bitpoort-on-chain-data

Security Findings (62)

• HighAS-002

  ⚠️Excessive Permissions ×6

  tool declares network permission

  query_blocksquery_transactionssearch_ragget_network_summary

  tool declares exec permission

  search_ragrpc_trace_transaction

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• HighAS-003

  🔀Scope Mismatch

  search_rag:tool name "search_rag" implies read-only operation but declares exec permission

  Fix: Ensure tool names, descriptions, and permission declarations are internally consistent. Use explicit naming conventions that fully reflect actual capabilities.

• MediumAS-002

  ⚠️Excessive Permissions ×3

  tool declares fs permission

  get_token_flowsget_wallet_profilerpc_read_contract

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• LowAS-011

  ℹ️Missing Rate-Limit / Timeout ×8

  tool performs network or execution operations but declares no rate-limit, timeout, or retry configuration

  query_blocksquery_transactionssearch_ragget_network_summaryget_conviction_signalsget_emerging_tokensget_hl_marketrpc_trace_transaction

  Fix: Declare explicit rate-limit, timeout, and retry configuration for all network and execution tools. Implement exponential back-off and surface resource state to the calling agent.

• LowAS-002

  ⚠️Excessive Permissions ×3

  tool declares http permission

  get_conviction_signalsget_emerging_tokensget_hl_market

  Fix: Tool requests broad permissions (exec/fs/network). Validate input parameters using Enums where possible, and restrict file system operations to explicit allowed directories.

• InfoAS-014

  ℹ️Dependency Inventory Unavailable ×41

  Tool did not expose metadata.dependencies or repo_url, so supply-chain coverage is limited.

  query_blocksquery_transactionssearch_ragget_whale_activityget_intent_detectionsget_pipeline_statusget_chain_statusget_healthinspect_blockget_logsget_alertsget_statsask_blockchainget_network_summaryget_entity_activityget_mev_leaderboardget_smart_walletsget_trade_signalsget_predictionsget_conviction_signalsget_exchange_flowsget_token_flowsget_price_historyget_risk_briefingget_alarm_feedget_alarm_categoriesget_emerging_tokensget_trending_tokensget_wallet_profileget_intelligence_feedget_hl_marketget_hl_tradersget_btc_flowsget_cross_chain_signalsrpc_get_balancerpc_get_blockrpc_get_transactionrpc_get_logsrpc_get_contract_inforpc_read_contractrpc_trace_transaction

  Fix: Review and remediate the identified issue.