Versioned security assessment
Report ID: SA-65AFEA88
7/9/2026, 11:55:58 PM
bnbchain-mcp security assessment v1
Skill Security Certification Report
Audit model: codex Historical report
- Skill name
- bnbchain-mcp
- Version
- v1
- Maintainer
- internet-court
- Coverage
- 5 Files scanned · 360 Lines analyzed
- Policy version
- Unavailable
Highest confirmed finding severity
High
28 confirmed security findings require attention.
Installation context
Historical evidence
This report may not describe the currently installable artifact. Open the current Skill page for install guidance.
Open current Skill pageThis report does not block or authorize the manifest or ZIP.
The skill is primarily documentation for configuring and using BNB Chain MCP tools, and many markdown backtick findings are false positives. Confirmed risks remain because the skill runs an npm MCP server, handles private keys, and enables irreversible blockchain writes. No prompt injection or malicious exfiltration intent was found.
Report position
Historical report
Open audit history before using this report to install.
Audit attestation
Not attestable
The required immutable binding is incomplete.
Human verification
Not verified
No human verification is recorded for this report.
Coverage
5 Files scanned · 360 Lines analyzed
44 items shown for review
Limitations
This report does not claim runtime or sandbox execution and does not prove the absence of side effects.
Evidence chain
Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.
Source
Binding unavailable
Artifact
Identity incomplete
Audit
Complete
Capabilities observed
Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.
Contains scripts
May execute code included with the Skill.
Not recorded by this audit
Network access
May connect to external services.
Observed in 3 evidence locations
Filesystem access
May read or write local files.
Not recorded by this audit
Env variables
May read values from the process environment.
Observed in 12 evidence locations
External commands
May invoke commands or programs outside the Skill.
Observed in 23 evidence locations
Capability review items (16)
High
Generic API/secret keys
| privateKey | string | Hex private key (or set `PRIVATE_KEY` in MCP env) |
The references/erc8004-tools-reference.md:15 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
High
Generic API/secret keys
Tools that require **PRIVATE_KEY** in the MCP server env are marked with **(write)**.
The references/evm-tools-reference.md:8 entry states that write tools require PRIVATE_KEY in the MCP environment. That is legitimate for signing, but it is still sensitive credential handling.
High
Generic API/secret keys
| get_address_from_private_key | Derive EVM address from private key | `privateKey` (or env PRIVATE_
The references/evm-tools-reference.md:45 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
High
Generic API/secret keys
**(Write)** — require PRIVATE_KEY in env:
The references/evm-tools-reference.md:49 entry states that write tools require PRIVATE_KEY in the MCP environment. That is legitimate for signing, but it is still sensitive credential handling.
High
Generic API/secret keys
Greenfield tools operate on **testnet** or **mainnet**. Use **`network`**: `"testnet"` (default) or
The references/greenfield-tools-reference.md:3 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
High
Generic API/secret keys
description: BNB Chain MCP server connection and tool usage. Covers npx @bnb-chain/mcp@latest, PRIVA
The description states that the skill covers PRIVATE_KEY and transacting on BNB Chain. That confirms the skill handles wallet secrets and state-changing blockchain actions.
High
Generic API/secret keys
- **PRIVATE_KEY:** Omit or leave empty for read-only (blocks, balances, contract reads). Set in the
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
- **Read-only vs state-changing:** Block/balance/contract-read tools work without a key; transfers a
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
"PRIVATE_KEY": ""
The MCP configuration includes a PRIVATE_KEY environment slot intended for signing operations. The placeholder is empty, but users may place a real wallet key there.
High
Generic API/secret keys
- **PRIVATE_KEY:** Set in the server’s `env` when state-changing tools are needed; leave empty for r
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
High
Generic API/secret keys
| Wallet / balance | `get_native_balance`, `get_erc20_balance`, `get_address_from_private_key` | Bal
The wallet tools include deriving an address from a private key. Any flow that accepts wallet secrets must be treated as high sensitivity even when used for balance lookup.
Medium
Ruby/shell backtick execution
- **Run the server:** `npx @bnb-chain/mcp@latest` (fetches from npm at runtime). Source: [github.com
This line instructs users to run npx @bnb-chain/mcp@latest, which fetches and executes an npm package at runtime. That creates supply-chain and local execution risk even though it matches the skill purpose.
