io.github.0rkz/byte-protocol

It requires PRIVATE_KEY and RPC_URL; PRIVATE_KEY is highly sensitive and, if exposed, could enable abuse of on-chain identity or asset-related actions. The materials do not describe key storage, scope restrictions, or signing boundaries, so it should be handled as a highly sensitive secret.

It declares connectivity to the remote endpoint mcp.payperbyte.io and, together with RPC_URL, may also communicate with a user-configured blockchain RPC service. The materials do not specify exactly what is transmitted or any data minimization measures, so tool interaction content and blockchain request metadata should be assumed to potentially leave the host to the declared service and configured RPC endpoint.

The system checks indicate that this tool executes code/spawns processes, which is a normal MCP capability. The available materials do not show system-level permissions clearly exceeding its stated purpose, but it still presents a local execution surface and should be run in a constrained environment.

The materials do not clearly specify what local files, directories, or other data resources it can read or write, so its data access boundary is not fully transparent. There is no explicit evidence of overbroad access, but as a locally executed MCP tool, its accessible directories, wallet files, and exposed environment variables should be restricted by default.

The source is an official registry entry and it has an open-source repository with updates within the past year, which are positive signals that lower risk; no obvious high-risk supply-chain red flags are evident. Still, community adoption is low (0 stars), the README is absent, and no license is declared, so auditability and compliance metadata are only moderate.