Sato Hub
Package

crypto-quant-signal-mcp

npm:crypto-quant-signal-mcp · v1.34.0 · sha256:b2f24b46b6ac · as of 2026-11-09

Does it take your key?
traced
Yes — it reads private-key material. Local signing is what a wallet does; question 2 says whether the key leaves.
Our static read of the published artifact found it.
Does your key leave?
observed
Not observed — no planted key left during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
We ran it with planted test keys and saw it.
Can it move funds on its own?
declared
Yes — 1 action can sign or send funds when called: pre_trade_check (trade, limit unknown).
The project says so — README, config, env list or tool description.
What changed?
observed
Since 1.33.0: adds a request to open-api-vst.bingx.com; adds a request to open-api.bingx.com; adds a request to openidconnect.googleapis.com; ….
We ran it with planted test keys and saw it.

Is this your project? Respond →Dispute this reading

Hosts contacted

HostWhenRoleEvidence
1rpc.iocodeothertraced
accounts.google.comcodeothertraced
agent.binance.comcodeothertraced
algovault.comcodevendortraced
api-cloud-v2.bitmart.comcodeothertraced
api-contract.weex.comcodeothertraced
api-futures.kucoin.comcodeothertraced
api-testnet.gateapi.iocodeothertraced
api.algovault.comcodevendortraced
api.bitget.comcodeothertraced
api.bybit.comcodeothertraced
api.cdp.coinbase.comcodeothertraced
api.gateio.wscodeothertraced
api.github.comcoderegistrytraced
api.hbdm.comcodeothertraced
api.hyperliquid.xyzcodeothertraced
api.npmjs.orgcodeothertraced
api.openai.comcodeothertraced
api.perplexity.aicodeothertraced
api.phemex.comcodeothertraced
api.pinata.cloudcodeothertraced
api.producthunt.comcodeothertraced
api.sandbox.gemini.comcodeothertraced
api.stackexchange.comcodeothertraced
api.telegram.orgcodeothertraced
base.drpc.orgcoderpctraced
base.publicnode.comcoderpctraced
basescan.orgcodeothertraced
cdn.tailwindcss.comcodeothertraced
challenges.cloudflare.comcodeothertraced
contract.mexc.comcodeothertraced
dashboard.stripe.comcodeothertraced
docs.crewai.comcodeothertraced
fapi.asterdex-testnet.comcodeothertraced
fapi.asterdex.comcodeothertraced
fapi.binance.comcodeothertraced
fapi.xt.comcodeothertraced
fonts.googleapis.comcodeothertraced
fonts.gstatic.comcodeothertraced
gateway-api-testnet.circle.comcodeothertraced
gateway-api.circle.comcodeothertraced
gateway.circle.comcodeothertraced
generativelanguage.googleapis.comcodeothertraced
github.comcoderegistrytraced
glama.aicodeothertraced
gql.hashnode.comcodeothertraced
hist.databento.comcodeothertraced
hn.algolia.comcodeothertraced
learn.microsoft.comcodeothertraced
mainnet.base.orgcoderpctraced
news.ycombinator.comcodeothertraced
oauth2.googleapis.comcodeothertraced
open-api-vst.bingx.comcodeothertraced
open-api.bingx.comcodeothertraced
openidconnect.googleapis.comcodeothertraced
plausible.algovault.comcodevendortraced
pro.edgex.exchangecodeothertraced
pypi.orgcoderegistrytraced
t.mecodeothertraced
web3.okx.comcodeothertraced
registry.npmjs.orginstallregistryobserved
Evidence (70 lines)
  • observedO-hosts2026-11-09

    registry.npmjs.org was contacted during install (registry).

    sandbox:obs_99f4bcc7aad7a25e

  • tracedT-key-read2026-11-09

    Reads process.env.FACILITATOR_PRIVATE_KEY.

    dist/facilitator.js:34

  • tracedT-key-read2026-11-09

    Reads process.env.CDP_WALLET_SECRET.

    dist/lib/payout-config.js:68

  • tracedT-key-read2026-11-09

    Reads process.env.BUYER_SIGNER_PRIVATE_KEY.

