Payment layer for AI agents. One MCP, five protocols, thousands of paid APIs your agent can call.
Drift inferred · capture-to-capture
tool count over time
06-03 23:38 now
3t
3t
transport stdio · http
verified
reported
listed in the official MCP registry counts 12 tools · 0 res
· 0 prompts
permission surface via code analysis
tools
-
call_mpp32_endpoint
-
compare_tokens_m32
-
debug_mpp32
-
find_mpp32_service
-
get_m32_whale_tracker
-
get_mpp32_diagnostics
-
get_pivx_dao_intelligence
-
get_solana_token_intelligence
-
list_mpp32_services
-
manage_agent_budget
-
scan_portfolio_m32
-
try_solana_token_intelligence_free
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit 1b61b9d · analyzer v33 · 2w ago
danger signals1
- credential in logs credential in log MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :2117
console.error(`[mpp32] MPP32_SOLANA_PRIVATE_KEY: ${fp(SOLANA_PRIVATE_KEY)}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 183
filesystem 2
- fs MPP32-MPP32-1b61b9d/webapp/src/pages/AgentConsole.tsx :1487
node -e "console.log(require('bs58').encode(Buffer.from(JSON.parse(require('fs').readFileSync('keypair.json')))))" - fs MPP32-MPP32-1b61b9d/webapp/src/pages/Docs.tsx :1133
// node -e "console.log(require('bs58').encode(Buffer.from(JSON.parse(require('fs').readFileSync('keypair.json')))))"
network 28
- net (weak) MPP32-MPP32-1b61b9d/backend/src/__tests__/x402-live.test.ts :27
const res = await fetch(`${url.replace(/\/+$/, '')}/supported`, { - net MPP32-MPP32-1b61b9d/backend/src/lib/catalog/crawlers/huggingface.ts :107
const res = await fetch(url.toString(), { - net MPP32-MPP32-1b61b9d/backend/src/lib/catalog/crawlers/mcp-registry.ts :110
const res = await fetch(url.toString(), { - net MPP32-MPP32-1b61b9d/backend/src/lib/catalog/crawlers/replicate.ts :111
const res = await fetch(nextUrl, { - net MPP32-MPP32-1b61b9d/backend/src/lib/catalog/crawlers/x402-bazaar.ts :126
const res = await fetch(url, { - net MPP32-MPP32-1b61b9d/backend/src/lib/catalog/health.ts :116
res = await fetch(probeUrl, { - net MPP32-MPP32-1b61b9d/backend/src/lib/fetch.ts :5
const res = await fetch(url, { - net MPP32-MPP32-1b61b9d/backend/src/lib/pivx-provider.ts :65
const res = await fetch(url, { signal: AbortSignal.timeout(timeoutMs) }) - net MPP32-MPP32-1b61b9d/backend/src/lib/solana-token.ts :23
const res = await fetch(env.SOLANA_RPC_URL, { - net MPP32-MPP32-1b61b9d/backend/src/lib/ssrf.ts :113
* Wrap fetch() so a malicious provider URL can't poke our internal network. - net MPP32-MPP32-1b61b9d/backend/src/lib/verification.ts :14
const res = await fetch(url, { method: 'GET', signal: controller.signal }) - net MPP32-MPP32-1b61b9d/backend/src/lib/x402.ts :56
const res = await fetch(`${trimmed}/supported`, { signal: AbortSignal.timeout(10_000) })
show 16 more
- net MPP32-MPP32-1b61b9d/backend/src/routes/agent.ts :631
const proxyRes = await fetch(targetUrlString, { - net MPP32-MPP32-1b61b9d/backend/src/routes/contact.ts :26
const res = await fetch("https://api.resend.com/emails", { - net MPP32-MPP32-1b61b9d/backend/src/routes/m32-apis.ts :64
const res = await fetch(env.SOLANA_RPC_URL, { - net MPP32-MPP32-1b61b9d/backend/src/routes/proxy.ts :451
upstream = await fetch(target.toString(), fetchOpts) - net MPP32-MPP32-1b61b9d/backend/src/routes/submissions.ts :117
const probeRes = await fetch(url, { method: 'GET', signal: controller.signal }) - net MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :173
return await fetch(url, { ...init, signal: controller.signal }); - net MPP32-MPP32-1b61b9d/sdk/src/client.ts :186
