nansen-cli@2.0.0
AI-agent CLI for Nansen API analytics, DEX swaps, and cross-chain trading
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource supports a warning for opt-in forwarding of an existing service credential to an unrestricted HTTPS recipient and guarded agent setup. It does not establish malicious behavior warranting a publication block.
Static reason
One or more suspicious static signals were detected.
Trigger
Run nansen mcp verify with a custom --url and --send-api-key while an existing API key is selected.
Impact
The chosen endpoint can receive the Nansen credential. Explicit agent setup also stores credentials in local client configuration.
Mechanism
The flag permits forwarding the selected key to a custom host, and the authenticated verification request includes it in a header.
AI rationale
Source supports a warning for opt-in forwarding of an existing service credential to an unrestricted HTTPS recipient and guarded agent setup. It does not establish malicious behavior warranting a publication block.
Evidence
src/auth-credentials.jssrc/cli.jssrc/commands/mcp.jssrc/mcp-verify.jsscripts/postinstall.js.claude.json.cursor/mcp.json
Network endpoints1
mcp.nansen.ai/ra/mcp
Decision evidence
public snapshotAI called this Suspicious at 97.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- Credential resolution can select an existing API key from saved configuration.
- The active MCP command accepts a custom URL and enables saved-key forwarding through the explicit --send-api-key flag; HTTPS destinations have no service host allowlist.
- After server reachability succeeds, verification sends the selected key in an authenticated POST to that URL; redirects are refused.
- Explicit MCP install commands merge a Nansen server entry into agent configuration and back up existing files.
- Postinstall skill setup requires an affirmative response to a default-no prompt.
Evidence against
- No covert credential export or malicious intent was established.
- Local installs and noninteractive onboarding skip skill installation.
- Doctor platform checks support local diagnostics, and transfer operations use caller-supplied recipients.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetwork
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/wallet.jsView file
444patternName = generic_password
severity = medium
line = 444
Medium
749
Findings
3 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitysrc/doctor.js
HighSemantic Analysis Limitedsrc/transfer.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patternsrc/wallet.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/wallet.js
MediumSecret Patternsrc/wallet.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nansen-cli@2.0.0.
See all versions of nansen-cli for other recorded verdicts.
- Review the evidence and your use of nansen-cli@2.0.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.