nansen-cli@1.45.0
AI-agent CLI for Nansen API analytics, DEX swaps, and cross-chain trading
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource establishes opt-in forwarding of an existing service credential to an unrestricted user-selected HTTPS host, warranting a warning under the credential forwarding policy. The inspected behavior does not support a malware verdict or publication block.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Running nansen mcp verify with a custom --url and --send-api-key while an existing API key is configured.
Impact
The selected server can receive and retain the Nansen API key.
Mechanism
The command resolves the saved credential, permits the custom destination after explicit opt-in, and sends an authenticated MCP request without restricting HTTPS hosts to Nansen.
AI rationale
Source establishes opt-in forwarding of an existing service credential to an unrestricted user-selected HTTPS host, warranting a warning under the credential forwarding policy. The inspected behavior does not support a malware verdict or publication block.
Evidence
src/doctor.jssrc/commands/mcp.jssrc/mcp-verify.js
Network endpoints1
mcp.nansen.ai/ra/mcp
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- src/doctor.js resolves the existing Nansen API key from saved configuration or NANSEN_API_KEY.
- The MCP verification command accepts a custom URL and requires --send-api-key to forward a saved key there; HTTPS destinations are not restricted to Nansen.
- After successful unauthenticated reachability checking, verification sends the key in the NANSEN-API-KEY header of an authenticated request.
- Explicit MCP install commands merge a Nansen server entry into agent configuration and back up existing configuration.
- Global interactive postinstall onboarding prompts before installing the Nansen coding skill.
Evidence against
- Custom verification withholds saved credentials by default, refuses public plain HTTP destinations, and disables redirects.
- MCP installation uses a fixed Nansen endpoint and a pinned bridge version.
- The update checker fetches registry version metadata and caches it; inspected code does not execute downloaded payloads.
- No covert credential theft or unconsented broad agent configuration mutation was established.
Behavioral surface
Source & flagged code
8 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 4
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/wallet.jsView file
Findings
4 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitysrc/doctor.js
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltasrc/update-check.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patternsrc/wallet.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/wallet.js
MediumSecret Patternsrc/wallet.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Low
Affected versions and remediation
This report applies to nansen-cli@1.45.0.
See all versions of nansen-cli for other recorded verdicts.
- Review the evidence and your use of nansen-cli@1.45.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.