Dkg MCP Server

by OriginTrail• 141•• Scanned•Claim this listing•Request removal
Crypto & Web3agent memoryai agentsai memoryclaude codecodex

OriginTrail Decentralized Knowledge Graph (DKG) — Shared memory for AI agents. Give Hermes, OpenClaw, Claude Code, Codex, and Cursor a local knowledge-graph memory that several agents can share, with provenance, and verify on-chain when it matters. Open source, Apache-2.0.

Dkg is an open-source mcp server by OriginTrail, written mainly in TypeScript, with 141 GitHub stars and the Apache-2.0 license. Its code was last updated Nov 1, 2026.

Scan summary: scanned Nov 5, 2026 at commit 4ef623b. Seen able to run shell commands, run dynamic code, read environment and secrets, connect to the internet. Scan policy

aboutREADMEsecurityreviews
Scanned
Full scan at 4ef623b · Nov 5, 2026
Scanned Builds
Static code scanwarn
Secrets scanfail
Dependency audit172 known vulnerabilitiesfail
Manifestnonewarn
Buildpass
Boot & handshaken/a
Network egresswarn
Reproducible (×3)n/a

Findings (133)

  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    code-execution issue
    Details are available to the maintainer after claiming this listing.
  • high
    credential-access issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    secrets issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • high
    dependencies issue
    Details are available to the maintainer after claiming this listing.
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    packages/evm-module/scripts/run-coverage.js:12
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    packages/evm-module/scripts/run-tests.js:7
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    packages/evm-module/utils/helpers.ts:516
  • medium
    Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.
    packages/evm-module/utils/helpers.ts:525
  • medium
    pycryptodome@3.9.9: 1 known vulnerability
    PYSEC-2026-1811
    packages/adapter-hermes/pytests/requirements.txt
  • medium
    adm-zip@0.4.16: 7 known vulnerabilities
    GHSA-7q85-xj36-vmfc, GHSA-8238-w5pm-2374, GHSA-c6fg-446q-cg94, GHSA-j5f4-cc29-5x44, GHSA-p634-w6r4-rjp2 +2 more
    pnpm-lock.yaml
  • medium
    axios@1.15.2: 28 known vulnerabilities
    GHSA-35jp-ww65-95wh, GHSA-3pq3-5fj3-cg6v, GHSA-42h9-826w-cgv3, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2 +23 more
    pnpm-lock.yaml
  • medium
    body-parser@2.2.2: 2 known vulnerabilities
    GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.6: 6 known vulnerabilities
    GHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7 +1 more
    pnpm-lock.yaml
  • medium
    brace-expansion@5.0.9: 3 known vulnerabilities
    GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7
    pnpm-lock.yaml
  • medium
    browserslist@4.28.1: 2 known vulnerabilities
    GHSA-73wf-gq98-2v4g, GHSA-c83g-rgw3-j3cx
    pnpm-lock.yaml
  • medium
    fast-uri@3.1.2: 11 known vulnerabilities
    GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more
    pnpm-lock.yaml
  • medium
    fflate@0.8.2: 1 known vulnerability
    GHSA-px8p-9vwx-vf98
    pnpm-lock.yaml
  • medium
    follow-redirects@1.16.0: 3 known vulnerabilities
    GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8
    pnpm-lock.yaml
  • medium
    form-data@4.0.5: 1 known vulnerability
    GHSA-hmw2-7cc7-3qxx
    pnpm-lock.yaml
  • medium
    happy-dom@20.8.9: 3 known vulnerabilities
    GHSA-5fpq-26gf-qwcr, GHSA-834v-8h66-3h79, GHSA-c8p4-j97h-3vg8
    pnpm-lock.yaml
  • medium
    immutable@4.3.8: 2 known vulnerabilities
    GHSA-v56q-mh7h-f735, GHSA-xvcm-6775-5m9r
    pnpm-lock.yaml
  • medium
    ip-address@10.1.1: 7 known vulnerabilities
    GHSA-22jq-vg5j-6vgg, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr +2 more
    pnpm-lock.yaml
  • medium
    js-yaml@3.14.2: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    js-yaml@4.1.1: 4 known vulnerabilities
    GHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68
