xyz.goldbean-api/goldbean-mcp

What we checked

Six static checks, weighted by risk. Every result reflects only what could be observed in the published package and repository — never intent.

• Injection surface

  fail25% of grade

  Tool descriptions/manifest scanned for instruction-injection patterns (imperatives at the model, hidden text, 'ignore previous', data-exfil URLs).

  tool "llm_chat" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "llm_embed" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "llm_summary" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "llm_translate" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "llm_code" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "sentiment" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "voice_2_text" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "text_2_voice" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "image_gen" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "image_analyze" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "image_upscale" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "video_gen" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "video_analyze" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "web_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "web_crawl" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "arxiv_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "wikipedia" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "github_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "github_repo" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "news_crypto" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "news_global" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "crypto_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "crypto_history" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "btc_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "eth_gas_now" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "token_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "token_price_history" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "eth_fee_history" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "stablecoin_rates" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "gas_forecast" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_swap_quote" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_pool_stats" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_lending_rates" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_staking_apr" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_positions" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "defi_insights" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "block_latest" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "block_detail" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "tx_detail" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "address_balance" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "address_txs" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "nonce" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ens_resolve" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "did_resolve" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "contract_verified" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "nft_floor" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "nft_metadata" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "nft_owner" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "nft_trades" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "weather_now" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "weather_forecast" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "weather_history" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "stock_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "forex_rate" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "commodity_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "index_price" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "fund_nav" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "kyc_check" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "aml_screen" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "address_risk" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "token_risk" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "phish_check" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "virus_scan" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "captcha_solve" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_twitter" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_discord" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_telegram" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_weibo" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_wechat" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_instagram" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "social_tiktok" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "lens_profile" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "farcaster_cast" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "air_ticket" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "hotel_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "food_delivery" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "express_trace" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "map_geocode" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "map_reverse" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "map_route" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "map_poi" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ecomm_product" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ecomm_review" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ecomm_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_pdf_parse" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_pdf_merge" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_excel" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_word" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_ocr" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "office_barcode" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "email_verify" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ip_locate" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "domain_whois" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "url_shorten" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "qrcode_gen" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "sms_send" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "market_intel" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "tracker_report" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "network_health" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "whale_alert" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "mempool_sniper" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "onchain_signals" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ai_agent_stats" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "simulation_tx" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "wallet_profile" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "game_nft_item" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "game_wallet" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "metaverse_land" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "music_search" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "music_recognize" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "rwa_realestate" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "rwa_commodity" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "rwa_bond" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "rwa_credit" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "ssi_verify" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "zk_proof" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "cross_chain_compare" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "pay_fiat" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "pay_crypto" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club. tool "token_insight" description: URL on a cheap/abused TLD (goldbean-api.xyz) — postmark-mcp used giftshop.club.

• Supply chain

  warn25% of grade

  Package provenance: namespace verification, repo linkage, maintainer count, account age, postinstall scripts, typosquat distance.

  install hook "prepare" present and not a recognized benign build command

• Credential hygiene

  fail15% of grade

  How the server takes secrets (env vs plaintext config vs hardcoded); secrets appearing in tool schemas.

  tool "defi_swap_quote" has a secret-shaped input parameter "fromToken" — secrets must never be tool parameters (the model would supply/handle the credential). tool "defi_swap_quote" has a secret-shaped input parameter "toToken" — secrets must never be tool parameters (the model would supply/handle the credential). tool "nft_metadata" has a secret-shaped input parameter "tokenAddress" — secrets must never be tool parameters (the model would supply/handle the credential). tool "nft_metadata" has a secret-shaped input parameter "tokenId" — secrets must never be tool parameters (the model would supply/handle the credential). tool "nft_owner" has a secret-shaped input parameter "tokenAddress" — secrets must never be tool parameters (the model would supply/handle the credential). tool "nft_owner" has a secret-shaped input parameter "tokenId" — secrets must never be tool parameters (the model would supply/handle the credential). tool "game_nft_item" has a secret-shaped input parameter "tokenId" — secrets must never be tool parameters (the model would supply/handle the credential).

• Permission scope

  pass15% of grade

  Declared tools vs. breadth (filesystem, network, exec); flags shell-exec and unbounded filesystem access.

  No shell-exec, unbounded/sensitive filesystem, or download-and-run primitives found in scanned source. PASS = no static red flag. Static scanning is blind to code fetched or executed at runtime.

• Version behavior

  unscannable10% of grade

  Diff of tool definitions between versions; new permissions or changed descriptions in a patch release (the postmark-mcp class).

  no prior version to diff (first sight of xyz.goldbean-api/[email protected]); version-drift / rug-pull cannot be evaluated. Cold-start risk is covered by point-in-time checks (injection_surface, supply_chain, credential_hygiene), not here.

• Transport config

  unscannable10% of grade

  Remote servers: TLS and auth mode (none/token/OAuth). Local servers: whether the manifest indicates it phones home.

  local stdio server: no remote transport or auth surface, and no phone-home/telemetry signal found in source. Absence of transport findings is NOT a safety guarantee — phone-home hosts can be constructed at runtime and defeat static analysis.