guarddog-mcp@1.0.1
🐕 Check if a token is SAFE before your AI agent trades it — one call, PASS/WARN/BLOCK. MCP server for AgentTradeGuard: honeypot detection, contract audit, liquidity structure, 4 live sources (GoPlus/Etherscan/DEX Screener/honeypot.is), millisecond verdic
AI Security Review
scanned 3d ago · by lpm-firewall-aiThe default launcher sends an undocumented activation beacon on every server start. Its observed payload is limited to package, version, stage, and optional error text, so this warrants a warning for telemetry rather than a malicious verdict.
Decision evidence
public snapshot- The launcher sends an activation beacon to api.guarddog.top whenever the MCP server starts, by default and without a documented opt-out.
- The beacon reports the package name, version, stage, and optionally a truncated error string; no host identity or credentials are included in that payload.
- The main API request sends a user-selected chain, token address, and action to the package’s advertised token-check service.
- The package has no install lifecycle scripts.
Source & flagged code
5 flaggedSource collects local host identity data and sends it to an external endpoint.
bin/guarddog-mcp.jsView on unpkg · L5The launcher sends an activation beacon to api.guarddog.top whenever the MCP server starts, by default and without a documented opt-out.
bin/guarddog-mcp.jsView on unpkg · L18Findings
Affected versions and remediation
This report applies to guarddog-mcp@1.0.1.
See all versions of guarddog-mcp for other recorded verdicts.
- Review the evidence and your use of guarddog-mcp@1.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.