Lightning Enable MCP Server

It requires highly sensitive payment and wallet credentials such as STRIKE_API_KEY, NWC_CONNECTION_STRING, LND_MACAROON_HEX, OPENNODE_API_KEY, and LIGHTNING_ENABLE_API_KEY, plus connection settings like LND_REST_HOST and AGENT_RELAY_URL. If exposed, they could enable payment actions, wallet access, or quota abuse. No abnormal credential request is evident, but the sensitivity warrants isolated storage and rotation.

No fixed remote hosts are declared, but the payment, L402, API discovery, and AGENT_RELAY_URL settings indicate outbound communication with external payment, relay, or wallet services. This looks like normal service egress, but endpoint and data-flow transparency is limited, so deployment should restrict access to only expected services.

The system checks indicate code execution capability; as an MCP service, this typically means it runs locally and can invoke network and payment-related logic. The materials do not show requests for system privileges beyond its stated purpose, so this is rated as caution for normal local execution capability.

Based on the provided materials, it mainly accesses payment secrets, wallet connection details, and potentially transaction or invoice data from environment variables; there is no explicit sign of broad filesystem access or unrelated data collection. The main concern is exposure to high-value payment data, so the runtime account should be tightly scoped and isolated from other sensitive data.

Positive factors include listing in the official registry, public source code, and updates within the last year, which improve auditability. However, the missing README, undeclared license, and very low adoption (0 stars) reduce verifiability and maturity. Overall there is no clear supply-chain red flag, but its dependencies and published artifacts should still be reviewed.