Substreams Search

Search, inspect, and analyze Substreams packages to discover modules, visualize data flows, and generate sink deployment commands.

This skill appears to do what it claims: it scrapes substreams.dev and fetches .spkg files to inspect module graphs and generate sink commands. Before installing/running it: - Treat it as code that will make outbound HTTP requests to substreams.dev and to any URL you pass in (inspect_package accepts arbitrary URLs). Do not pass internal-only or sensitive endpoints unless you isolate the process or run it in a safe network environment (SSRF risk). - Running via npx will pull the package from npm — verify the npm package and GitHub repository (author: PaulieB14) if you care about supply-chain provenance. - If running the server with HTTP/SSE enabled, avoid exposing it to untrusted networks without authentication. - If you need stronger assurance, run the provided code in a sandbox/container, review the full package on npm/github, or audit the @substreams/core and @modelcontextprotocol/sdk dependency versions used.

Package: (mcp) Version: Description: The package is a Model Context Protocol (MCP) server designed to search, inspect, and analyze Substreams packages from the substreams.dev registry. It provides tools to search the registry via web scraping, introspect .spkg files (protobuf-encoded blockchain data streams) using the @substreams/core library, and generate deployment commands for various data sinks. The codebase contains both a Python implementation (server.py) and a TypeScript implementation (src/index.ts), both of which perform legitimate operations consistent with the package's description. No malicious logic, unauthorized data exfiltration, or suspicious obfuscation was found.