registry / tapmarket-connect / 0.1.1

tapmarket-connect@0.1.1

Give your AI assistant the power to hire paid specialists on TapMarket — with spending limits enforced on-chain.

AI Security Review

scanned 12h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs `npx tapmarket-connect setup`, then an MCP client invokes `serve` and `hire_specialist`.

Impact

Claude Desktop can invoke TapMarket tools that spend from the created wallet within the package's smart-account permissions and send task inputs to TapMarket service endpoints.

Mechanism

explicit MCP agent capability setup for paid TapMarket actions

Rationale

Static inspection supports warning for explicit AI-agent capability setup and payment actions, but not a malicious block: there are no lifecycle hooks, no stealth execution, and no observed key/credential exfiltration. Because it mutates Claude MCP config and enables paid agent actions, it should not be marked fully clean.

Evidence

package.jsoncli.jsserver.jsinit-lib.jscatalog.jsowner-tools.js~/.tapmarket/wallet.json~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%/Claude/claude_desktop_config.json~/.config/Claude/claude_desktop_config.json~/.tapmarket/hires.jsonl

Network endpoints7

fund.tappayment.io/fundfaucet.circle.comsepolia.base.orgrpc.zerodev.app/api/v3/${ZERODEV_PROJECT_ID}/chain/84532hermes.tappayment.io/assessscribe.tappayment.io/writesepolia.basescan.org/tx/

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

cli.js setup writes Claude Desktop MCP config to run `npx -y tapmarket-connect@latest serve`.
cli.js setup creates ~/.tapmarket/wallet.json containing ownerKey/sessionApproval and posts wallet address to fund.tappayment.io.
server.js exposes MCP hire_specialist tool that spends USDC via ZeroDev/Base Sepolia and sends user input to catalog endpoints.
catalog.js routes user-supplied specialist input to hermes.tappayment.io and scribe.tappayment.io.
server.js logs hire records to ~/.tapmarket/hires.jsonl.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts.
Claude config mutation is gated behind explicit `tapmarket-connect setup`, not install/import time.
No child_process, eval/vm/Function, native binary loading, or hidden remote payload execution found.
Network endpoints are package-aligned payment/faucet/specialist RPC endpoints for the advertised TapMarket connector.
Wallet keys are generated locally and read locally; inspected code does not exfiltrate ownerKey or sessionApproval.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 21.4 KB of source, external domains: faucet.circle.com, fund.tappayment.io, hermes.tappayment.io, rpc.zerodev.app, scribe.tappayment.io, sepolia.base.org, sepolia.basescan.org

Source & flagged code

3 flagged

server.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// TapMarket MCP server — lets any MCP client (Claude, OpenClaw, etc.) hire paid

3// specialists on TapMarket. Crypto hidden; charges and limits always visible.

4import { Server } from "@modelcontextprotocol/sdk/server/index.js";

5import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

6import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

7import { createPublicClient, http, parseAbi, encodeFunctionData, formatUnits } from "viem";

8import { baseSepolia } from "viem/chains";

9import { createKernelAccountClient } from "@zerodev/sdk";

10import { KERNEL_V3_1, getEntryPoint } from "@zerodev/sdk/constants";

11import { deserializePermissionAccount } from "@zerodev/permissions";

12import { config } from "dotenv";

13import { appendFileSync } from "fs";

14import { homedir } from "os";

15import { join } from "path";

16import { CATALOG } from "./catalog.js";

17import { ZERODEV_RPC as ZRPC } from "./init-lib.js";

18import { readFileSync, existsSync } from "fs";

20const WALLET_FILE = process.env.TAPMARKET_WALLET ?? new URL("./wallet.json", import.meta.url).pathname;

21if (!existsSync(WALLET_FILE)) {

22 console.error("No wallet found. Run: npx tapmarket-connect setup");

23 process.exit(1);

24}

25const wallet = JSON.parse(readFileSync(WALLET_FILE, "utf8"));

27config({ path: new URL("../.env.local", import.meta.url).pathname, quiet: true });

29const TAP_MARKET = "0xBfd085f192d2246F1BFBe386DF399335dc894f2c";

30const USDC = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";

31const ZERODEV_RPC = ZRPC;

32// routes now come from catalog entries (endpoint + shape)

34const marketAbi = parseAbi(["function buyPack(uint256 listingId, uint256 numUses, uint64 capPerPeriod)", "function escrows(uint256,address) view returns (uint256 balance, uint256 usesPurchased, uint256 usesSettled, uint64 capPerPeriod, uint64 periodStart, uint64 usedThisPeriod, uint64 purchaseTime)"]);

35const usdcAbi = parseAbi(["function approve(address,uint256)", "function balanceOf(address) view returns (uint256)"]);

36const publicClient = createPublicClient({ chain: baseSepolia, transport: http("https://sepolia.base.org") });

37const account = await deserializePermissionAccount(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server.jsView on unpkg · L19

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg · L19

38 publicClient, getEntryPoint("0.7"), KERNEL_V3_1, wallet.sessionApproval

39);

package.jsonView file

Lines 1-26json

2 "name": "tapmarket-connect",

3 "version": "0.1.1",

4 "description": "Give your AI assistant the power to hire paid specialists on TapMarket — with spending limits enforced on-chain.",