if (!this.retryConfig) return fetch(url, init) - net MPP32-MPP32-1b61b9d/webapp/src/components/home/IntegrationStrip.tsx :19
const res = await client.fetch('https://mpp32.org/api/intelligence', { - net MPP32-MPP32-1b61b9d/webapp/src/lib/api.ts :46
const response = await fetch(url, config); - net MPP32-MPP32-1b61b9d/webapp/src/pages/AgentHub.tsx :171
"Create Session": `const session = await fetch('https://mpp32.org/api/agent/sessions', { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Dashboard.tsx :174
const res = await fetch('https://mpp32.org/api/intelligence', { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Docs.tsx :25
const res = await fetch('https://mpp32.org/api/intelligence', { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Manage.tsx :106
const res = await fetch(`${API_BASE}${path}`, { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Messages.tsx :17
const res = await fetch(`${API_BASE}/api/contact`, { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Playground.tsx :268
const resp = await fetch(`${base}/api/intelligence/demo`, { - net MPP32-MPP32-1b61b9d/webapp/src/pages/Token.tsx :202
const res = await fetch(DEXSCREENER_API);
secrets 7
- secrets MPP32-MPP32-1b61b9d/backend/src/lib/catalog/crawlers/replicate.ts :96
const token = process.env.REPLICATE_API_TOKEN - secrets MPP32-MPP32-1b61b9d/backend/src/lib/mpp.ts :495
const expected = process.env.MPP_SECRET_KEY - secrets MPP32-MPP32-1b61b9d/backend/src/routes/submissions.ts :14
const resend = process.env.RESEND_API_KEY ? new Resend(process.env.RESEND_API_KEY) : null - secrets MPP32-MPP32-1b61b9d/webapp/src/components/home/IntegrationStrip.tsx :14
wallet: process.env.WALLET_KEY - secrets MPP32-MPP32-1b61b9d/webapp/src/pages/AgentConsole.tsx :1562
solanaPrivateKey: process.env.SOLANA_PRIVATE_KEY!, - secrets MPP32-MPP32-1b61b9d/webapp/src/pages/Dashboard.tsx :172
Mppx.create({ methods: [tempo({ account: privateKeyToAccount(process.env.PRIVATE_KEY) })] }) - secrets MPP32-MPP32-1b61b9d/webapp/src/pages/Docs.tsx :572
res.type('text/plain').send(process.env.MPP32_VERIFY_TOKEN);
database 1
- db MPP32-MPP32-1b61b9d/backend/src/lib/db.ts :1
import { PrismaClient } from '@prisma/client'
tool registrations 12
- get_mpp32_diagnostics MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :366
- debug_mpp32 MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :435
- list_mpp32_services MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :463
- find_mpp32_service MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :591
- call_mpp32_endpoint MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :681
- get_solana_token_intelligence MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :728
- try_solana_token_intelligence_free MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :766
- get_m32_whale_tracker MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :821
- compare_tokens_m32 MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :857
- scan_portfolio_m32 MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :896
- get_pivx_dao_intelligence MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :1014
- manage_agent_budget MPP32-MPP32-1b61b9d/mcp-server/src/index.ts :1104
install hooks 1
- prepublishOnly MPP32-MPP32-1b61b9d/mcp-server/package.json :31
npm run build
declared dependencies 16
- @hono/node-server@1.12.0
- @hono/zod-validator@^0.7.6
- @prisma/client@5.22.0
- @vibecodeapp/backend-sdk@^1.0.1
- @vibecodeapp/cloud-studio@^0.2.4
- @vibecodeapp/proxy@^2.0.3
- bs58@^6.0.0
- cheerio@^1.2.0
- hono@4.6.0
- mppx@^0.4.12
- prisma@5.22.0
- resend@^6.12.0
show 4 more
- tweetnacl@^1.0.3
- zod@4.1.11
- @types/bun@latest
- typescript@5.8.3