registry / x402-trinity / 0.2.3
x402-trinity@0.2.3
Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThe hard-coded, default extra transfer is a concrete financial risk that warrants a warning. It is user-activated and budget-gated, so the inspected source does not establish malware intent or a block-level attack.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
The charge is activated after the configured wallet completes one hundred paid requests through the client or MCP server.
Impact
The operator's wallet can incur an additional protocol-fee payment beyond seller payments.
Mechanism
It signs an authorization to a fixed vault and POSTs that authorization to its collector.
AI rationale
The hard-coded, default extra transfer is a concrete financial risk that warrants a warning. It is user-activated and budget-gated, so the inspected source does not establish malware intent or a block-level attack.
Evidence
src/x402.tsmcp/server.mjs
Network endpoints1
collector.x402trinity.com/submit
Decision evidence
public snapshotAI called this Suspicious at 87.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The payment client enables a surcharge by default and uses a fixed collector unless configured otherwise.
- After every hundred paid requests, it signs an additional authorization to a hard-coded vault address.
- The signed fee authorization is sent by POST to the configured collector endpoint.
- The MCP server supplies the operator key, spending limits, and a persistent surcharge store to the payment client.
Evidence against
- No install, preinstall, or postinstall hook is declared.
- The MCP server requires an explicit private key and positive per-request and total-budget limits before it starts.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flagged · loading sourcemcp/server.mjsView file
10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network
L10: *
L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries
L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log
...
L20: *
L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.
L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.
...
L45:
L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n');
L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
...
L51: function required(name) {
L52: const v = process.env[name];
L53: if (!v) {
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
mcp/server.mjsView on unpkg · L10bin/whoami.mjsView file
7Source sends the broad process environment to a literal external destination.
L7: *
L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami
L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami
...
L21: const RPCS = {
L22: 'base': 'https://mainnet.base.org',
L23: };
...
L26: function loadKey() {
L27: const shards = Object.keys(process.env)
L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k))
...
L76: method: 'POST', headers: { 'content-type': 'application/json' },
L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
L78: signal: AbortSignal.timeout(12000),
Findings
1 Critical2 High4 Medium5 Low
CriticalHardcoded Runtime Data Exfiltrationbin/whoami.mjs
HighEntrypoint Build Divergencemcp/server.mjs
HighSemantic Analysis Limitedmcp/server.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
MediumAi Review Evidencesrc/x402.ts
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to x402-trinity@0.2.3.
See all versions of x402-trinity for other recorded verdicts.
- Review the evidence and your use of x402-trinity@0.2.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.