đŚ
Audit History
bnbchain-mcp - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 21, 2026, 02:53 AM
Static detections for private keys, shell execution, URLs, and address analysis are documentation-format false positives. The skill nevertheless enables high-impact blockchain writes and local file transfers, and it installs an unpinned npm package at runtime. Its explicit confirmation and key-handling guidance mitigate, but do not remove, these operational risks.
5
Files scanned
360
Lines analyzed
6
Review items
0
False positives ignored
Confirmed security concerns (3)
High
Financial and Irreversible Write Operations
The skill enables token transfers, token approvals, contract writes, and an irreversible Greenfield refund change. These actions can cause loss of funds or permanent account changes if the user confirms incorrect parameters.
The references expressly identify state-changing, irreversible operations, while the skill supplies confirmation guidance. The danger remains inherent to the supported operations.
Medium
Unpinned Runtime Package Installation
The setup instructs clients to run the latest npm package at runtime. A later package release can change the code executed by the MCP server.
The documented command uses @latest and the configuration repeats it. This is direct evidence of an unpinned dependency execution path.
Medium
Local File Transfer Through Greenfield Tools
Greenfield upload and download tools accept local file paths. Incorrect path selection can disclose local data to a bucket or overwrite a local destination.
The documentation explicitly supports absolute upload paths and download target paths. It does not show malicious intent, but the file-transfer capability has a clear data-handling impact.
Risk Factors
đ Env variables (12)
âď¸ External commands (23)
đ Network access (3)
Audited by: claude
Jul 9, 2026, 11:55 PM
The skill is primarily documentation for configuring and using BNB Chain MCP tools, and many markdown backtick findings are false positives. Confirmed risks remain because the skill runs an npm MCP server, handles private keys, and enables irreversible blockchain writes. No prompt injection or malicious exfiltration intent was found.
5
Files scanned
360
Lines analyzed
47
Review items
0
False positives ignored
Confirmed security concerns (28)
High
Crypto seed/private key mention
| privateKey | string | Hex private key (or set `PRIVATE_KEY` in MCP env) |
The references/erc8004-tools-reference.md:15 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
High
Crypto seed/private key mention
| privateKey | string | Ownerâs private key |
The references/erc8004-tools-reference.md:31 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
High
Crypto seed/private key mention
| get_address_from_private_key | Derive EVM address from private key | `privateKey` (or env PRIVATE_
The references/evm-tools-reference.md:45 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
High
Crypto seed/private key mention
| get_native_balance | Native token balance (BNB, ETH, etc.) | `address` (optional) or `privateKey`,
The references/evm-tools-reference.md:46 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
High
Crypto seed/private key mention
| get_erc20_balance | ERC20 balance for an address | `tokenAddress`, `address`, `network` (and optio
The references/evm-tools-reference.md:47 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
High
Crypto seed/private key mention
| transfer_native_token | Send native token | `privateKey`, `toAddress`, `amount` (string e.g. "0.1"
The references/evm-tools-reference.md:53 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| transfer_erc20 | Send ERC20 tokens | `privateKey`, `tokenAddress`, `toAddress`, `amount` (string),
The references/evm-tools-reference.md:54 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| approve_token_spending | Approve spender for ERC20 | `privateKey`, `tokenAddress`, `spenderAddress
The references/evm-tools-reference.md:55 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| transfer_nft | Transfer ERC721 NFT | `privateKey`, `tokenAddress`, `tokenId`, `toAddress`, `networ
The references/evm-tools-reference.md:56 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| transfer_erc1155 | Transfer ERC1155 | `privateKey`, `tokenAddress`, `tokenId`, `amount`, `toAddres
The references/evm-tools-reference.md:57 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| write_contract | **(Write)** Call state-changing function | `contractAddress`, `abi`, `functionNam
The references/evm-tools-reference.md:67 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
High
Crypto seed/private key mention
| gnfd_list_buckets | List buckets owned by an address | `network`, `address` (optional), `privateKe
The references/greenfield-tools-reference.md:13 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Crypto seed/private key mention
| gnfd_get_bucket_full_info | Bucket info and quota usage | `network`, `bucketName`, `privateKey` |
The references/greenfield-tools-reference.md:15 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Crypto seed/private key mention
| gnfd_create_bucket | **(Write)** Create a bucket | `network`, `privateKey`, `bucketName` |
The references/greenfield-tools-reference.md:16 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_delete_bucket | **(Write)** Delete a bucket | `network`, `privateKey`, `bucketName` |
The references/greenfield-tools-reference.md:17 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_upload_object / gnfd_create_file | **(Write)** Upload a file to a bucket | `network`, `privat
The references/greenfield-tools-reference.md:29 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_download_object | Download object to disk | `network`, `bucketName`, `objectName`, `targetPat
The references/greenfield-tools-reference.md:30 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Crypto seed/private key mention
| gnfd_delete_object | **(Write)** Delete an object | `network`, `privateKey`, `bucketName`, `object
The references/greenfield-tools-reference.md:31 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_create_folder | **(Write)** Create a folder in a bucket | `network`, `privateKey`, `bucketNam
The references/greenfield-tools-reference.md:32 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_get_account_balance | Balance for a Greenfield account | `network`, address/privateKey as per
The references/greenfield-tools-reference.md:42 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Crypto seed/private key mention
| gnfd_get_payment_accounts | Payment accounts for an address | `network`, `address` (optional), `pr
The references/greenfield-tools-reference.md:43 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Crypto seed/private key mention
| gnfd_create_payment | **(Write)** Create a payment account | `network`, `privateKey` |
The references/greenfield-tools-reference.md:45 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_deposit_to_payment | **(Write)** Deposit into payment account | `network`, `to` (payment acco
The references/greenfield-tools-reference.md:47 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_withdraw_from_payment | **(Write)** Withdraw from payment account | `network`, `from`, `amoun
The references/greenfield-tools-reference.md:48 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
| gnfd_disable_refund | **(Write, IRREVERSIBLE)** Disable refund for payment account | `network`, `a
The references/greenfield-tools-reference.md:49 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
High
Crypto seed/private key mention
- **PRIVATE_KEY:** Omit or leave empty for read-only (blocks, balances, contract reads). Set in the
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Crypto seed/private key mention
| Wallet / balance | `get_native_balance`, `get_erc20_balance`, `get_address_from_private_key` | Bal
The wallet tools include deriving an address from a private key. Any flow that accepts wallet secrets must be treated as high sensitivity even when used for balance lookup.
