Is Uluwalletmcp safe to install?

SaferSkills independently audited Uluwalletmcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.

CategoryWeightCategory scoreContribution

Securityprompt, exec, net, exfil, eval

35%

100

35.0 pts

Supply chainhash, typosquat, maintainer, lockfile

20%

100

20.0 pts

Maintenancestaleness, pinning, CI

15%

100

15.0 pts

TransparencySKILL.md, perms, README

15%

100

15.0 pts

Communityinstalls, verify, response

15%

100

15.0 pts

Findings & checks · 0 flagged

Securityscore 100 · 0 findings

✓—All security checks passedNo findings in this category for the latest scan.pass

Supply chainscore 100 · 0 findings

✓—All supply chain checks passedNo findings in this category for the latest scan.pass

Maintenancescore 100 · 0 findings

✓—All maintenance checks passedNo findings in this category for the latest scan.pass

Transparencyscore 100 · 0 findings

✓—All transparency checks passedNo findings in this category for the latest scan.pass

Communityscore 100 · 0 findings

✓—All community checks passedNo findings in this category for the latest scan.pass

The primary manifest — the file an agent reads to learn what this artifact does.

README.md · 1 file

README.md4.5 KB · Markdown

UluWalletMCP

MCP server for managing Algorand signer records, enforcing local signing policy, and signing payloads.

Build anywhere, sign here.

UluWalletMCP is not responsible for network access, querying chain state, building transactions, or broadcasting. The caller handles chain context and payload correctness. UluWalletMCP handles key management, policy enforcement, and signing only.

Setup

npm install

Optionally set a custom data directory (defaults to ~/.ulu-wallet-mcp):

export ULU_WALLET_MCP_DATA_DIR=/path/to/data

Usage

node index.js

Adding to a Client

{
  "mcpServers": {
    "ulu-wallet-mcp": {
      "command": "node",
      "args": ["/absolute/path/to/ulu-wallet-mcp/index.js"]
    }
  }
}

Tools

Signer Management

Tool	Description
`wallet_list_signers`	List all registered signers
`wallet_get_signer`	Get full signer record by ID
`wallet_create_hot_signer`	Generate a new hot signer with fresh keypair
`wallet_import_hot_signer`	Import an account from a 25-word mnemonic
`wallet_create_lsig_signer`	Create a LogicSig signer from compiled TEAL
`wallet_delete_signer`	Delete a signer and its key material

Signing

Tool	Description
`wallet_sign_transactions`	Sign unsigned transactions with policy enforcement
`wallet_sign_bytes`	Sign arbitrary bytes (hot signers only)

Core Concepts

Signer Record

Each signer is a registered signing authority identified by signerId:

{
  "signerId": "agent-hot-1",
  "signerType": "hot",
  "signerClass": "custody",
  "storageType": "local_file",
  "capabilities": ["sign_transactions", "sign_bytes"],
  "metadata": {
    "description": "Agent automation signer",
    "nickname": "agent-hot",
    "createdAt": "2026-03-07T18:00:00Z"
  },
  "addresses": {
    "primary": "ADDRESS_HERE",
    "authAddress": null,
    "lsigAddress": null
  },
  "policy": {
    "maxTransactionsPerRequest": 16,
    "allowRekey": false,
    "allowCloseRemainderTo": false,
    "allowAssetCloseTo": false,
    "expiresAt": null
  },
  "config": {},
  "state": {}
}

Signer Types

Type	Description	Use Cases
`hot`	Unattended local signer with key stored on disk	Automation, relays, fee sponsorship, agents
`lsig`	Stored LogicSig signer (Algorand-specific)	Constrained delegated signing, time-limited authority
`secure`	OS-keychain-backed signer (planned)	User custody, higher trust signing

Signer Classes

Class	Meaning
`custody`	Signer controls key material directly
`delegated`	Constrained delegated authority (e.g. LogicSig)
`external`	Signing performed by external system (planned)
`virtual`	Identity-only record, no signing (planned)

Storage Types

Type	Used By
`local_file`	Hot signers — secret key stored in `~/.ulu-wallet-mcp/keys/`
`artifact`	LogicSig signers — serialized lsig stored in `~/.ulu-wallet-mcp/keys/`
`os_keychain`	Secure signers (planned)

Capabilities

Capability	Description
`sign_transactions`	Can sign Algorand transaction payloads
`sign_bytes`	Can sign arbitrary byte arrays (hot signers only)

Policy

Policy is enforced before every signing operation. Transactions violating policy are rejected.

Field	Default	Description
`maxTransactionsPerRequest`	`16`	Max transactions per signing call
`allowRekey`	`false`	Allow transactions with `rekeyTo` set
`allowCloseRemainderTo`	`false`	Allow payment transactions that close the account
`allowAssetCloseTo`	`false`	Allow asset transfers that close out the asset
`expiresAt`	`null`	ISO 8601 expiry timestamp, `null` for no expiry

Additionally, wallet_sign_transactions verifies that each transaction's sender address matches the signer's address before signing.

Data Directory

All persistent state lives under ~/.ulu-wallet-mcp/ (or $ULU_WALLET_MCP_DATA_DIR):

~/.ulu-wallet-mcp/
├── signers.json          # Signer records (0600)
└── keys/                 # Key material directory (0700)
    ├── <signerId>.key    # Hot signer secret keys (0600, base64)
    └── <signerId>.lsig   # Serialized LogicSig artifacts (0600, base64)

Key material files are created with restrictive permissions (0600/0700).

Uluwalletmcp— agent skill

Is Uluwalletmcp safe to install?

UluWalletMCP

Setup

Usage

Adding to a Client

Tools

Signer Management

Signing

Core Concepts

Signer Record

Signer Types

Signer Classes

Storage Types

Capabilities

Policy

Data Directory

Audit the pieces. Scan the whole. Decide.