@blockrun/mcp
mcp:npm:@blockrun/mcp · v0.55.8 · sha256:449464000fe4 · as of 2026-11-10
- Does it take your key? traced
- Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.
- Our static read of the published artifact found it.
- Does your key leave? no evidence
- Not yet run — we have not run this version with planted test keys.
- No evidence line on file for this question yet.
- Can it move funds on its own? declared
- Unknown — we could not read what it exposes.
- The project says so — README, config, env list or tool description.
- What changed? traced
- No change in key, host or fund behaviour since 0.55.7.
- Our static read of the published artifact found it.
Is this your project? Respond →Dispute this reading
Hosts contacted
| Host | When | Role | Evidence |
|---|---|---|---|
| 1rpc.io | code | other | traced |
| api.blockrun.ai | code | vendor | traced |
| api.dexscreener.com | code | other | traced |
| arc-scan.org | code | other | traced |
| arc.blockrun.ai | code | vendor | traced |
| base.llamarpc.com | code | rpc | traced |
| basescan.org | code | other | traced |
| blockrun.ai | code | vendor | traced |
| bridge.base.org | code | rpc | traced |
| bridge.polymarket.com | code | other | traced |
| data-api.polymarket.com | code | other | traced |
| docs.polymarket.com | code | other | traced |
| gamma-api.polymarket.com | code | other | traced |
| github.com | code | registry | traced |
| mainnet.base.org | code | rpc | traced |
| pay.coinbase.com | code | other | traced |
| pm-egress-1092497648280.europe-north1.run.app | code | other | traced |
| polygon-bor-rpc.publicnode.com | code | rpc | traced |
| polygon.drpc.org | code | rpc | traced |
| polygonscan.com | code | other | traced |
| polymarket.com | code | other | traced |
| portalbridge.com | code | other | traced |
| registry.npmjs.org | code | registry | traced |
| relayer-v2.polymarket.com | code | other | traced |
| sol.blockrun.ai | code | vendor | traced |
| solscan.io | code | other | traced |
| user.blockrun.ai | code | vendor | traced |
| www.coinbase.com | code | other | traced |
Evidence (45 lines)
- tracedT-key-read2026-11-10
Reads process.env.SOLANA_WALLET_KEY.
dist/index.js:572
- tracedT-key-read2026-11-10
Reads process.env.BLOCKRUN_WALLET_KEY.
dist/index.js:572
- tracedT-key-read2026-11-10
Reads process.env.BASE_CHAIN_WALLET_KEY.
dist/index.js:572
- tracedT-key-read2026-11-10
Reads process.env.SOLANA_WALLET_KEY.
dist/index.js:1003
- tracedT-key-read2026-11-10
Reads process.env.BLOCKRUN_WALLET_KEY.
dist/chunk-EHYQJLDP.js:789
- tracedT-key-read2026-11-10
Reads process.env.BASE_CHAIN_WALLET_KEY.
dist/chunk-EHYQJLDP.js:789
- tracedT-key-read2026-11-10
Reads key file loaded by loadWallet().
dist/chunk-EHYQJLDP.js:795
- tracedT-key-read2026-11-10
Reads process.env.SOLANA_WALLET_KEY.
dist/chunk-EHYQJLDP.js:824
- tracedT-hosts2026-11-10
1rpc.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
api.blockrun.ai appears in shipped code (vendor).
dist/chunk-EHYQJLDP.js
- tracedT-hosts2026-11-10
api.dexscreener.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
arc-scan.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
arc.blockrun.ai appears in shipped code (vendor).
dist/chunk-EHYQJLDP.js
- tracedT-hosts2026-11-10
base.llamarpc.com appears in shipped code (rpc).
dist/chunk-EHYQJLDP.js
- tracedT-hosts2026-11-10
basescan.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
blockrun.ai appears in shipped code (vendor).
dist/index.js
- tracedT-hosts2026-11-10
bridge.base.org appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-11-10
bridge.polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
data-api.polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
docs.polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
gamma-api.polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
github.com appears in shipped code (registry).
dist/index.js
- tracedT-hosts2026-11-10
mainnet.base.org appears in shipped code (rpc).
dist/chunk-EHYQJLDP.js
- tracedT-hosts2026-11-10
pay.coinbase.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
pm-egress-1092497648280.europe-north1.run.app appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
polygon-bor-rpc.publicnode.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-11-10
polygon.drpc.org appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-11-10
polygonscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
portalbridge.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
registry.npmjs.org appears in shipped code (registry).
dist/index.js
- tracedT-hosts2026-11-10
relayer-v2.polymarket.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
sol.blockrun.ai appears in shipped code (vendor).
dist/chunk-EHYQJLDP.js
- tracedT-hosts2026-11-10
solscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-11-10
user.blockrun.ai appears in shipped code (vendor).
dist/index.js
- tracedT-hosts2026-11-10
www.coinbase.com appears in shipped code (other).
dist/index.js
- tracedT-key-named2026-11-10
The shipped code names SOLANA_WALLET_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-11-10
The shipped code names BLOCKRUN_WALLET_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-11-10
The shipped code names BASE_CHAIN_WALLET_KEY in a message to the user.
dist/index.js
- declaredD-env-key2026-11-10
Setup names SOLANA_WALLET_KEY as something to provide.
deploy_spec.requires
- declaredD-env-key2026-11-10
Setup names BLOCKRUN_WALLET_KEY as something to provide.
@blockrun/mcp@0.55.8/README.md
- declaredD-doc-funds2026-11-10
The project's own text says it carries out transactions: "<p>Agents can pay like agents: sign transactions from a wallet.<br>"
@blockrun/mcp@0.55.8/README.md (line 7)
- declaredD-doc-custody2026-11-10
The project's own text describes its custody model: "<strong>Two ways to pay, same tools:</strong> a self-custody <strong>wallet</strong> (USDC on Solana, Base or Arc, no account needed) — or a <strong>BlockRun API key</strong> backed by account credit. <a href="https://u…"
@blockrun/mcp@0.55.8/README.md (line 10)
- declaredD-doc-custody2026-11-10
The project's own text describes its custody model: "<em>Read the odds <strong>and</strong> place the bet, from one self-custody wallet.</em></p>"
@blockrun/mcp@0.55.8/README.md (line 11)
- declaredD-doc-funds2026-11-10
The project's own text says it carries out transactions: "Reads and acts — most tools deliver data; blockrun_polymarket places real, confirm-gated trades."
@blockrun/mcp@0.55.8/README.md (line 76)
Limits
- The observed lane has not run on this version: not yet run on this version
- Traced analysis follows flows inside one module and one hop across a relative import; a longer chain is not followed.
- The observed lane has not run on this version.
- No tool inventory was available, so fund actions were not read.
- Traced: 11 key reads; the first 8 are listed.
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
sato.custody/v1 · custody-3
Maintain this project? Respond to this reading
Loading sign-in…