5 "main": "index.js",

6 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

Source & flagged code

3 flagged · loading source

server.jsView file

19L20: const WALLET_FILE = process.env.TAPMARKET_WALLET ?? new URL("./wallet.json", import.meta.url).pathname; L21: if (!existsSync(WALLET_FILE)) { ... L24: } L25: const wallet = JSON.parse(readFileSync(WALLET_FILE, "utf8")); L26: ... L35: const usdcAbi = parseAbi(["function approve(address,uint256)", "function balanceOf(address) view returns (uint256)"]); L36: const publicClient = createPublicClient({ chain: baseSepolia, transport: http("https://sepolia.base.org") }); L37: const account = await deserializePermissionAccount( ... L77: if (!spec) return { content: [{ type: "text", text: `Unknown specialist '${args.specialist}'. Use list_specialists.` }], isError: true }; L78: const route = { url: spec.endpoint, body: spec.shape }; L79: const esc = await publicClient.readContract({ address: TAP_MARKET, abi: marketAbi, functionName: "escrows", args: [BigInt(spec.listingId), account.address] });

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server.jsView on unpkg · L19

19Trigger-reachable chain: manifest.bin -> cli.js -> server.js L19: L20: const WALLET_FILE = process.env.TAPMARKET_WALLET ?? new URL("./wallet.json", import.meta.url).pathname; L21: if (!existsSync(WALLET_FILE)) { ... L24: } L25: const wallet = JSON.parse(readFileSync(WALLET_FILE, "utf8")); L26: ... L35: const usdcAbi = parseAbi(["function approve(address,uint256)", "function balanceOf(address) view returns (uint256)"]); L36: const publicClient = createPublicClient({ chain: baseSepolia, transport: http("https://sepolia.base.org") }); L37: const account = await deserializePermissionAccount( ... L77: if (!spec) return { content: [{ type: "text", text: `Unknown specialist '${args.specialist}'. Use list_specialists.` }], isError: true }; L78: const route = { url: spec.endpoint, body: spec.shape }; L79: const esc = await publicClient.readContract({ address: TAP_MARKET, abi: marketAbi, functionName: "escrows", args: [BigInt(spec.listingId), account.address] });

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg · L19

package.jsonView file

•scripts registry_only=start

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.

package.jsonView on unpkg

Findings

3 Critical3 Medium4 Low

CriticalCredential Exfiltrationserver.js

CriticalTrigger Reachable Dangerous Capabilityserver.js

CriticalManifest Confusionpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

server.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2// TapMarket MCP server — lets any MCP client (Claude, OpenClaw, etc.) hire paid

3// specialists on TapMarket. Crypto hidden; charges and limits always visible.

4import { Server } from "@modelcontextprotocol/sdk/server/index.js";

5import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

6import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";

7import { createPublicClient, http, parseAbi, encodeFunctionData, formatUnits } from "viem";

8import { baseSepolia } from "viem/chains";

9import { createKernelAccountClient } from "@zerodev/sdk";

10import { KERNEL_V3_1, getEntryPoint } from "@zerodev/sdk/constants";

11import { deserializePermissionAccount } from "@zerodev/permissions";

12import { config } from "dotenv";

13import { appendFileSync } from "fs";

14import { homedir } from "os";

15import { join } from "path";

16import { CATALOG } from "./catalog.js";

17import { ZERODEV_RPC as ZRPC } from "./init-lib.js";

18import { readFileSync, existsSync } from "fs";

20const WALLET_FILE = process.env.TAPMARKET_WALLET ?? new URL("./wallet.json", import.meta.url).pathname;

21if (!existsSync(WALLET_FILE)) {

22 console.error("No wallet found. Run: npx tapmarket-connect setup");

23 process.exit(1);

24}

25const wallet = JSON.parse(readFileSync(WALLET_FILE, "utf8"));

27config({ path: new URL("../.env.local", import.meta.url).pathname, quiet: true });

29const TAP_MARKET = "0xBfd085f192d2246F1BFBe386DF399335dc894f2c";

30const USDC = "0x036CbD53842c5426634e7929541eC2318f3dCF7e";

31const ZERODEV_RPC = ZRPC;

32// routes now come from catalog entries (endpoint + shape)

35const usdcAbi = parseAbi(["function approve(address,uint256)", "function balanceOf(address) view returns (uint256)"]);

36const publicClient = createPublicClient({ chain: baseSepolia, transport: http("https://sepolia.base.org") });

37const account = await deserializePermissionAccount(

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

server.jsView on unpkg · L19

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

server.jsView on unpkg · L19

38 publicClient, getEntryPoint("0.7"), KERNEL_V3_1, wallet.sessionApproval

39);

package.jsonView file

Lines 1-26json

2 "name": "tapmarket-connect",

3 "version": "0.1.1",

4 "description": "Give your AI assistant the power to hire paid specialists on TapMarket — with spending limits enforced on-chain.",

5 "main": "index.js",

6 "scripts": {

Critical

Manifest Confusion

Tarball package.json differs from the npm registry version manifest for scripts or dependency sets.