wallet_balances
on npm:@phantom/mcp-server@1.2.7
Severity
1 finding on this tool
- mediumexcessive agencyf-r5-wallet_balances
Tool `wallet_balances` description mentions money but no `money` side-effect is declared
Description: "Returns token balances for the connected wallet." -- this references money/payment/refund/etc., but the declared side_effects ([]) don't include `money`. A capframe-bind policy that relies on declared side_effects to scope spend caveats will under-scope this tool.
fix: Add `money` to the tool's `side_effects` declaration, or rewrite the description to clarify that no actual money moves.
OWASP LLM08NIST MEASURE-2.6ATLAS T0040
About this tool
wallet_balances is one of 30 tools exposed by phantom-wallet-mcp. The server scored 58/100 overall against the capframe rule engine (source: registry). Last scanned 2026-06-27.
The findings above are emitted by the public capframe.findings.v1 schema. Disagree with one? Open an issue.