gate-mcp-installer

Pass

Audited by Gen Agent Trust Hub on Apr 25, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes a bash script (scripts/install.sh) designed to automate the setup process. It performs standard administrative tasks such as directory creation, file copying, and environment detection to configure the user's development platform.
  • [EXTERNAL_DOWNLOADS]: The installation script fetches the gate-skills suite from the official vendor repository. It also interacts with the public npm registry to ensure necessary tools are available.
  • [REMOTE_CODE_EXECUTION]: The installer configures the development environment to run specific MCP tools using npx (e.g., gate-mcp, gatepay-local-mcp). This involves fetching and executing code from the npm registry as part of the tool's core functionality.
  • [SAFE]: The skill manages API keys and private key placeholders for trading and payment functionalities. These are handled locally by prompting the user and storing them in standard configuration files (e.g., mcp.json) as required for MCP operation. The gate-dex configuration includes a hardcoded API key used as a platform identifier for the DEX service. A remote merchant discovery service is configured via HTTP, which is a common pattern for public catalogs.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 25, 2026, 04:37 PM