Okto Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Okto Mcp Server (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
A bulleted imperative like {match} tells the agent to never reveal, disclose, or mention something to the user. Used adversarially it can instruct the agent to hide its tool calls or lie about what it did — stripping the transparency a user relies on to trust the agent.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
A Model Context Protocol (MCP) server for Okto Web3 integration in Claude Desktop with auto authentication support. This server enables AI assistants to manage Web3 transactions and portfolio through natural language interactions.
a. Create a Google Cloud Project:
b. Create OAuth 2.0 Credentials:
http://localhost:3000/oauth2callback to the authorized redirect URIsgcp-oauth.keys.jsonGet these Okto credentials from https://dashboard.okto.tech/:
OKTO_ENVIRONMENT=sandbox
OKTO_CLIENT_PRIVATE_KEY=your_private_key
OKTO_CLIENT_SWA=your_swaYou can authenticate in two ways:
a. Global Authentication (Recommended):
# First time: Place gcp-oauth.keys.json in your home directory's .okto-mcp folder
mkdir -p ~/.okto-mcp
mv gcp-oauth.keys.json ~/.okto-mcp/
# Run authentication from anywhere
npx @okto_web3/okto-mcp-server@latest authb. Local Authentication:
# Place gcp-oauth.keys.json in your current directory
# The file will be automatically copied to global config
npx @okto_web3/okto-mcp-server@latest authThe authentication process will:
gcp-oauth.keys.json in the current directory or ~/.okto-mcp/~/.okto-mcp/~/.okto-mcp/credentials.jsonNote: - After successful authentication, credentials are stored globally in~/.okto-mcp/and can be used from any directory - Both Desktop app and Web application credentials are supported - For Web application credentials, make sure to addhttp://localhost:3000/oauth2callbackto your authorized redirect URIs
Add the following to your Claude Desktop configuration file (typically located at ~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"okto": {
"command": "node",
"env": {
"OKTO_ENVIRONMENT": "sandbox",
"OKTO_CLIENT_PRIVATE_KEY": "your_private_key_here",
"OKTO_CLIENT_SWA": "your_swa_here"
},
"args": [
"/path/to/okto-mcp-server/build/index.js"
]
}
}
}Replace:
your_private_key_here with your Okto client private keyyour_swa_here with your Okto client SWA/path/to/okto-mcp-server with the actual path where you installed the serverAlternatively, if you installed via npm:
{
"mcpServers": {
"okto": {
"command": "npx",
"env": {
"OKTO_ENVIRONMENT": "sandbox",
"OKTO_CLIENT_PRIVATE_KEY": "your_private_key_here",
"OKTO_CLIENT_SWA": "your_swa_here"
},
"args": [
"@okto_web3/okto-mcp-server@latest"
]
}
}
}The server provides the following tools that can be used through Claude Desktop:
get-portfolio)Retrieves detailed portfolio information including holdings and balances.
<!-- ```json {}
### 2. Get Account (`get-account`)
Retrieves account details across multiple chains.
<!-- ```json
{}get-nft-collections)Lists all NFT collections associated with the account. <!--
{}get-orders-history)Retrieves transaction history.
<!-- ```json {}
### 5. Get NFT Portfolio (`get-nft-portfolio`)
Shows detailed NFT holdings information.
<!-- ```json
{}get-tokens)Lists all available tokens and their details.
<!-- ```json {}
### 7. Token Transfer (`token-transfer`)
Transfers tokens between addresses.
{ "amount": "1000000000000000000", "recipient": "0x...", "token": "0x...", "caip2Id": "eip155:1" }
### 8. Get Chains (`get-chains`)
Lists all supported blockchain networks.
<!-- ```json
{}~/.okto-mcp/)gcp-oauth.keys.json is in either your current directory or ~/.okto-mcp/web or installed credentialsISC
If you encounter any issues or have questions, please file an issue on the GitHub repository.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.