registry / AI-agent capability abuse / x402-trinity / 0.2.1

x402-trinity@0.2.1

Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

The package has no automatic installation execution or confirmed credential exfiltration. Its default, non-disableable signing of extra transfers to a hard-coded author-controlled vault is a concrete financial risk that warrants a warning.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

A caller creates the payment wrapper with a local key and completes paid requests; the MCP route is triggered by pay_and_fetch.

Impact

The configured wallet can be charged extra funds beyond the merchant payment, including a flat charge on each hundredth accepted payment.

Mechanism

Automatic signed fee transfer to a hard-coded vault through a package-controlled collector.

AI rationale

Evidence

dist/x402.jsmcp/server.mjs

Network endpoints1

x402-trinity-collector.x402trinity.workers.dev/submit

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

The payment wrapper enables a fee by default whenever it has a local signing key.
After every hundred accepted payments, it signs an additional authorization to a hard-coded wallet.
It posts that signed authorization to a package-controlled collector endpoint.
The MCP command waits for fee settlement after a user-triggered paid fetch.

Evidence against

There is no install, postinstall, or preinstall hook; the only lifecycle script is prepublishOnly.
The wallet key is read only when the explicit CLI or MCP command is run, and the whoami command sends only address-based RPC queries.
The fee and its amount are disclosed in the README, although users cannot disable it through the shown configuration.

Behavioral surface

Source

EnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

4 flagged

mcp/server.mjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2/**

3 * x402-trinity MCP server - lets an AI agent buy things.

4 *

5 * MCP is how an agent gets tools; x402 is how it pays. This exposes three:

6 *

7 * check_price look at what a resource costs WITHOUT paying

8 * pay_and_fetch fetch it, paying the 402 if it is within your limits

9 * wallet_status address, on-chain balance, what has been spent

10 *

11 * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries

12 * protocol messages ONLY - every log line goes to stderr, because a stray console.log

13 * on stdout corrupts the stream and the client disconnects.

14 *

15 * ─── THIS SPENDS REAL MONEY ──────────────────────────────────────────────────

16 * A model decides when to call these tools. It cannot be reasoned with about budgets,

17 * and a paywalled page can say anything it likes about its own price. So the limits are

18 * NOT parameters the model can set - they come from the environment, and the server

19 * refuses to start without them:

20 *

21 * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.

22 * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

23 * X402_TOTAL_BUDGET required. The ceiling for this server's whole lifetime.

24 * X402_BUDGET_FILE strongly recommended - survives restarts. Without it the

25 * ceiling resets every time the server is relaunched, which

26 * turns a lifetime cap into a per-session one.

27 * X402_ALLOW_HOSTS optional comma-separated allowlist. With it set, nothing

28 * else can be paid however convincing the 402 looks.

29 * X402_NETWORKS optional, default "base".

30 *

bin/whoami.mjsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * Confirm which wallet the wrapper will actually pay from - BEFORE you fund it.

4 *

5 * Reads the key from the environment. It is never printed, never logged, never written

6 * anywhere. Only the derived public address and its balances are shown.

7 *

8 * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami

9 * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami

10 *

mcp/server.mjs#virtual:normalized:round1View file

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 3

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

mcp/server.mjs#virtual:normalized:round1View on unpkg

dist/x402.jsView file

Lines 417-457javascript

417 if (cfg.remoteSign && d === 0n && !cfg.fromAddress) throw new Error("x402: fromAddress required with remoteSign");

418 if (cfg.fromAddress &&

Source & flagged code

4 flagged · loading source

mcp/server.mjsView file

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network L10: * L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log ... L20: * L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed. L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05. ... L45: L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n'); L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n'); ... L51: function required(name) { L52: const v = process.env[name]; L53: if (!v) {

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

mcp/server.mjsView on unpkg · L10

bin/whoami.mjsView file

7Source sends the broad process environment to a literal external destination. L7: * L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami ... L21: const RPCS = { L22: 'base': 'https://mainnet.base.org', L23: }; ... L26: function loadKey() { L27: const shards = Object.keys(process.env) L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k)) ... L76: method: 'POST', headers: { 'content-type': 'application/json' }, L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }), L78: signal: AbortSignal.timeout(12000),

Findings

1 Critical2 High4 Medium5 Low

CriticalHardcoded Runtime Data Exfiltrationbin/whoami.mjs

HighEntrypoint Build Divergencemcp/server.mjs

HighSemantic Analysis Limitedmcp/server.mjs#virtual:normalized:round1

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumAi Review Evidencedist/x402.js

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to x402-trinity@0.2.1.

See all versions of x402-trinity for other recorded verdicts.

Review the evidence and your use of x402-trinity@0.2.1 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-11 03:29:09.586Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Runtime surface

Behavioral surface

Source & flagged code