    dist/scripts/acp-graduation-buyer.js:66

  • tracedT-key-read2026-11-09

    Reads process.env.ACP_SIGNER_PRIVATE_KEY.

    dist/channels/acp/provider.js:37

  • tracedT-hosts2026-11-09

    1rpc.io appears in shipped code (other).

    dist/scripts/monitor.js

  • tracedT-hosts2026-11-09

    accounts.google.com appears in shipped code (other).

    dist/lib/auth-providers.js

  • tracedT-hosts2026-11-09

    agent.binance.com appears in shipped code (other).

    dist/lib/integrations-data/exchange-kits.js

  • tracedT-hosts2026-11-09

    algovault.com appears in shipped code (vendor).

    dist/index.js

  • tracedT-hosts2026-11-09

    api-cloud-v2.bitmart.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    api-contract.weex.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    api-futures.kucoin.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    api-testnet.gateapi.io appears in shipped code (other).

    dist/lib/integrations-data/exchange-kits.js

  • tracedT-hosts2026-11-09

    api.algovault.com appears in shipped code (vendor).

    dist/index.js

  • tracedT-hosts2026-11-09

    api.bitget.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    api.bybit.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    api.cdp.coinbase.com appears in shipped code (other).

    dist/lib/x402-facilitator.js

  • tracedT-hosts2026-11-09

    api.gateio.ws appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    api.github.com appears in shipped code (registry).

    dist/lib/auth-providers.js

  • tracedT-hosts2026-11-09

    api.hbdm.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    api.hyperliquid.xyz appears in shipped code (other).

    dist/scripts/backfill-funding-episodes.js

  • tracedT-hosts2026-11-09

    api.npmjs.org appears in shipped code (other).

    dist/lib/funnel-snapshot.js

  • tracedT-hosts2026-11-09

    api.openai.com appears in shipped code (other).

    dist/lib/llm-provider.js

  • tracedT-hosts2026-11-09

    api.perplexity.ai appears in shipped code (other).

    dist/lib/llm-provider.js

  • tracedT-hosts2026-11-09

    api.phemex.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    api.pinata.cloud appears in shipped code (other).

    dist/scripts/register-erc8004-agent.js

  • tracedT-hosts2026-11-09

    api.producthunt.com appears in shipped code (other).

    dist/lib/footer-content.js

  • tracedT-hosts2026-11-09

    api.sandbox.gemini.com appears in shipped code (other).

    dist/lib/integrations-data/exchange-kits.js

  • tracedT-hosts2026-11-09

    api.stackexchange.com appears in shipped code (other).

    dist/scripts/geo-demand-mining.js

  • tracedT-hosts2026-11-09

    api.telegram.org appears in shipped code (other).

    dist/lib/telegram.js

  • tracedT-hosts2026-11-09

    base.drpc.org appears in shipped code (rpc).

    dist/scripts/monitor.js

  • tracedT-hosts2026-11-09

    base.publicnode.com appears in shipped code (rpc).

    dist/scripts/monitor.js

  • tracedT-hosts2026-11-09

    basescan.org appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    cdn.tailwindcss.com appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    challenges.cloudflare.com appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    contract.mexc.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    dashboard.stripe.com appears in shipped code (other).

    dist/scripts/stripe-rak-smoke.js

  • tracedT-hosts2026-11-09

    docs.crewai.com appears in shipped code (other).

    dist/lib/integrations-data/ai-agents.js

  • tracedT-hosts2026-11-09

    fapi.asterdex-testnet.com appears in shipped code (other).

    dist/lib/integrations-data/exchange-kits.js

  • tracedT-hosts2026-11-09

    fapi.asterdex.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    fapi.binance.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    fapi.xt.com appears in shipped code (other).

    dist/lib/exchange-universe.js

  • tracedT-hosts2026-11-09

    fonts.googleapis.com appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    fonts.gstatic.com appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    gateway-api-testnet.circle.com appears in shipped code (other).

    dist/lib/circle-gateway.js

  • tracedT-hosts2026-11-09

    gateway-api.circle.com appears in shipped code (other).