    pnpm-lock.yaml
  • medium
    nanoid@3.3.12: 2 known vulnerabilities
    GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8
    pnpm-lock.yaml
  • medium
    postcss@8.5.15: 2 known vulnerabilities
    GHSA-fxqj-rqcc-2cmp, GHSA-r28c-9q8g-f849
    pnpm-lock.yaml
  • medium
    protobufjs@8.3.0: 5 known vulnerabilities
    GHSA-94rc-8x27-4472, GHSA-f38q-mgvj-vph7, GHSA-j3f2-48v5-ccww, GHSA-jfj6-75fj-8934, GHSA-wcpc-wj8m-hjx6
    pnpm-lock.yaml
  • medium
    react-router@7.17.0: 5 known vulnerabilities
    GHSA-337j-9hxr-rhxg, GHSA-chx6-hx7r-mcp5, GHSA-h8fp-f39c-q6mh, GHSA-qwww-vcr4-c8h2, GHSA-wrjc-x8rr-h8h6
    pnpm-lock.yaml
  • medium
    smol-toml@1.7.0: 2 known vulnerabilities
    GHSA-7w5x-hrqm-74c2, GHSA-r4xh-jqrq-34v2
    pnpm-lock.yaml
  • medium
    source-map-js@1.2.1: 1 known vulnerability
    GHSA-68fv-2mgg-jv7q
    pnpm-lock.yaml
  • medium
    tmp@0.2.4: 1 known vulnerability
    GHSA-ph9p-34f9-6g65
    pnpm-lock.yaml
  • medium
    undici@6.24.0: 14 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-35p6-xmwp-9g52, GHSA-4qv8-2p9j-2685, GHSA-8xcm-r25x-g524, GHSA-9fm3-97px-rjf6 +9 more
    pnpm-lock.yaml
  • medium
    undici@7.29.1: 8 known vulnerabilities
    GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more
    pnpm-lock.yaml
  • medium
    uuid@8.3.2: 1 known vulnerability
    GHSA-w5hq-g745-h8pq
    pnpm-lock.yaml
  • medium
    vite@6.4.2: 7 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff, GHSA-r825-w8mm-5pxw +2 more
    pnpm-lock.yaml
  • medium
    vite@7.3.2: 7 known vulnerabilities
    GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-fx2h-pf6j-xcff, GHSA-r825-w8mm-5pxw +2 more
    pnpm-lock.yaml
  • medium
    ws@7.5.10: 1 known vulnerability
    GHSA-96hv-2xvq-fx4p
    pnpm-lock.yaml
  • medium
    ws@8.20.1: 1 known vulnerability
    GHSA-96hv-2xvq-fx4p
    pnpm-lock.yaml
  • medium
    zod@3.25.76: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    zod@4.4.3: 1 known vulnerability
    GHSA-mrhx-c7xc-m3w5
    pnpm-lock.yaml
  • medium
    Install contacted hosts other than package registries
    binaries.soliditylang.org, telemetry.vercel.com
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    devnet/issue-2052-system-records/extract-rdf.test.ts:133
  • low
    In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).
    scripts/lib/__tests__/package-certification-workflow.test.mjs:19
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/lib/__tests__/query-observation.test.mjs:426
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/lib/__tests__/query-observation.test.mjs:427
  • low
    In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.
    scripts/lib/__tests__/query-observation.test.mjs:444
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/conviction-emission-bell/automated.test.ts:56
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/agent-provenance/automated.test.ts:52
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/storage-ack-priority-lane/2026-07-08-six-node-devnet.md:179
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/v10-rs-prune/automated.test.ts:47
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/v10-stress/automated.test.ts:68
  • low
    Possible example credential in docs/tests: generic-api-key
    devnet/v10-end-to-end/automated.test.ts:73
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/archive/internal/SPEC_PART1_MARKETPLACE.md:81
  • low
    Possible example credential in docs/tests: generic-api-key
    docs/archive/v9/specs/SPEC_PART1_MARKETPLACE.md:81
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/adapter-openclaw/test/setup.part-23.test.ts:186
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/_helpers/refusing-endpoint-adapter.ts:47
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/authority-index-snapshot-wiring.test.ts:41
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/chain-cursor-wiring.test.ts:7
