Is 1inch MCP server safe?

Findings (1)

• lowUnusually long tool description (over 2,000 characters)poison.long-description

  tool swap: …[Requires authentication] Call the authenticate tool first to start or confirm 1inch Business login (initialize 200 is still anonymous). If authenticate or this tool returns HTTP 401, complete OAuth, then retry. Swap tokens via 1inch. Supports classic (on-chain), Fusion (intent/gasless), and cross-chain swaps. Omit preferredType and the tool picks a type for you; set preferredType (classic, fusion, crosschain) to choose explicitly. When quoteOnly returns a `recommended` type and that type is available, present **only** that type to the user. Do not mention, compare, or suggest other swap types unless the user explicitly asks to compare alternatives. ERC-20 source tokens may require a one-time approval transaction before the swap can proceed; the approval costs native gas on the source chain even for gasless Fusion/cross-chain swaps. When a response includes an `approval` block, tell the user upfront (approval.estimatedCost holds the estimated cost in native units). Usage modes: 1. **Quote** (quoteOnly=true): Returns only one swap type and its quote. If you pass `preferredType` explicitly (classic, fusion, or crosschain), the response returns that exact type (when a quote for it is available). If `preferredType` is omitted, the tool compares classic, Fusion, and cross-chain internally and picks the best one. The chosen type is echoed as `recommended`. 2. **Execute** (default): Returns data to sign. Response type depends on swap mode: - Classic → {type:"classic", step:"approve"|"swap", tx:{to,data,value}} → sign with eth_sendTransaction, wait for receipt. If step="approve", sign the approve tx first, then call swap again for the actual swap tx. - Fusion → {type:"fusion", orderHash, typedData} → sign typedData with eth_signTypedData_v4, then call this tool again with signedOrder=<signature> and orderHash. - Cross-chain → {type:"crosschain", orderHash, typedData, srcChain, dstChain} → same as Fusion: sign typedData, then submit with signedOrder. 3. **Submit** (signedOrder=<sig>): Submit a previously signed Fusion/cross-chain order. Returns {status:"submitted", orderHash}. Flows: - **Full flow**: quote first (quoteOnly=true), then execute with chosen preferredType, then sign + submit. - **Shortcut**: skip the quote — call directly without quoteOnly. Omit preferredType to let the tool pick a type, or set preferredType explicitly. Set dstChain for cross-chain. Responses that require on-chain transactions link to a guide. Use the product_api tool with path="/web3/{chainId}" to broadcast (see linked guide for body format). With an active WalletConnect session (`walletconnect` action=connect), swap execution is automatic by default: classic approve/swap txs, Fusion/cross-chain sign-and-submit, and native escrow sends are prompted in the user’s wallet — no manual broadcast or separate submit step. Set `execute=false` to receive unsigned payloads instead. Set `execute=true` to require WalletConnect (fails if not connected).…