crossfin.dev

Item: crossfin.dev
Rating: 45
Author: wmcp.sh

https://crossfin.dev/api/mcp

45/100 · MCP Trust Grade · checked 5h ago · MCP 2025-06-18

✓ Watched since 2026-06-03 — behavioral baseline locked. We re-check this server's tool surface on a schedule; if it adds, removes, or silently rewrites a tool (rug-pull), we record it.

What it offers — 16 tools · Finance & Crypto

get_kimchi_premium

Free preview of Route Spread — real-time price spread between Korean and global crypto exchanges (top 3 pairs)

list_exchange_fees

Trading fees, withdrawal fees, and transfer times for all supported exchanges (Bithumb, Upbit, Coinone, GoPax, bitFlyer, WazirX, bitbank, Indodax, Bit

compare_exchange_prices

Compare Bithumb KRW prices vs Binance USD prices for tracked coins with transfer-time estimates

search_services

Search the CrossFin service registry (184 services) by keyword

list_services

List services from the CrossFin registry with optional category filter

get_service

Get detailed information about a specific service by ID

list_categories

List all service categories with counts

get_analytics

CrossFin gateway usage analytics — total calls, top services, recent activity

get_guide

Complete CrossFin API guide — services, pricing, x402 payment flow, code examples

find_optimal_route

Find cheapest/fastest path across 14 exchanges (incl. Coinbase, SUI, APT) using 13 bridge coins. Paid: $0.10 via x402. Requires local install with EVM

call_paid_service

Call any CrossFin paid API with automatic x402 USDC payment. Requires local install with EVM_PRIVATE_KEY.

create_wallet

Create a wallet in the local CrossFin ledger. Requires local install.

get_balance

Get wallet balance (KRW). Requires local install.

transfer

Transfer funds between wallets (KRW). Requires local install.

list_transactions

List transactions. Requires local install.

set_budget

Set daily spend limit (KRW). Requires local install.

Spec conformance20%100

✓ initialize → protocolVersion 2025-06-18
✓ initialize HTTP 200
✓ unknown method → -32601
✓ tools/list → 16 tools
✓ every tool has name + inputSchema

Security (OWASP MCP)30%10

16 tools scanned
no injection markup
2 secret-path refs

Reliability / performance20%70

single-probe latency 1867ms (PRELIMINARY — continuous uptime/p95 from proxy telemetry lands in v2)

Tool hygiene15%56

69% of tools have typed inputSchema
0/16 declare outputSchema
1 destructive-by-name tools lack safety annotations

Transparency / provenance15%70

HTTPS ✓
advertises protocol 2025-06-18

Observed behavior

No proxied traffic observed for this host yet. Connect it at /connect and its grade gains a measured Reliability score + per-tool behavioral evidence — the half a static scan can't produce.

Findings

FAILMCP08 Tool "find_optimal_route" references sensitive file paths / secrets (exfiltration surface).

FAILMCP08 Tool "call_paid_service" references sensitive file paths / secrets (exfiltration surface).

Grade another server

We re-grade crossfin.dev on a schedule and alert your Slack/webhook the moment its tools change or its grade drops — rug-pull insurance for the connection.

Share this report card

A 1200×630 card with the grade + audit — drop it in a post, Slack, or your repo.

MCP Trust report card — crossfin.dev grade F

Share on X Open card image

https://wmcp.sh/mcp/grade/crossfin.dev

Embed this grade

A live badge — it re-verifies itself and shows current stability. Static scorecards can't. Paste it in your README or site to show users you're independently audited.

Markdown (for your README)

[![MCP Trust Grade F](https://wmcp.sh/mcp/grade/crossfin.dev/badge.svg)](https://wmcp.sh/mcp/grade/crossfin.dev)

HTML

<a href="https://wmcp.sh/mcp/grade/crossfin.dev"><img src="https://wmcp.sh/mcp/grade/crossfin.dev/badge.svg" alt="MCP Trust Grade F · wmcp.sh"></a>

Agents: check this before connecting

Add the wmcp.sh trust oracle as an MCP server and call grade_mcp_server / check_mcp_drift in your agent's pre-connection gate:

https://wmcp.sh/mcp/trust

How this grade is computed. An open, independent rubric — Spec conformance (20%), Security mapped to the OWASP MCP Top 10 (30%), Reliability (20%), Tool hygiene (15%), Transparency (15%) — run by connecting to the server and inspecting its real MCP surface. The grade is free and identical whether or not the operator pays. v1 uses static + spec signals from a single connection; continuous uptime, real latency, and annotation-truthing (declared readOnly vs observed behavior) layer on via the wmcp.sh proxy.