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/e2e-finalization.test.ts:16
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/e2e-security.test.ts:145
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/named-ka-recovery-pending-warning.test.ts:152
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/durable-sync-graph-scoped-materialization.test.ts:46
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/agent/test/rfc64-inventory-v1-candidates.test.ts:109
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-adapter-cg-policy-cancellation.unit.test.ts:4
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/context-graph-name-hash-reverse-resolution.fixtures.ts:12
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-adapter-external-signer.unit.test.ts:26
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/chain/test/evm-adapter-receipt-detach.unit.test.ts:5
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/chain/test/evm-adapter-stuck-transaction.unit.test.ts:7
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-init-admission.unit.test.ts:8
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/context-graph-registration-signing.unit.test.ts:17
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-adapter-update-context.unit.test.ts:7
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-fee-policy.unit.test.ts:20
  • low
    Possible example credential in docs/tests: private-key
    packages/chain/test/fixtures/localhost-tls/localhost-key.pem:1
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/chain/test/ka-version-snapshot-settlement.unit.test.ts:115
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/rpc-failover-host-only-messages.unit.test.ts:56
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/evm-init-single-flight.unit.test.ts:16
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/chain/test/stuck-transaction-recovery.unit.test.ts:20
  • low
    Possible example credential in docs/tests: generic-api-key
    5 matches in this file
    packages/chain/test/remote-signer.unit.test.ts:31
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/cli/test/chain-rpc-transport-status.test.ts:83
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/cli/test/publisher-startup-admission.test.ts:36
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/cli/test/integrations-install-service.test.ts:599
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/cli/test/status-chain-rpc.test.ts:52
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/cli/test/publisher-runner-rpc-usage.test.ts:39
  • low
    Possible example credential in docs/tests: stripe-access-token
    2 matches in this file
    packages/core/test/log-redaction.test.ts:88
  • low
    Possible example credential in docs/tests: jwt
    packages/core/test/log-redaction.test.ts:96
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/core/test/log-redaction.test.ts:13
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/core/test/rfc64-semantic-addresses-v1.test.ts:83
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/core/test/crypto.test.ts:253
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/test/rfc64-semantic-records-v1.test.ts:206
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/core/test/author-catalog-codec.test.ts:63
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/kafka-plugin/test/kafka-plugin-api.e2e.test.ts:347
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/mcp-dkg/test/inject-session-context-hook.test.ts:438
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/node-ui/test/redact-rpc-url.test.ts:42
  • low
    Possible example credential in docs/tests: generic-api-key
    2 matches in this file
    packages/publisher/test/assertion-draft-recovery.test.ts:15
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/publisher/test/chain-event-lane-log-range.test.ts:135
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/publisher/test/rs-scoped-promotion.test.ts:36
