@phantom/mcp-server
MCP Server for Phantom Wallet
Supply chain provenance
Status for the latest visible version.
Maintainers
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@modelcontextprotocol/sdk | AI (phantom-deps): Bundled CLI; dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/base64url | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/sdk-types | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/perps-client | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/api-key-stamper | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| source-diff | obfuscated-file:dist/cli.js | AI (source-diff): dist/cli.js is a tsup/esbuild CLI bundle; long lines are minified deps, not obfuscation. | ai | |
| source-diff | net-exec-file:dist/cli.js | AI (source-diff): Network + dynamic require is expected in a bundled MCP server CLI; no dropper pattern evident. | ai | |
| source-diff | source-size-tripled | AI (source-diff): Size increase reflects bundling all deps into a single CLI artifact; expected for this package. | ai | |
| phantom-deps | phantom-dep:bs58 | AI (phantom-deps): Bundled CLI; deps are inlined into dist/cli.js and won't appear as direct imports. | ai | |
| phantom-deps | phantom-dep:axios | AI (phantom-deps): Bundled CLI; deps are inlined into dist/cli.js and won't appear as direct imports. | ai | |
| phantom-deps | phantom-dep:@phantom/auth2 | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/utils | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/crypto | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@solana/web3.js | AI (phantom-deps): Bundled CLI; dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:qrcode-terminal | AI (phantom-deps): Bundled CLI; dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@phantom/parsers | AI (phantom-deps): Bundled CLI; same-org dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:@solana/spl-token | AI (phantom-deps): Bundled CLI; dep inlined into dist/cli.js. | ai | |
| phantom-deps | phantom-dep:openid-client | AI (phantom-deps): openid-client is a direct runtime dependency; false positive in monorepo context. | ai | |
| phantom-deps | phantom-dep:@phantom/constants | AI (phantom-deps): Workspace dependency in monorepo; stable pattern for this package. | ai | |
| phantom-deps | phantom-dep:@phantom/server-sdk | AI (phantom-deps): Workspace dependency in monorepo; stable pattern for this package. | ai | |
| dependencies | unvetted-dep:@phantom/cli | AI (dependencies): Sibling package from the same phantom-connect-sdk monorepo; expected internal dependency. | ai |
Versions (showing 28 of 28)
| Version | Deps | Published |
|---|---|---|
| 1.2.7 | 1 / 4 | |
| 1.2.6 | 1 / 4 | |
| 1.2.5 | 1 / 4 | |
| 1.2.4 | 1 / 4 | |
| 1.2.3 | 1 / 4 | |
| 1.2.2 | 1 / 4 | |
| 1.2.1 | 1 / 4 | |
| 1.2.0 | 1 / 4 | |
| 1.1.0 | 1 / 4 | |
| 1.0.4 | 17 / 10 | |
| 1.0.3 | 17 / 10 | |
| 1.0.2 | 17 / 10 | |
| 1.0.1 | 17 / 10 | |
| 1.0.0 | 17 / 10 | |
| 0.2.4 | 16 / 10 | |
| 0.2.3 | 16 / 10 | |
| 0.2.2 | 15 / 10 | |
| 0.2.1 | 14 / 10 | |
| 0.2.0 | 14 / 9 | |
| 0.1.8 | 13 / 9 | |
| 0.1.7 | 13 / 9 | |
| 0.1.6 | 13 / 9 | |
| 0.1.5 | 14 / 9 | |
| 0.1.4 | 14 / 9 | |
| 0.1.3 | 14 / 9 | |
| 0.1.2 | 14 / 9 | |
| 0.1.1 | 14 / 9 | |
| 0.1.0 | 11 / 9 |
v0.2.4
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.3
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.2
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.1
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.2.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.8
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.7
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.1.6
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.