Is x402-agent-hub-mcp@1.6.0 safe to install?

Skills/Glama/x402-agent-hub-mcp

x402-agent-hub-mcp@1.6.0

VERIFIED

Publisher claims: "| GET /v1/trading/sessions | $0.005 | $0.00 | Live ICT Killzones (Asian/London/NY), Silver Bullet 60m FVG windows, rollover spread alerts, Wednesday/Friday triple-swap flags. | | GET /v1/trading/microstructure | $0.010 | $0.00 | Calibrated ECN Raw Pro spreads, commissions, M1 ATR, M1–H1 cost/ATR ratios & optional live MT5 closed-bar FVGs across 14 symbols (XAUUSD, BTCUSD, NAS100," Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher blackcat-cyber-creator · publishing for 3 daysInstalls 0Last detonated 3d ago

$npx skills add x402-agent-hub-mcp

Watch Report an issue

Coverage

Server started and answered tools/list.

Tested: MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested: what the tools do when called with real credentials

Before you give it your token

It will ask for: X402_BUYER_PRIVATE_KEYConfiguration, not credentials: RAW_KEY, X402_HUB_URL
Where it talks to: no vendor host named in the codeAlso workers.dev, tryponcho.com — not the publisher's domain; check what for before connecting.
What the honeypot saw: no credential files read · no network
What we could not test: what the tools do when called with real credentials

Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names workers.dev, tryponcho.com as well as its own vendor. The guard injects X402_BUYER_PRIVATE_KEY only into requests to the host you bind (and its subdomains) and refuses the rest.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-12 and scored it 90/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 38 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.0sprocessno install scripts in bundle

17sprocessdependency install exit 0

37sclaimed26 tools: get_hub_catalog, get_ict_sessions, get_cfd_microstructure, calculate_prop_firm_risk, extract_clean_markdown, enrich_business_lead, audit_technical_seo, render_visual_card, audit_crypto_token, generate_outreach_dossier, chain_native_balance, chain_token_balance, chain_token_info, chain_transaction_status, chain_address_info, chain_ens_resolve, chain_portfolio, company_search, company_profile, company_financials, company_filings, company_insider_trades, entity_search, entity_company, entity_person

37sprocessscript backend runs setup only

37sprocessno install scripts to re-run

Static findings

MEDIUM

npx invocation of non-well-known packageskills/x402-agent-hub/SKILL.md:97 · npx invocation of non-well-known package — may execute untrusted code

Example: `npx --yes agentcash fetch "https://x402-agent-hub.x402-agent-hub.workers.dev/v1/company/financials?ticker=NVDA&period=quarterly"`