    dist/lib/circle-gateway.js

  • tracedT-hosts2026-11-09

    gateway.circle.com appears in shipped code (other).

    dist/lib/circle-gateway.js

  • tracedT-hosts2026-11-09

    generativelanguage.googleapis.com appears in shipped code (other).

    dist/lib/llm-provider.js

  • tracedT-hosts2026-11-09

    github.com appears in shipped code (registry).

    dist/index.js

  • tracedT-hosts2026-11-09

    glama.ai appears in shipped code (other).

    dist/index.js

  • tracedT-hosts2026-11-09

    gql.hashnode.com appears in shipped code (other).

    dist/lib/forum-post-verify.js

  • tracedT-hosts2026-11-09

    hist.databento.com appears in shipped code (other).

    dist/lib/equities/equity-constants.js

  • tracedT-hosts2026-11-09

    hn.algolia.com appears in shipped code (other).

    dist/scripts/geo-demand-mining.js

  • tracedT-hosts2026-11-09

    learn.microsoft.com appears in shipped code (other).

    dist/lib/integrations-data/ai-agents.js

  • tracedT-hosts2026-11-09

    mainnet.base.org appears in shipped code (rpc).

    dist/lib/erc8004.js

  • tracedT-hosts2026-11-09

    news.ycombinator.com appears in shipped code (other).

    dist/scripts/geo-demand-mining.js

  • tracedT-hosts2026-11-09

    oauth2.googleapis.com appears in shipped code (other).

    dist/lib/auth-providers.js

  • tracedT-hosts2026-11-09

    open-api-vst.bingx.com appears in shipped code (other).

    dist/lib/integrations-data/exchange-kits.js

  • tracedT-hosts2026-11-09

    open-api.bingx.com appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    openidconnect.googleapis.com appears in shipped code (other).

    dist/lib/auth-providers.js

  • tracedT-hosts2026-11-09

    plausible.algovault.com appears in shipped code (vendor).

    dist/index.js

  • tracedT-hosts2026-11-09

    pro.edgex.exchange appears in shipped code (other).

    dist/lib/asset-class-detection.js

  • tracedT-hosts2026-11-09

    pypi.org appears in shipped code (registry).

    dist/lib/integrations-data/ai-agents.js

  • tracedT-hosts2026-11-09

    t.me appears in shipped code (other).

    dist/lib/channel-registry.js

  • tracedT-hosts2026-11-09

    web3.okx.com appears in shipped code (other).

    dist/lib/okx-a2mcp-config.js

  • tracedT-key-named2026-11-09

    The shipped code names FACILITATOR_PRIVATE_KEY in a message to the user.

    dist/facilitator.js

  • tracedT-key-named2026-11-09

    The shipped code names CDP_WALLET_SECRET in a message to the user.

    dist/lib/referral-pages.js

  • tracedT-key-named2026-11-09

    The shipped code names BUYER_SIGNER_PRIVATE_KEY in a message to the user.

    dist/scripts/acp-graduation-buyer.js

  • tracedT-key-named2026-11-09

    The shipped code names ACP_SIGNER_PRIVATE_KEY in a message to the user.

    dist/channels/acp/seller-worker.js

  • declaredD-fund-tool2026-11-09

    Tool pre_trade_check is described as a trade action.

    tools/list

Limits

  • Traced analysis follows flows inside one module and one hop across a relative import; a longer chain is not followed.
  • Key egress not observed during install and start-up, under our test conditions — code paths that only run later, or only on a trigger, are not covered.
  • Sandbox: DNS queries made directly by the target are not logged; hosts are recorded from proxied HTTP(S) requests and CONNECTs..
  • Sandbox: Code that ignores HTTP(S)_PROXY has no route out of the sandbox, so its attempts are not captured..
  • Traced: 443 code files; parsed 400, entry points first; 71 literal hosts; listed the first 60.

A profile describes what we read and ran, with dates. It is not a safety rating, an audit or an endorsement, and "not found" is not "not there".

sato.custody/v1 · custody-3

Maintain this project? Respond to this reading

Loading sign-in…