io.github.mobileappbyharis/navi-x402-mcp

It requires X402_PRIVATE_KEY and MAX_PRICE_USDC; the private key is a highly sensitive credential, and leakage could enable misuse of on-chain payment capability. The claim of 'zero API keys' does not mean no sensitive secret is needed, only that a traditional API key is not required.

The described capabilities—crypto, weather, translation, web intel, and x402 discovery—normally imply outbound requests to external services. However, no specific remote endpoints are listed in the provided materials, so the destinations and data scope are opaque; this warrants caution rather than proving suspicious exfiltration.

The system flags executes-code, indicating the tool can run code or start processes locally. This is a common MCP capability, but the materials do not define execution boundaries, accessible system capabilities, or sandboxing, so it should be run with least privilege.

The provided materials do not specify what local files, wallet data, or other resources it can read or write, so the data access scope is unclear. There is no explicit evidence of requesting permissions beyond its stated function, but filesystem and sensitive directory access should still be restricted by default.

Positive factors include an official Registry source, open-source code, and updates within the last year; these materially reduce supply-chain risk. Caution remains appropriate because the repository has no declared license, very low community adoption (0 stars), and no README, making behavior and dependencies harder to review quickly.