Orbis API Marketplace

It requires a WALLET_PRIVATE_KEY, which is not a standard API key but a highly sensitive private key usable for on-chain signing and payments. If exposed or misused by the tool, it could directly lead to financial loss; the materials do not describe key custody, least-privilege controls, or signing scope restrictions.

Although no fixed remote host is listed, the stated function—accessing 8,000+ APIs via x402/USDC—likely involves outbound requests to selected third-party APIs and related payment / blockchain infrastructure. The materials do not clearly enumerate endpoints, data scope, or recipients, so data egress boundaries require caution.

System checks indicate that the tool executes code / starts local processes. This is a normal MCP capability, but it still means logic runs with the current user's permissions; the materials do not specify whether it invokes additional system capabilities or subprocesses, so isolated use is advisable.

The materials do not define a clear local file read/write scope and do not explicitly request local data access beyond environment variables. However, as an executable MCP tool, it will at minimum handle user inputs and the environment containing WALLET_PRIVATE_KEY; due to missing disclosure of data-access boundaries, caution is warranted.

Positive factors include the official registry source, an auditable open-source repository, and updates within the last year, all of which materially reduce supply-chain risk. However, the repository has no declared license, community adoption is currently low (0 stars), and the README is missing, so the audit context remains incomplete; caution is more appropriate than high risk.