chiefofstaff Hyperliquid perp data + token safety

com.run402.chiefofstaff-solana/token-safety

by com.run402.chiefofstaff-solana· v0.2.0Official MCP Registry

Findings

Detected by Squatch rules from the server's metadata and protocol behavior. Latest completed scan: Nov 14, 2026, 22:57 UTC.

CriticalOpenSQ-SERVER-INSTRUCTIONS-INJECTION

The server's instructions field contains directives addressed to the AI model beyond describing how to use the server.

First seen Oct 16, 2026 · Last seen Nov 14, 2026

Suggested fix: Limit server instructions to usage guidance for this server's own tools.

MediumOpenSQ-TOOL-CREDENTIAL-ARGUMENT

A tool parameter asks the AI model to supply a password, token, key or similar credential, which the model can see and repeat.

First seen Oct 16, 2026 · Last seen Nov 14, 2026

Suggested fix: Obtain credentials through server-side configuration or MCP authorization instead of tool arguments.

LowOpenSQ-CONFORMANCE-MODERN-FAILURE

The server failed one or more MCP protocol conformance checks.

First seen Oct 16, 2026 · Last seen Nov 14, 2026

Suggested fix: Review the failed checks against the MCP specification.

LowOpenSQ-REPO-MISSING

No source repository is linked in the registry entry.

First seen Oct 16, 2026 · Last seen Nov 14, 2026

Suggested fix: Add a repository to server.json.

Squatch never calls a server's tools, so it cannot see what they actually do at run time.
It scans without credentials: tools behind authentication may not be visible.
It does not review source code, dependencies or the publisher's infrastructure.
A server can change behavior between scans; monitoring compares each scan with the last.
Classifications come from tool names, descriptions and schemas, which the publisher controls.

High-severity findings detected

1 open finding at HIGH or above (1 critical).

1 piece of evidence

Source: Squatch observedscan
Metadata and configuration analysis; tools are not executed.
Observed Nov 14, 2026, 22:57 UTC

Last checked Nov 14, 2026, 22:57 UTC

Squatch observed

Summary: { "type": "none", "challengeStatus": null, "scopesSupported": [], "resourceMetadataUrl": null, "authorizationServers": [] }

Checks: { "checks": [ { "check": "tools_list_deterministic", "passed": true }, { "check": "list_methods_succeed", "passed": true }, { "check": "list_results_schema_valid", "passed": true }, { "check": "pagination_terminates", "passed": true }, { "check": "tool_names_valid", "passed": true }, { "check": "tool_names_unique", "passed": true }, { "check": "no_network_schema_refs", "passed": true }, { "check": "x_mcp_header_valid", "passed": true }, { "check": "icon_urls_https_or_data", "detail": "no icons declared", "passed": true }, { "check": "initialize_version_echo", "detail": "requested 2025-11-25, received \"2025-11-25\"", "passed": true }, { "check": "notification_202", "passed": true }, { "check": "get_stream_or_405", "detail": "GET answered HTTP 200", "passed": false } ], "toolsListNondeterministic": false }