mcp-server

The server stores a Solana wallet locally (`~/.portals/wallet.json`) with mode 0600 permissions, which is good practice. It explicitly requires a `PORTALS_WHITELIST` to prevent agents from accessing arbitrary portals. Input validation for tool arguments is performed against fetched OpenAPI schemas using Ajv. The fetching of OpenAPI schemas via `axios.get` from whitelisted portal URLs (which are retrieved from on-chain registry) introduces a potential, though mitigated, risk if a whitelisted portal were to serve a malicious or extremely large schema designed to exploit `axios` or `ajv` parsers. The `refreshPortals` function, which includes these network calls, is invoked on every tool request, adding a slight performance overhead but no immediate critical security flaw.