Is Spraay Solana Gateway MCP Server safe to use?

Spraay Solana Gateway MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.

How do I install Spraay Solana Gateway MCP Server?

Spraay Solana Gateway MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Spraay Solana Gateway MCP Server?

Spraay Solana Gateway MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is Spraay Solana Gateway MCP Server actively maintained?

Spraay Solana Gateway MCP Server is recently maintained — last commit was 81 days ago.

Spraay Solana Gateway MCP Server

@modelcontextprotocol/sdk

Batch send SOL or any SPL token to 1000+ wallets via x402. AI agent payments on Solana.

36.0M/wk 0 tools GitHub npm

No known CVEs

No license

Maintained

Last commit 81d ago

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-plagtech-spraay-solana-gateway": {
      "args": [
        "-y",
        "@modelcontextprotocol/sdk"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-plagtech-spraay-solana-gateway)](https://mcppedia.org/s/io-github-plagtech-spraay-solana-gateway)

Read me

What Spraay Solana Gateway MCP Server does

x402-powered batch payment infrastructure for AI agents on Solana.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@modelcontextprotocol/sdk' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

55/100across 5 weighted dimensions

How we score →

0255075100

−45

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

3 fixed

CVE-2026-25536low · fixedCVSS 3.1

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

### Summary Cross-client data leak via two distinct issues: (1) reusing a single `StreamableHTTPServerTransport` across multiple client requests, and (2) reusing a single `McpServer`/`Server` instance across multiple transports. Both are most common in stateless deployments. ### Impact This advisory covers two related but distinct vulnerabilities. A deployment may be affected by one or both. #### Issue 1: Transport re-use **What happens:** When a single `StreamableHTTPServerTransport` insta

Affected: >= 1.10.0Fixed in 1.26.0source →

CVE-2026-0621medium · fixedCVSS 4

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

### Impact A ReDoS vulnerability in the `UriTemplate` class allows attackers to cause denial of service. The `partToRegExp()` function generates a regex pattern with nested quantifiers (`([^/]+(?:,[^/]+)*)`) for exploded template variables (e.g., `{/id*}`, `{?tags*}`), causing catastrophic backtracking on malicious input. **Who is affected:** MCP servers that register resource templates with exploded array patterns and accept requests from untrusted clients. **Attack result:** An attacker sen

Affected: >= 0Fixed in 1.25.2source →

CVE-2025-66414medium · fixedCVSS 4

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

The Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with `StreamableHTTPServerTransport` or `SSEServerTransport` and has not enabled `enableDnsRebindingProtection`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access re

Affected: >= 0Fixed in 1.24.0source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Spraay Solana Gateway MCP Server safe to use?: Spraay Solana Gateway MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install Spraay Solana Gateway MCP Server?: Spraay Solana Gateway MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Spraay Solana Gateway MCP Server?: Spraay Solana Gateway MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Spraay Solana Gateway MCP Server actively maintained?: Spraay Solana Gateway MCP Server is recently maintained — last commit was 81 days ago.

Similar servers

Others in finance

View all →

Alpha Vantage Mcp93

Real-time financial market data: stocks, forex, crypto, commodities, and economic indicators

150 3

Spreedly Mcp92

A Model Context Protocol (MCP) server that provides AI assistants with direct access to the Spreedly payments API. Enables LLMs to manage gateways, process transactions, tokenize payment methods, and more, through structured, validated tool calls.

9 8

io.github.rezmeplxrf/insightsentry_mcp91

MCP server for InsightSentry financial data API - market data, options, screeners, and more

io.github.xkumakichi/xaip-mcp-server90

AI agents get on-chain identity, credentials, reputation, escrow, and persistent memory on XRPL.

MCP Security Weekly

Get CVE alerts and security updates for Spraay Solana Gateway MCP Server and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Finance

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "io-github-plagtech-spraay-solana-gateway": {
      "args": [
        "-y",
        "@modelcontextprotocol/sdk"
      ],
      "command": "npx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/io-github-plagtech-spraay-solana-gateway)](https://mcppedia.org/s/io-github-plagtech-spraay-solana-gateway)

Read me

What Spraay Solana Gateway MCP Server does

x402-powered batch payment infrastructure for AI agents on Solana.

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

npx -y '@modelcontextprotocol/sdk' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

💧 Spraay Solana Gateway

x402-powered batch payment infrastructure for AI agents on Solana.

Any AI agent can batch send SOL, USDC, BONK, or any SPL token to 1,000+ wallets via the x402 payment protocol. No API keys. No accounts. Pay per request.

