amadeus-mcp

The server uses environment variables for sensitive configurations like blockchain RPC URLs and the testnet faucet's secret key (`AMADEUS_TESTNET_SK`), which is good practice. Input validation is performed on incoming API parameters using `validator`. Transaction creation returns an unsigned blob, requiring external signing (BLS12-381) before submission, which enhances security by keeping private keys off the server. The testnet faucet (`claim_testnet_ama`) implements an IP-based 24-hour cooldown using Cloudflare D1, which provides a basic level of abuse prevention for a testnet resource. No obvious `eval` or malicious code patterns were found. Network requests include retry logic. Overall, the security practices appear solid for its stated purpose.