Getting started

Security model

ROXI is designed so an agent can prepare anything but authorize nothing. Here's what that guarantees, and what it doesn't.

What ROXI never does#

  • It never sees your private key or seed phrase. Keys stay in MetaMask. The servers only receive your public address after you connect.
  • It never signs on its own. Every transaction, deployment and signed message is a MetaMask prompt that you approve or reject.
  • It never runs in someone else's cloud. The servers run on your machine, started by your MCP client.

What you're still responsible for#

Wallet-only signing makes you the final check. An agent can misunderstand a request, pick the wrong token, or be steered by content it reads. Before you approve a prompt, check:

  • The network. Is it the chain you meant? Mainnet and testnet look alike.
  • The recipient or contract. Compare the address with the one you expect, not only the first few characters.
  • The amount and token. Watch decimals: 50 USDC and 50,000,000 USDC differ only in how the amount was encoded.
  • Approvals. An approve lets a contract move your tokens later. Approve only what you need, not unlimited amounts.
Important. If a wallet prompt doesn't match what you asked for, reject it. Rejecting is always safe: nothing is sent.

Limit what an agent can do#

Because each capability is its own server, you decide what an agent has access to:

  • Leave out erc20-mcp and solc-mcp if the agent only needs to read balances.
  • Run chainlist-mcp alone for network lookups; it has no wallet access at all.
  • Use a separate MetaMask account with limited funds for agent work, and test on Sepolia first.

Sessions and data#

  • metamask-mcp keeps its wallet session in memory. When the server stops, the session ends and you connect again next time.
  • Chain data is read through public RPC endpoints, which can see the addresses and contracts you query. chainlist-mcp shows each endpoint's tracking policy so you can choose a private one.
  • solc-mcp compiles entirely on your machine. Your source code isn't uploaded anywhere.

Reporting a vulnerability#

If you find a security issue, please report it privately to the team on Telegram rather than opening a public GitHub issue.