{
  "projectId": "bybit-agent-tools",
  "title": "Bybit MCP 的审批与请求签名路径",
  "summary": "MCP 服务器发行包包含启动完整性校验、工具版本检查、用户审批入口及 API 签名模块。其保障仍依赖宿主与真实交易所账户权限。",
  "scope": "npm bybit-official-trading-server@2.1.23 的选定发布文件；REA 解析 2 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:34:56.709864+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "标记审批的工具有明确拒绝分支",
      "detail": "requiresApproval 为真的工具先调用 requireUserApproval；客户端不支持 form elicitation，或用户未明确接受时会抛错。流程还把规范化参数摘要放入审批请求。这证明选定入口有条件审批代码，不能推导每个工具都要求审批，或远端订单权限已充分限制。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_189a33538aa25234fc7a1337b21c4cdea89c087ea703d3b3f4222e158cf63da2"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/bybit-official-trading-server/-/bybit-official-trading-server-2.1.23.tgz"
      ]
    },
    {
      "title": "签名与版本来源是独立模块",
      "detail": "网络模块包含 HMAC/RSA 签名与 X-BAPI 请求头构建；入口通过 api.bybit.com/ai-manifest/mcp/manifest 获取版本清单并检查本地文件。没有读取用户 API key，也没有向交易接口发请求。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_189a33538aa25234fc7a1337b21c4cdea89c087ea703d3b3f4222e158cf63da2"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/bybit-official-trading-server/-/bybit-official-trading-server-2.1.23.tgz"
      ]
    }
  ],
  "limitations": [
    "本轮覆盖服务器入口与签名/订阅公共块，未分析全部工具定义。",
    "服务端权限、撤销和实盘订单边界仍需专门测试。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "bybit-official-trading-server@2.1.23",
      "url": "https://registry.npmjs.org/bybit-official-trading-server/-/bybit-official-trading-server-2.1.23.tgz",
      "sha256": "3f95eaa24930caec994492ca456e683f37e443008fb6761faaa853f6f4bd48f1"
    },
    {
      "label": "dist--index.js",
      "url": "https://registry.npmjs.org/bybit-official-trading-server/-/bybit-official-trading-server-2.1.23.tgz",
      "sha256": "013783d50a57c368730556c6d26e73c669100a69b799616c5f6bf3e8c2d3fcc5"
    },
    {
      "label": "dist--chunk-UPBMVGYX.js",
      "url": "https://registry.npmjs.org/bybit-official-trading-server/-/bybit-official-trading-server-2.1.23.tgz",
      "sha256": "ddb0382ff91c84355b9dbece99f69a63e6a7c8a1c3c0e34368c31279d09ccfc5"
    }
  ],
  "evidenceIds": [
    "ev_189a33538aa25234fc7a1337b21c4cdea89c087ea703d3b3f4222e158cf63da2"
  ],
  "reportUrl": "/research/rea/bybit-agent-tools.json",
  "coverage": {
    "parsedFiles": 2,
    "parseFailures": 0,
    "semanticCoverage": "unknown",
    "rootArtifactSha256": "0ec7398016c2ef64788e3a99007ca4199d401b09b733d3fca0417d228ddfe1e7",
    "inputFileCount": 2,
    "inputBytes": 25099,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}