Medium
Ruby/shell backtick execution
```json
The fenced MCP configuration includes command npx with @bnb-chain/mcp@latest. It is legitimate setup guidance, but it still delegates execution to a runtime npm package.
Medium
Ruby/shell backtick execution
**SSE mode:** `"args": ["-y", "@bnb-chain/mcp@latest", "--sse"]` (and client SSE URL if required). *
The SSE example uses @bnb-chain/mcp@latest with a server mode. This is a real external runtime command and may expose a local MCP endpoint if configured unsafely.
Low
Hardcoded URL
- **Run the server:** `npx @bnb-chain/mcp@latest` (fetches from npm at runtime). Source: [github.com
The line explicitly says the server is fetched from npm at runtime and links to the upstream repository. This is expected for setup, but it is a real network dependency.
Low
Hardcoded URL
**SSE mode:** `"args": ["-y", "@bnb-chain/mcp@latest", "--sse"]` (and client SSE URL if required). *
The line documents an SSE URL on localhost for local development. It is not exfiltration, but it does create a network transport that must be bound and authorized carefully.
Risk findings
Confirmed security concerns are separated from items that still need review.
Confirmed security concerns (28)
RISK-001 High
Crypto seed/private key mention
| privateKey | string | Hex private key (or set `PRIVATE_KEY` in MCP env) |
The references/erc8004-tools-reference.md:15 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
RISK-002 High
Crypto seed/private key mention
| privateKey | string | Owner’s private key |
The references/erc8004-tools-reference.md:31 entry documents a privateKey parameter or PRIVATE_KEY environment fallback for ERC-8004 write ownership. A leaked key could authorize identity registry changes or expose the owner wallet.
RISK-003 High
Crypto seed/private key mention
| get_address_from_private_key | Derive EVM address from private key | `privateKey` (or env PRIVATE_
The references/evm-tools-reference.md:45 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
RISK-004 High
Crypto seed/private key mention
| get_native_balance | Native token balance (BNB, ETH, etc.) | `address` (optional) or `privateKey`,
The references/evm-tools-reference.md:46 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
RISK-005 High
Crypto seed/private key mention
| get_erc20_balance | ERC20 balance for an address | `tokenAddress`, `address`, `network` (and optio
The references/evm-tools-reference.md:47 entry allows a privateKey for wallet derivation or default balance lookup. Even read-oriented handling of a wallet key is sensitive because disclosure can compromise funds.
RISK-006 High
Crypto seed/private key mention
| transfer_native_token | Send native token | `privateKey`, `toAddress`, `amount` (string e.g. "0.1"
The references/evm-tools-reference.md:53 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-007 High
Crypto seed/private key mention
| transfer_erc20 | Send ERC20 tokens | `privateKey`, `tokenAddress`, `toAddress`, `amount` (string),
The references/evm-tools-reference.md:54 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-008 High
Crypto seed/private key mention
| approve_token_spending | Approve spender for ERC20 | `privateKey`, `tokenAddress`, `spenderAddress
The references/evm-tools-reference.md:55 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-009 High
Crypto seed/private key mention
| transfer_nft | Transfer ERC721 NFT | `privateKey`, `tokenAddress`, `tokenId`, `toAddress`, `networ
The references/evm-tools-reference.md:56 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-010 High
Crypto seed/private key mention
| transfer_erc1155 | Transfer ERC1155 | `privateKey`, `tokenAddress`, `tokenId`, `amount`, `toAddres
The references/evm-tools-reference.md:57 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-011 High
Crypto seed/private key mention
| write_contract | **(Write)** Call state-changing function | `contractAddress`, `abi`, `functionNam
The references/evm-tools-reference.md:67 entry documents a privateKey parameter for token transfers, approvals, NFT transfers, or contract writes. These operations can move assets or grant spending rights if the key is mishandled.