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/publisher/test/issue-373-adapter-backed-signer.test.ts:21
  • low
    Possible example credential in docs/tests: generic-api-key
    packages/publisher/test/publication-pricing.integration.test.ts:34
  • low
    Possible example credential in docs/tests: generic-api-key
    run-reports/2026-10-18-issue-3332.md:15
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/publisher/test/publisher-no-random-wallet.test.ts:110
  • low
    Possible example credential in docs/tests: generic-api-key
    3 matches in this file
    packages/storage/test/sparql-terms.test.ts:266
  • low
    Possible example credential in docs/tests: generic-api-key
    scripts/lib/__tests__/devnet-update-seal.test.mjs:32
  • low
    pytest@9.0.2: 1 known vulnerability
    PYSEC-2026-1845
    packages/adapter-hermes/pytests/requirements.txt
  • low
    requests@2.32.5: 1 known vulnerability
    PYSEC-2026-2275
    packages/adapter-hermes/pytests/requirements.txt
  • low
    idna@3.9.0: 1 known vulnerability
    PYSEC-2026-215
    packages/adapter-hermes/pytests/requirements.txt
  • low
    pygments@2.9.0: 2 known vulnerabilities
    PYSEC-2023-117, PYSEC-2026-2987
    packages/adapter-hermes/pytests/requirements.txt
  • low
    @babel/core@7.29.0: 1 known vulnerability
    GHSA-4x5r-pxfx-6jf8
    pnpm-lock.yaml
  • low
    @hono/node-server@1.19.17: 1 known vulnerability
    GHSA-rmxm-3fg6-px4f
    pnpm-lock.yaml
  • low
    @vitest/mocker@4.0.18: 2 known vulnerabilities
    GHSA-82fw-gwwq-j7x9, GHSA-qxg6-89mg-rqv8
    pnpm-lock.yaml
  • low
    baseline-browser-mapping@2.10.0: 1 known vulnerability
    GHSA-w5vr-8v7q-w6rv
    pnpm-lock.yaml
  • low
    elliptic@6.6.1: 1 known vulnerability
    GHSA-848j-6mx2-7j84
    pnpm-lock.yaml
  • low
    esbuild@0.27.3: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    pnpm-lock.yaml
  • low
    esbuild@0.27.7: 1 known vulnerability
    GHSA-g7r4-m6w7-qqqr
    pnpm-lock.yaml
  • low
    glob@10.5.0: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    pnpm-lock.yaml
  • low
    glob@13.0.6: 1 known vulnerability
    GHSA-3g3m-2fjr-6pw4
    pnpm-lock.yaml
  • low
    minimatch@10.2.3: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    minimatch@10.2.6: 1 known vulnerability
    GHSA-g3hv-75wg-m249
    pnpm-lock.yaml
  • low
    pbkdf2@3.1.5: 1 known vulnerability
    GHSA-477h-4r7f-fvrx
    pnpm-lock.yaml
  • low
    qs@6.15.2: 3 known vulnerabilities
    GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx
    pnpm-lock.yaml
  • low
    serialize-javascript@7.0.5: 1 known vulnerability
    GHSA-m5mm-p8h7-m29v
    pnpm-lock.yaml
  • low
    package.json has a preinstall script
    node packages/cli/scripts/verify-node-sqlite-runtime.mjs
    package.json
  • low
    No manifest declaring network access and environment variables (agent.json)
  • low
    Couldn't work out how to start the server. Set "entrypoint" in agent.json.

Network activity

During install
binaries.soliditylang.orggithub.comregistry.npmjs.orgrelease-assets.githubusercontent.comtelemetry.vercel.com
While running
Not run — the code wasn't started in this scan

Automated result for the commit shown. See our scan policy. View the scan log

Maintainers can claim the listing to rescan, or dispute a result.

Dkg alternatives

View more →

Similar mcp servers in Crypto & Web3, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Dkg (this page)
OriginTrail
141Apache-2.0Nov 1, 2026Scanned, no flagged issues
Solana MCP Vybe
vybenetwork
2.2kNone foundOct 27, 2026Not scanned yet
Oracle3 Prediction Market Agent
YichengYang-Ethan
560Apache-2.0Oct 12, 2026Scanned, no flagged issues
Web3 Research MCP
aaronjmars
170MITOct 31, 2026Scanned, no flagged issues
Alchemy MCP Server
alchemyplatform
88MITSep 24, 2026Scanned, no flagged issues
Cryptopanic MCP Server
kukapay
74MITDec 9, 2025Scanned, no flagged issues