High
Irreversible Blockchain Write Capability
The skill directs use of transfer, approval, contract write, ERC-8004, and Greenfield write tools. Mistaken calls can move assets, grant spending rights, or disable refund behavior permanently.
The cited lines explicitly list write operations, required confirmation, and an irreversible Greenfield action. This is a business-logic risk, not evidence of malicious intent.
Capability review items (16)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
| privateKey | string | Hex private key (or set `PRIVATE_KEY` in MCP env) |
The references/erc8004-tools-reference.md:15 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
High
Generic API/secret keys
Tools that require **PRIVATE_KEY** in the MCP server env are marked with **(write)**.
The references/evm-tools-reference.md:8 entry states that write tools require PRIVATE_KEY in the MCP environment. That is legitimate for signing, but it is still sensitive credential handling.
High
Generic API/secret keys
| get_address_from_private_key | Derive EVM address from private key | `privateKey` (or env PRIVATE_
The references/evm-tools-reference.md:45 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
High
Generic API/secret keys
**(Write)** â require PRIVATE_KEY in env:
The references/evm-tools-reference.md:49 entry states that write tools require PRIVATE_KEY in the MCP environment. That is legitimate for signing, but it is still sensitive credential handling.
High
Generic API/secret keys
Greenfield tools operate on **testnet** or **mainnet**. Use **`network`**: `"testnet"` (default) or
The references/greenfield-tools-reference.md:3 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Generic API/secret keys
description: BNB Chain MCP server connection and tool usage. Covers npx @bnb-chain/mcp@latest, PRIVA
The description states that the skill covers PRIVATE_KEY and transacting on BNB Chain. That confirms the skill handles wallet secrets and state-changing blockchain actions.
High
Generic API/secret keys
- **PRIVATE_KEY:** Omit or leave empty for read-only (blocks, balances, contract reads). Set in the
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
- **Read-only vs state-changing:** Block/balance/contract-read tools work without a key; transfers a
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
"PRIVATE_KEY": ""
The MCP configuration includes a PRIVATE_KEY environment slot intended for signing operations. The placeholder is empty, but users may place a real wallet key there.
High
Generic API/secret keys
- **PRIVATE_KEY:** Set in the serverâs `env` when state-changing tools are needed; leave empty for r
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
| Wallet / balance | `get_native_balance`, `get_erc20_balance`, `get_address_from_private_key` | Bal
The wallet tools include deriving an address from a private key. Any flow that accepts wallet secrets must be treated as high sensitivity even when used for balance lookup.
Medium
Ruby/shell backtick execution
- **Run the server:** `npx @bnb-chain/mcp@latest` (fetches from npm at runtime). Source: [github.com
This line instructs users to run npx @bnb-chain/mcp@latest, which fetches and executes an npm package at runtime. That creates supply-chain and local execution risk even though it matches the skill purpose.
Medium
Ruby/shell backtick execution
```json
The fenced MCP configuration includes command npx with @bnb-chain/mcp@latest. It is legitimate setup guidance, but it still delegates execution to a runtime npm package.
Medium
Ruby/shell backtick execution
**SSE mode:** `"args": ["-y", "@bnb-chain/mcp@latest", "--sse"]` (and client SSE URL if required). *
The SSE example uses @bnb-chain/mcp@latest with a server mode. This is a real external runtime command and may expose a local MCP endpoint if configured unsafely.
Low
Hardcoded URL
- **Run the server:** `npx @bnb-chain/mcp@latest` (fetches from npm at runtime). Source: [github.com
The line explicitly says the server is fetched from npm at runtime and links to the upstream repository. This is expected for setup, but it is a real network dependency.
Low
Hardcoded URL
**SSE mode:** `"args": ["-y", "@bnb-chain/mcp@latest", "--sse"]` (and client SSE URL if required). *
The line documents an SSE URL on localhost for local development. It is not exfiltration, but it does create a network transport that must be bound and authorized carefully.
Risk Factors
đ Env variables (12)
âď¸ External commands (23)
đ Network access (3)
Audited by: codex