🏗️ Architecture

AI Agent (any framework)
    │
    ├── HTTP Request
    │
    ▼
┌──────────────────────────────────────────┐
│   Spraay Solana Gateway                  │
│   gateway-solana.spraay.app              │
│                                          │
│   @x402/express + @x402/svm             │
│   ┌─────────────┐  ┌──────────────┐     │
│   │ x402 Payment│  │ Solana Batch │     │
│   │ Middleware   │  │ Engine       │     │
│   └──────┬──────┘  └──────┬───────┘     │
│          │                │              │
│          ▼                ▼              │
│   USDC payment     Execute batch        │
│   verified via     SOL/SPL transfers    │
│   facilitator                           │
└──────────────────────────────────────────┘
    │
    ▼
Solana Network

📡 Endpoints

Endpoint	Method	Price	Description
`/solana/batch-send-sol`	POST	$0.01	Batch send SOL to multiple wallets
`/solana/batch-send-token`	POST	$0.01	Batch send any SPL token
`/solana/quote`	GET	$0.001	Get cost estimate
`/solana/status/:txid`	GET	$0.001	Check transaction status
`/health`	GET	Free	Health check
`/.well-known/x402`	GET	Free	x402 discovery manifest

🚀 Quick Start

1. Clone & Install

git clone https://github.com/plagtech/spraay-solana-gateway.git
cd spraay-solana-gateway
npm install

2. Configure

cp .env.example .env
# Edit .env with your treasury wallet and private key

3. Run

npm run dev    # development (auto-reload)
npm start      # production

📖 API Usage

Batch Send SOL

curl -X POST https://gateway-solana.spraay.app/solana/batch-send-sol \
  -H "Content-Type: application/json" \
  -H "X-PAYMENT: <base64 payment proof>" \
  -d '{
    "recipients": [
      { "address": "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM", "amount": 0.01 },
      { "address": "7S3P4HxJpyyigGzodYwHtCxZyUQe9JiBMHyLWP9SfKFJ", "amount": 0.02 }
    ]
  }'

Batch Send SPL Token

curl -X POST https://gateway-solana.spraay.app/solana/batch-send-token \
  -H "Content-Type: application/json" \
  -H "X-PAYMENT: <base64 payment proof>" \
  -d '{
    "mint": "DezXAZ8z7PnrnRJjz3wXBoRgixCa6xjnB7YaB1pPB263",
    "recipients": [
      { "address": "9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM", "amount": 1000 },
      { "address": "7S3P4HxJpyyigGzodYwHtCxZyUQe9JiBMHyLWP9SfKFJ", "amount": 500 }
    ]
  }'

Get Quote

curl "https://gateway-solana.spraay.app/solana/quote?recipients=100&token=BONK"

🔐 x402 Payment Flow

Agent sends request without payment header
Gateway returns 402 Payment Required with Solana USDC payment instructions
Agent sends USDC on Solana to the treasury address
Agent retries request with payment proof in X-PAYMENT header
Gateway verifies payment via facilitator, executes batch transfer

Supported facilitators:

Devnet: https://x402.org/facilitator
Mainnet: https://facilitator.payai.network (PayAI — free tx fees)

🤖 MCP Server

The gateway includes an MCP server for AI agent framework integration:

# Install MCP SDK
npm install @modelcontextprotocol/sdk

# Run MCP server
node mcp/spraay-solana-mcp.js

Tools available:

spraay_solana_batch_send_sol — Batch send SOL
spraay_solana_batch_send_token — Batch send SPL tokens
spraay_solana_quote — Cost estimation
spraay_solana_tx_status — Transaction lookup

🌐 Deployment

Railway

Create new service in Railway project
Connect GitHub repo: plagtech/spraay-solana-gateway
Set environment variables in Railway dashboard
Deploy → configure custom doma

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

55/100across 5 weighted dimensions

How we score →

0255075100

−45

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

3 fixed

CVE-2026-25536low · fixedCVSS 3.1

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

Affected: >= 1.10.0Fixed in 1.26.0source →

CVE-2026-0621medium · fixedCVSS 4

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

Affected: >= 0Fixed in 1.25.2source →

CVE-2025-66414medium · fixedCVSS 4

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Affected: >= 0Fixed in 1.24.0source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Spraay Solana Gateway MCP Server safe to use?: Spraay Solana Gateway MCP Server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
How do I install Spraay Solana Gateway MCP Server?: Spraay Solana Gateway MCP Server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Spraay Solana Gateway MCP Server?: Spraay Solana Gateway MCP Server is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Spraay Solana Gateway MCP Server actively maintained?: Spraay Solana Gateway MCP Server is recently maintained — last commit was 81 days ago.