nansen-cli@2.0.1
AI-agent CLI for Nansen API analytics, DEX swaps, and cross-chain trading
AI Security Review
scanned 1mo ago · by lpm-firewall-aiSource establishes opt-in forwarding of an existing service credential to a custom endpoint, warranting a warning under the credential forwarding policy. Guarded skill installation and explicit agent configuration commands do not establish block-eligible malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Run nansen mcp verify with --url and --send-api-key, using an existing API key.
Impact
The selected endpoint can receive the existing service credential. Consent reduces covert exposure but does not bind the key to its intended service.
Mechanism
The command resolves the existing credential and places it in an authenticated POST request to the selected endpoint without restricting HTTPS hosts to Nansen.
AI rationale
Source establishes opt-in forwarding of an existing service credential to a custom endpoint, warranting a warning under the credential forwarding policy. Guarded skill installation and explicit agent configuration commands do not establish block-eligible malicious behavior.
Evidence
src/auth-credentials.jssrc/commands/mcp.jssrc/mcp-verify.js
Network endpoints1
mcp.nansen.ai/ra/mcp
Decision evidence
public snapshotAI called this Suspicious at 96.0% confidence as Dangerous Capability with low false-positive risk.
Evidence for warning
- MCP verification selects an existing API key from authentication configuration or NANSEN_API_KEY.
- The explicit MCP verify command accepts a custom URL; --send-api-key permits forwarding the saved key without a service host allowlist.
- Authenticated verification sends the selected key in a POST request to that URL; redirects are refused.
- Explicit MCP installation merges a Nansen server entry into agent configuration and backs up existing configuration.
- The postinstall skill installer requires an affirmative response before invoking the external installer.
Evidence against
- Custom endpoint credential forwarding requires explicit consent and rejects public plain HTTP destinations.
- No covert credential export or unconsented install-time agent configuration mutation was established.
- Inspected transfer code validates recipients and uses wallet credentials for requested transactions; doctor code reports local diagnostic state.
Behavioral surface
ChildProcessCryptoEnvironmentVars
Source & flagged code
7 flaggedpackage.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgsrc/wallet.jsView file
444patternName = generic_password
severity = medium
line = 444
Medium
749
Findings
3 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighSandbox Evasion Gated Capabilitysrc/doctor.js
HighSemantic Analysis Limitedsrc/transfer.js#virtual:normalized:round1
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumSecret Patternsrc/wallet.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumSecret Patternsrc/wallet.js
MediumSecret Patternsrc/wallet.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nansen-cli@2.0.1.
See all versions of nansen-cli for other recorded verdicts.
- Review the evidence and your use of nansen-cli@2.0.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.