registry / x402-trinity / 0.2.4
x402-trinity@0.2.4
Zero-dependency HTTP 402 fetch replacement for autonomous agents and edge/local runtimes with native EIP-3009 gasless transfers.
AI Security Review
scanned 25d ago · by lpm-firewall-aiThere is no install lifecycle, self-dependency, secret harvesting, or unsolicited agent-config mutation. The payment and protocol-fee behavior is the stated product and runs only after the user supplies a key and starts the client.
Static reason
High-risk behavior combination matched malicious policy.
Trigger
User invocation of the library, the x402-trinity-mcp binary, or x402-trinity-whoami.
Impact
Funds move only from the wallet the operator configured, within those limits, including the disclosed protocol fee.
Mechanism
The code signs EIP-3009 payments under caller-configured caps and, by default, an extra protocol fee to the package fee vault.
AI rationale
There is no install lifecycle, self-dependency, secret harvesting, or unsolicited agent-config mutation. The payment and protocol-fee behavior is the stated product and runs only after the user supplies a key and starts the client.
Network endpoints2
mainnet.base.orgcollector.x402trinity.com/submit
Decision evidence
public snapshotAI called this Clean at 86.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no preinstall, install, or postinstall hooks; scripts are build, typecheck, an explicit mcp command, and prepublishOnly.
- The MCP server spends only after the operator sets X402_PRIVATE_KEY, per-request, and lifetime budget environment variables, and it exits if those limits are missing.
- bin/whoami.mjs reads a caller-supplied key only to print an address and query https://mainnet.base.org for balances; it does not write the key or run at install time.
Evidence against
- createX402Fetch adds a documented default 0.1% plus periodic flat protocol fee, signed locally and posted to https://collector.x402trinity.com/submit for payTo 0x2f011f21D6Ec758Bc18f0f9142EeD01Ce2d8a0d3, and the MCP server enables that surcharge when the user starts it.
Behavioral surface
EnvironmentVarsFilesystemNetwork
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
4 flagged · loading sourcemcp/server.mjsView file
10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: environment+network
L10: *
L11: * Transport is stdio: newline-delimited JSON-RPC 2.0, per the MCP spec. stdout carries
L12: * protocol messages ONLY - every log line goes to stderr, because a stray console.log
...
L20: *
L21: * X402_PRIVATE_KEY required. Never accepted as a tool argument, never echoed.
L22: * X402_MAX_PER_REQUEST required. Atomic units, e.g. 50000 = $0.05.
...
L45:
L46: const log = (...a) => process.stderr.write('[x402-trinity] ' + a.join(' ') + '\n');
L47: const send = (msg) => process.stdout.write(JSON.stringify(msg) + '\n');
...
L51: function required(name) {
L52: const v = process.env[name];
L53: if (!v) {
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
mcp/server.mjsView on unpkg · L10bin/whoami.mjsView file
7Source sends the broad process environment to a literal external destination.
L7: *
L8: * PowerShell: $env:X402_PRIVATE_KEY="0x..."; npx x402-trinity-whoami
L9: * bash: X402_PRIVATE_KEY=0x... npx x402-trinity-whoami
...
L21: const RPCS = {
L22: 'base': 'https://mainnet.base.org',
L23: };
...
L26: function loadKey() {
L27: const shards = Object.keys(process.env)
L28: .filter(k => /^X402_KEY_SHARD_\d+$/.test(k))
...
L76: method: 'POST', headers: { 'content-type': 'application/json' },
L77: body: JSON.stringify({ jsonrpc: '2.0', id: 1, method, params }),
L78: signal: AbortSignal.timeout(12000),
Findings
1 Critical2 High3 Medium6 Low
CriticalHardcoded Runtime Data Exfiltrationbin/whoami.mjs
HighEntrypoint Build Divergencemcp/server.mjs
HighSemantic Analysis Limitedmcp/server.mjs#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to x402-trinity@0.2.4.
See all versions of x402-trinity for other recorded verdicts.
- Review the evidence and your use of x402-trinity@0.2.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.