Sato Check · Package
@nirholas/universal-crypto-mcp
npm:@nirholas/universal-crypto-mcp · v1.1.3 · sha256:6cbd230d2424 · as of 2026-09-27
- Does it take your key? traced
- Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.
- Our static read of the published artifact found it.
- Does your key leave? no evidence
- Not yet run — we have not run this version with planted test keys.
- No evidence line on file for this question yet.
- Can it move funds on its own? no evidence
- Unknown — we could not read what it exposes.
- No evidence line on file for this question yet.
- What changed? no evidence
- First profile of this subject — nothing to compare yet.
- No evidence line on file for this question yet.
Is this your project? Respond →Dispute this reading
Hosts contacted
| Host | When | Role | Evidence |
|---|---|---|---|
| akash-api.polkachu.com | code | other | traced |
| api-optimistic.etherscan.io | code | other | traced |
| api-sepolia.etherscan.io | code | other | traced |
| api-v2.rubic.exchange | code | other | traced |
| api.1inch.dev | code | other | traced |
| api.alternative.me | code | other | traced |
| api.arbiscan.io | code | other | traced |
| api.basescan.org | code | other | traced |
| api.bscscan.com | code | other | traced |
| api.coingecko.com | code | other | traced |
| api.devnet.solana.com | code | rpc | traced |
| api.dexpaprika.com | code | other | traced |
| api.duckduckgo.com | code | other | traced |
| api.etherscan.io | code | other | traced |
| api.ftmscan.com | code | other | traced |
| api.geckoterminal.com | code | other | traced |
| api.gopluslabs.io | code | other | traced |
| api.llama.fi | code | other | traced |
| api.mainnet-beta.solana.com | code | rpc | traced |
| api.polygonscan.com | code | other | traced |
| api.securerpc.com | code | other | traced |
| api.snowtrace.io | code | other | traced |
| api.sperax.io | code | other | traced |
| app.uniswap.org | code | other | traced |
| arb-mainnet.g.alchemy.com | code | rpc | traced |
| arb1.arbitrum.io | code | other | traced |
| arbiscan.io | code | other | traced |
| arbitrum.io | code | other | traced |
| babel-api.mainnet.iotex.io | code | other | traced |
| babel-api.testnet.iotex.io | code | other | traced |
| basescan.org | code | other | traced |
| bsc-dataseed.binance.org | code | other | traced |
| bsc-ws-node.nariox.org | code | other | traced |
| bscscan.com | code | other | traced |
| builder0x69.io | code | other | traced |
| coins.llama.fi | code | other | traced |
| cosmos-rest.publicnode.com | code | rpc | traced |
| data-seed-prebsc-1-s1.binance.org | code | other | traced |
| docs.dexpaprika.com | code | other | traced |
| docs.sperax.io | code | other | traced |
| eth-sepolia.g.alchemy.com | code | rpc | traced |
| eth.llamarpc.com | code | rpc | traced |
| etherscan.io | code | other | traced |
| explorer.solana.com | code | rpc | traced |
| faucet.arbitrum.io | code | other | traced |
| free-crypto-news.vercel.app | code | other | traced |
| ftmscan.com | code | other | traced |
| fullnode.mainnet.aptoslabs.com | code | other | traced |
| fullnode.mainnet.sui.io | code | other | traced |
| github.com | code | registry | traced |
| injective-api.polkachu.com | code | other | traced |
| ipfs.io | code | other | traced |
| juno-api.polkachu.com | code | other | traced |
| livenet.xrpl.org | code | other | traced |
| lunarcrush.com | code | other | traced |
| mainnet.base.org | code | rpc | traced |
| mainnet.infura.io | code | rpc | traced |
| mainnet.optimism.io | code | rpc | traced |
| min-api.cryptocompare.com | code | other | traced |
| near-explorer-mainnet-api.near.org | code | other | traced |
Evidence (79 lines)
- tracedT-key-read2026-09-27
Reads process.env.X402_PRIVATE_KEY.
dist/index.js:1113
- tracedT-key-read2026-09-27
Reads process.env.X402_PRIVATE_KEY.
dist/index.js:1124
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:4836
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:7152
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:7247
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:7329
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:7425
- tracedT-key-read2026-09-27
Reads process.env.PRIVATE_KEY.
dist/index.js:7576
- tracedT-hosts2026-09-27
akash-api.polkachu.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api-optimistic.etherscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api-sepolia.etherscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api-v2.rubic.exchange appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.1inch.dev appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.alternative.me appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.arbiscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.basescan.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.bscscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.coingecko.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.devnet.solana.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
api.dexpaprika.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.duckduckgo.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.etherscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.ftmscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.geckoterminal.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.gopluslabs.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.llama.fi appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.mainnet-beta.solana.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
api.polygonscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.securerpc.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.snowtrace.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
api.sperax.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
app.uniswap.org appears in shipped code (other).
dist/x402/cli/index.js
- tracedT-hosts2026-09-27
arb-mainnet.g.alchemy.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
arb1.arbitrum.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
arbiscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
arbitrum.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
babel-api.mainnet.iotex.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
babel-api.testnet.iotex.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
basescan.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
bsc-dataseed.binance.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
bsc-ws-node.nariox.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
bscscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
builder0x69.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
coins.llama.fi appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
cosmos-rest.publicnode.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
data-seed-prebsc-1-s1.binance.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
docs.dexpaprika.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
docs.sperax.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
eth-sepolia.g.alchemy.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
eth.llamarpc.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
etherscan.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
explorer.solana.com appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
faucet.arbitrum.io appears in shipped code (other).
dist/x402/cli/index.js
- tracedT-hosts2026-09-27
free-crypto-news.vercel.app appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
ftmscan.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
fullnode.mainnet.aptoslabs.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
fullnode.mainnet.sui.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
github.com appears in shipped code (registry).
dist/index.js
- tracedT-hosts2026-09-27
injective-api.polkachu.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
ipfs.io appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
juno-api.polkachu.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
livenet.xrpl.org appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
lunarcrush.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
mainnet.base.org appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
mainnet.infura.io appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
mainnet.optimism.io appears in shipped code (rpc).
dist/index.js
- tracedT-hosts2026-09-27
min-api.cryptocompare.com appears in shipped code (other).
dist/index.js
- tracedT-hosts2026-09-27
near-explorer-mainnet-api.near.org appears in shipped code (other).
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names X402_PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names X402_SVM_PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names X402_EVM_PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names SOLANA_PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names XRP_PRIVATE_KEY in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names XRP_MNEMONIC in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names TON_MNEMONIC in a message to the user.
dist/index.js
- tracedT-key-named2026-09-27
The shipped code names X402_SPONSOR_PRIVATE_KEY in a message to the user.
dist/index.js
- declaredD-env-key2026-09-27
Setup names PRIVATE_KEY as something to provide.
deploy_spec.requires
- declaredD-env-key2026-09-27
Setup names X402_PRIVATE_KEY as something to provide.
deploy_spec.requires
Limits
- The observed lane has not run on this version: not yet run on this version
- Traced analysis follows flows inside one module only; a key handed from one module to another is not followed.
- The observed lane has not run on this version.
- No tool inventory was available, so fund actions were not read.
- Traced: 101 literal hosts; listed the first 60; 70 key reads; the first 8 are listed.
A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".
sato.custody/v1 · custody-1
Maintain this project? Respond to this reading
Loading sign-in…