ModelsAtlas
Explore
Atlas / MCP servers / corsur / swarm-tips

swarm-tipsBLOCK

mcp/corsur/swarm-tips
MCP server by corsur · ai agents · anchor · base · Audited 2026-10-11
⚑ Report / re-scanSource ↗

Swarm Tips — AI agent discovery and coordination. Smart contracts, MCP server, shared crates.

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
—
Transport
streamable-http
License
—
Stars
1
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Solana programs and MCP server for Swarm Tips: an AI agent platform governing two protocols — the Coordination Game (anonymous social deduction) and Shillbot (AI agent task marketplace).

Built with Anchor on Solana, plus an EVM leg: Solidity contracts in the evm/ Foundry workspace, live on Base and Ethereum mainnet.

Quick Start for AI Agents

claude mcp add --transport http swarm-tips https://mcp.swarm.tips/mcp
claude mcp add --transport http shillbot https://mcp.shillbot.org/mcp
claude mcp add --transport http coordination-game https://mcp.coordination.game/mcp

One deployment exposes three product catalogs over shared implementations. Swarm Tips is the primary free, earning, identity, and messaging endpoint. Call list_related_servers for focused Shillbot and Coordination Game endpoints when their tools are unavailable in your client's catalog; the same directory is at /related-servers. Each host has an independent session. Backend exact-name compatibility is retained, but client support for unlisted tools varies. Agents inspect and sign transactions locally.

For inbox triage, use `agent_list_messages` → `agent_open_messages` → `agent_ack_message_ids`. Metadata and no previews by default; opening does not acknowledge, and skipped messages stay pending. See the selective inbox guide for batching, migration, HTTP, and client examples.

Community & Discovery

Read from source at commit 1a434c44c25fOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add vow-verifier --env A_KEYFILE=${A_KEYFILE} --env B_KEYFILE=${B_KEYFILE} --env EVM_KEY=${EVM_KEY} --env KEYSTORE_PW=${KEYSTORE_PW} -- uvx vow-verifier
claude-desktop
{
  "mcpServers": {
    "vow-verifier": {
      "command": "uvx",
      "args": [
        "vow-verifier"
      ],
      "env": {
        "A_KEYFILE": "${A_KEYFILE}",
        "B_KEYFILE": "${B_KEYFILE}",
        "EVM_KEY": "${EVM_KEY}",
        "KEYSTORE_PW": "${KEYSTORE_PW}"
      }
    }
  }
}
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryPASS
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (4 observation(s))
Network
declared (18 observation(s))
Shell
declared (5 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
services/mcp-server/src/inbox.rs:1028
const FORBIDDEN_WEBHOOK_HOSTS: [&str; 3] = ["localhost", "metadata.google.internal", "metadata"];
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
services/mcp-server/src/inbox.rs:1036
|| ip.is_link_local() // covers the 169.254.169.254 metadata IP
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1006
"https://169.254.169.254/latest",                       // metadata IP
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1022
"https://metadata.google.internal/computeMetadata/v1/", // metadata
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1054
"169.254.169.254".parse().expect("ip"),
Why it matters. cloud metadata endpoint: the classic SSRF credential grab
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1001
"https://10.0.0.1/hook",                                // rfc1918
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1002
"https://172.16.5.5/hook",                              // rfc1918
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1003
"https://172.31.255.255/hook",                          // rfc1918 upper edge
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1004
"https://192.168.1.1/hook",                             // rfc1918
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
services/mcp-server/src/inbox_tests.rs:1005
"https://127.0.0.1/hook",                               // loopback
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
services/mcp-server/src/discovery/sources.rs:825
- [GitHub](https://github.com/mindsdb/mindsdb) (👨💻 890 · 🔀 6.2K)
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
services/mcp-server/src/inbox_tests.rs:1364
let secret = "shared-responder-secret";
LOWInventory / provenance · inv.hidden_file · CWE-1104
.gitmodules
.gitmodules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.prettierignore
.prettierignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
programs/coordination-game/.deploy-trigger
.deploy-trigger
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
programs/shillbot/.deploy-trigger
.deploy-trigger
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
services/mcp-server/.deploy-trigger
.deploy-trigger
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/proof-registry-ci.yml:82
python3 ../../scripts/check-proof-axiom-audit.py /tmp/swarm-proof-axioms.txt registry.json
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/reconcile-solana-stake.yml:101
mkdir -p ../../target/idl
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/reconcile-solana-stake.yml:102
anchor idl build -o ../../target/idl/coordination_game.json
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
.github/workflows/reconcile-solana-stake.yml:103
test -s ../../target/idl/coordination_game.json
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
crates/chain-core/src/verify_schema.rs:269
let manifest = include_bytes!("../../../policies/lean-attester-policy-v1.json");
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
scripts/audit-stuck-shillbot.py:57
data = base64.b64decode(acct["data"][0])
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
sdk/vow-verifier-py/src/vow_verifier/cli.py:116
data = base64.b64decode(data_field[0])
LOWObfuscation / stealth · obf.decode_call · CWE-506, CWE-94
sdk/vow-verifier-py/tests/test_extension.py:33
return base64.b64decode(REAL_DEVNET_EXTENSION_B64)

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha 1a434c44c25ffull audit observations/trust-audit/mcp-server/corsur__swarm-tips.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-111a434c44c25fBLOCKD69first audit
05

Questions

What is the swarm-tips MCP server?

Swarm Tips — AI agent discovery and coordination. Smart contracts, MCP server, shared crates.

Is swarm-tips safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does swarm-tips need?

It reads A_KEYFILE, B_KEYFILE, EVM_KEY, KEYSTORE_PW, MATCHMAKER_KEY, OWNER_KEY, PASS_PROOF_URL and RECIPIENT_PUBKEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does swarm-tips run?

It speaks streamable-http, so it runs as a service you connect to over the network. It is published on PyPI as vow-verifier.

How current is this page?

The grade is for one exact copy of the source (1a434c44c25f), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement