Security at Sato Hub
How it is built, what we never do, and how to report a problem.
Sato Hub runs a public MCP server, mostly read-only and never custodial, and a set of open data feeds. This page states the posture plainly, for researchers and for the automated scanners that check us daily.
We are not audited
No third party has audited this codebase or this infrastructure. We have not commissioned a penetration test, we hold no certification, and nothing on this site should be read as implying otherwise. The same rule we apply to every listing applies to us: absent evidence is published as absent. When that changes, this paragraph will say so and will name who did the work.
Reporting something
Email satohub88@gmail.com, or open an issue on the public repository for anything that is not sensitive. Please include what you did, what happened, and what you expected — a reproduction is worth more than a scanner output.
We do not run a paid bounty. We will credit you if you want the credit, and we will tell you what we changed.
https://satohub.ai/.well-known/security.txt
Disclosure policy
Report privately first and give us time to fix it. We will acknowledge a report within five working days and tell you what we found, whether or not we agree it is a problem. We ask for ninety days before public disclosure, and we will not ask for more than that or ask you to stay quiet afterwards. We will never threaten legal action over a report made in good faith under this policy.
In scope: this site and its API, the public MCP server at /api/mcp, the data feeds under /api/export, the Agent Passport and listing-claim flows, the signing and attestation surfaces described below, and anything that lets one party change what another party sees.
Out of scope: the projects we list — they are other people’s software, and a finding about one belongs to its maintainers, though we would like to know so the listing can reflect it. Also out of scope: denial of service, volumetric or automated scanning, social engineering, physical access, findings that require a compromised device, and reports consisting only of a scanner’s output with no demonstrated impact.
Please do not run destructive tests, do not access data that is not yours, and do not degrade the service for other people. Everything worth testing here is free and unauthenticated, so there is rarely a reason to.
What we never do
The useful version of a security posture is not a list of promises. It is a list of capabilities the system does not have, because a capability that does not exist cannot be abused, leaked, or turned against a user by whoever ends up holding the keys.
We never hold a private key or take custody of funds
Sato Route returns an unsigned transaction; you sign it with your own wallet. There is no account to fund here, no balance to withdraw, and no path in the codebase that moves anyone's money.
We never execute anything on your behalf
Every tool on the public MCP server reads. Nothing submits a transaction, calls a contract, deploys code, or installs a package. A build plan is text; running it is your decision, on your machine.
We never relay, forward, net or settle a payment
Where a fee exists it is a parameter inside the transaction you sign or an entry in a venue's own reward split, disclosed before signing. We are not a facilitator, an intermediary or a counterparty to anything.
We never ask for a seed phrase, and we never ask for credentials
The one place a signature is used is proving control of a key when registering an Agent Passport, where only the signature is verified. If anything claiming to be Sato Hub asks you for a seed phrase, it is not us.
How to check us without trusting us
Signed responses. Preflight verdicts, Sato Route decisions and score proofs leave here with a detached Ed25519 signature over the exact bytes and the timestamp. The public keys are at /.well-known/jwks.json and the construction is written out at /.well-known/sato-signing.json. Anyone holding a verdict in a CI log can confirm we issued it, on that date, unaltered. Retired keys stay published for ninety days so old statements keep verifying.
Anchored scores. Every morning, every Sato Score we publish is committed to one Merkle root. The roots are signed and published at /.well-known/sato-score-roots.json, and where an attestation key is configured the root is written to Ethereum Attestation Service on Base. Each listing’s verification record carries its proof and a command that folds it independently. The point is narrow and it is the point: we cannot quietly change what we said yesterday.
Neither of these makes a number correct. A signed wrong verdict is a wrong verdict, and an anchored wrong score is a wrong score with a receipt. What they remove is deniability, which is the part we were asking you to take on faith.
Something wrong with a listing?
That is not a security report and it does not need one. Every listing page carries a correction form — “Report an issue”, below the record — for a dead link, a wrong description, a project that has moved or shut down, or a listing that should not be here at all. It asks for no name and no email, so nobody can write back; corrections go into the review queue and are checked against the source. If a project is yours, the same page offers “Is this your project?” — prove control of a domain the listing already points at and you can correct the descriptive fields directly, which grants no verification, no score change and no badge, by design.
The posture
The MCP server moves no funds and holds no keys
Most tools at /api/mcp only read. 4 can change Sato Hub state, and each says so in its annotations: a watch stores the email address you give it, a project submission queues a listing for review, an agent registration creates a self-reported passport, and a swap in build-tx mode records a receipt for an unsigned transaction. None of them signs, holds a key, broadcasts or moves funds, and none takes an action on anyone's behalf. There is no key to hold because the data is public, under CC-BY-4.0.
No credentials, no wallets, no custody
Sato Hub never holds a private key, never takes custody of funds, and never asks for a seed phrase. Wallet signatures are used in one place — proving control of a key when registering an Agent Passport — and only the signature is verified, never stored as a secret.
What is collected
Anonymous usage events: which tool was called, a sanitised argument, a latency, a session identifier that is not tied to a person. No IP addresses, no cookies for tracking, no personal profiles. The MCP caller's user-agent is recorded because it is how we tell a monitoring bot from a real client.
Database access
Row Level Security is enabled on every public table with no policies, and the application is server-only through a service-role key. The public PostgREST/anon API is therefore denied by default rather than filtered.
Outbound fetches are guarded
Where the app fetches a URL on a user's behalf — verifying a listing claim, probing an endpoint — the target is checked against loopback, private and link-local ranges before the request, and redirects are not followed automatically.
What a claim or a registration proves
A claimed listing proves the claimant controls a domain that listing already points at. A registered Agent Passport with a verified wallet proves control of a key. Neither is an endorsement, neither changes a Sato Score, and neither can set a verification status — those are evidence-reviewed and unreachable from any self-service path.
If you are a scanner
You are welcome here — several of you check this server every day, and the handshake is deliberately cheap. Everything under /api/export and /api/mcp is free and unauthenticated, so there is no need to probe around them. If you publish a finding about this server, we would rather hear about it first — but we would rather you publish than stay quiet.