Skills/npm/santyvv-data-mcp

santyvv-data-mcp@1.0.0

VERIFIED

Publisher claims: "Market and on-chain crypto data for AI agents. Pay per call in USDC on Base (x402)." Observed in sandbox: calls mcp.santyvv.com only, touches nothing outside the project, writes no memory.

Registry npm (MCP server) · listed in the official MCP RegistryPublisher santyvv · publishing for 55 daysInstalls 0Last detonated 8 h ago
$claude mcp add santyvv-data-mcp -- npx -y santyvv-data-mcp
WatchReport an issue

Coverage

Server started and answered tools/list.
Tested
MCP initialize and tools/list · every tool description, for hidden instructions · every file read, file written and host contacted by what ran
Not tested
what the tools do when called with real credentials

Before you give it your token

It will ask for
EVM_PRIVATE_KEYX402_PRIVATE_KEYConfiguration, not credentials: SANTYVV_MCP_URL, X402_MAX_PRICE_USDC
Where it talks to
santyvv.com (its own)
What the honeypot saw
no credential files read · reached only mcp.santyvv.com (its own)
What we could not test
what the tools do when called with real credentials

Connect it with a scoped credential, under the guard. It asks for EVM_PRIVATE_KEY, X402_PRIVATE_KEY and talks to santyvv.com. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind.

$vet-skills run --secrets EVM_PRIVATE_KEY=santyvv.com,X402_PRIVATE_KEY=santyvv.com -- npx -y santyvv-data-mcp

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios) on 2026-11-14 and scored it 93/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: calls mcp.santyvv.com only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 51 s · 2 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
31sprocessdependency install exit 0
51snetworkCONNECT tcp://mcp.santyvv.com:443
51snetworkCONNECT tcp://mcp.santyvv.com:443
51sclaimed8 tools: catalogo, estado_fuentes, precio, ficha_token, velas, mercado, tvl_protocolo, saldo
51stools972b259e82064e9f
51stools63514f62131a569a
51stools8fd3f19322cf1733
51stools457e7236844dc0a7
51stoolsf3f4126c4f8d6e10
51stools355440af6cab01a5
51stoolsd3be3c05a576736c
51stools73abd799ac7ba964
51sprocessscript backend runs setup only
51sprocessno install scripts to re-run

Static findings

No findings across 239 lines in 4 files.

Cost to the agent

Instructions loaded
≈73 tok
1 file · 4 in bundle
Tool list per prompt
≈1,170 tok
8 tools · 146 per tool
Handshake
1414 ms
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 220

Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.

Known vulnerabilities

No advisories in OSV for santyvv-data-mcp@1.0.0 as of 8 h ago. This is the package itself, not its dependencies.