RISK-012 High
Crypto seed/private key mention
| gnfd_list_buckets | List buckets owned by an address | `network`, `address` (optional), `privateKe
The references/greenfield-tools-reference.md:13 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
RISK-013 High
Crypto seed/private key mention
| gnfd_get_bucket_full_info | Bucket info and quota usage | `network`, `bucketName`, `privateKey` |
The references/greenfield-tools-reference.md:15 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
RISK-014 High
Crypto seed/private key mention
| gnfd_create_bucket | **(Write)** Create a bucket | `network`, `privateKey`, `bucketName` |
The references/greenfield-tools-reference.md:16 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-015 High
Crypto seed/private key mention
| gnfd_delete_bucket | **(Write)** Delete a bucket | `network`, `privateKey`, `bucketName` |
The references/greenfield-tools-reference.md:17 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-016 High
Crypto seed/private key mention
| gnfd_upload_object / gnfd_create_file | **(Write)** Upload a file to a bucket | `network`, `privat
The references/greenfield-tools-reference.md:29 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-017 High
Crypto seed/private key mention
| gnfd_download_object | Download object to disk | `network`, `bucketName`, `objectName`, `targetPat
The references/greenfield-tools-reference.md:30 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
RISK-018 High
Crypto seed/private key mention
| gnfd_delete_object | **(Write)** Delete an object | `network`, `privateKey`, `bucketName`, `object
The references/greenfield-tools-reference.md:31 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-019 High
Crypto seed/private key mention
| gnfd_create_folder | **(Write)** Create a folder in a bucket | `network`, `privateKey`, `bucketNam
The references/greenfield-tools-reference.md:32 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-020 High
Crypto seed/private key mention
| gnfd_get_account_balance | Balance for a Greenfield account | `network`, address/privateKey as per
The references/greenfield-tools-reference.md:42 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
RISK-021 High
Crypto seed/private key mention
| gnfd_get_payment_accounts | Payment accounts for an address | `network`, `address` (optional), `pr
The references/greenfield-tools-reference.md:43 entry documents privateKey use for Greenfield account or storage operations. Handling wallet secrets in tool parameters or env creates exposure risk if misused.
RISK-022 High
Crypto seed/private key mention
| gnfd_create_payment | **(Write)** Create a payment account | `network`, `privateKey` |
The references/greenfield-tools-reference.md:45 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-023 High
Crypto seed/private key mention
| gnfd_deposit_to_payment | **(Write)** Deposit into payment account | `network`, `to` (payment acco
The references/greenfield-tools-reference.md:47 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-024 High
Crypto seed/private key mention
| gnfd_withdraw_from_payment | **(Write)** Withdraw from payment account | `network`, `from`, `amoun
The references/greenfield-tools-reference.md:48 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-025 High
Crypto seed/private key mention
| gnfd_disable_refund | **(Write, IRREVERSIBLE)** Disable refund for payment account | `network`, `a
The references/greenfield-tools-reference.md:49 entry documents privateKey use for Greenfield write operations. These calls can create, delete, upload, move funds, or perform irreversible account actions.
RISK-026 High
Crypto seed/private key mention
- **PRIVATE_KEY:** Omit or leave empty for read-only (blocks, balances, contract reads). Set in the
The line instructs users to configure PRIVATE_KEY for state-changing MCP tools. This is expected, but a compromised or logged key can directly compromise wallet funds.
RISK-027 High
Crypto seed/private key mention
| Wallet / balance | `get_native_balance`, `get_erc20_balance`, `get_address_from_private_key` | Bal
The wallet tools include deriving an address from a private key. Any flow that accepts wallet secrets must be treated as high sensitivity even when used for balance lookup.
RISK-028 High
Irreversible Blockchain Write Capability
The skill directs use of transfer, approval, contract write, ERC-8004, and Greenfield write tools. Mistaken calls can move assets, grant spending rights, or disable refund behavior permanently.
The cited lines explicitly list write operations, required confirmation, and an irreversible Greenfield action. This is a business-logic risk, not evidence of malicious intent.
Remediation
Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.
- FIX-001HighWrite tools require wallet private keys.Recommend read-only mode by default, separate low-value signing wallets, and secret storage outside chat transcripts.
- FIX-002HighState-changing blockchain calls can be irreversible.Require explicit confirmation of network, recipient, contract, amount, and function before any write call.
- FIX-003HighTool references allow privateKey parameters in prompts.Prefer environment or wallet-manager configuration and warn users not to paste private keys into chat or tool arguments.
- FIX-004MediumRuntime npm execution uses @latest.Pin @bnb-chain/mcp to a reviewed version and document how users can verify the package before installation.
Expert evidence
Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.
Artifact subject
- Marketplace commit
- Unavailable
- Content hash
- Unavailable
- Tree hash
- Unavailable
- Skill path
- Unavailable
- Audit payload hash
- Unavailable
Analysis metadata
Audit model: codex
Analysis state: Complete
Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.
Verify and export
The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.
Audit attestation: not_attestable