Fundchain MCP Server

This MCP server provides tools for creating and managing crypto crowdfunding campaigns on Fundchain.ai. While the code is well-structured and uses proper MCP SDK patterns, there are significant security and design concerns: (1) the donate_to_campaign tool provides instructions for autonomous x402 donations without requiring explicit user consent or transaction review, creating potential for unauthorized fund transfers; (2) wallet_address parameter in create_campaign is optional and user-controlled, which could enable campaign impersonation if not validated server-side; (3) no authentication or API key validation is implemented despite interacting with a financial/crypto service; (4) error handling masks API responses in some cases, reducing transparency. These issues are concerning for a financial application. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 2 high severity).

3 files analyzed · 10 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.