{
  "projectId": "okx-agent-trade-kit",
  "title": "OKX Agent Trade Kit｜MCP 工具权限与模式",
  "summary": "实际发布的 MCP 核心包按业务模块和只读配置生成工具集合，并区分模拟与实盘配置；客户端工具过滤不替代交易所账户权限。",
  "scope": "npm @okx_ai/okx-trade-mcp@1.4.8 的选定发布文件；REA 解析 1 个 JS 文件，静态分析。",
  "status": "partial",
  "analyzedAt": "2026-10-13T10:54:52.413567+00:00",
  "tool": {
    "name": "REA",
    "version": "6.4.0"
  },
  "findings": [
    {
      "title": "只读开关实际过滤写工具",
      "detail": "buildTools 在 readOnly 启用时过滤 isWrite 工具；MCP 列表和调用映射基于筛选后的集合，未找到的工具返回 unknown-tool 结果。该版本存在真实代码约束，不只是 readOnlyHint 提示。",
      "evidenceType": "observed",
      "evidenceIds": [
        "ev_c66e9c9640b6ecba8b4bfac914e9490a45f0fe7348e078568b9a894f547f09b0"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@okx_ai/okx-trade-mcp/-/okx-trade-mcp-1.4.8.tgz"
      ]
    },
    {
      "title": "凭据、模拟模式与用户确认属于不同层",
      "detail": "代码读取完整 API key / secret / passphrase 组合，也支持 OAuth 状态；--demo 对应模拟交易请求头。普通工具派发直接调用 handler，错误补救中的“先确认再写入”主要以服务端 instructions 和提示表达，不能视为逐笔独立审批器。",
      "evidenceType": "code_inference",
      "evidenceIds": [
        "ev_c66e9c9640b6ecba8b4bfac914e9490a45f0fe7348e078568b9a894f547f09b0"
      ],
      "sourceUrls": [
        "https://registry.npmjs.org/@okx_ai/okx-trade-mcp/-/okx-trade-mcp-1.4.8.tgz"
      ]
    }
  ],
  "limitations": [
    "范围是 @okx_ai/okx-trade-mcp@1.4.8 的 dist/index.js；没有运行安装钩子或启动 MCP。",
    "没有验证账户 API 权限、区域站点、远端额度控制或模拟与实盘实际可用性。",
    "静态代码不证明运行行为、完整风控、成交或收益；未审计服务端。",
    "没有登录、读取账户、连接钱包、签名、交易或执行目标代码。"
  ],
  "artifacts": [
    {
      "label": "@okx_ai/okx-trade-mcp@1.4.8",
      "url": "https://registry.npmjs.org/@okx_ai/okx-trade-mcp/-/okx-trade-mcp-1.4.8.tgz",
      "sha256": "82fcc061d3ccf6d185c187b145e850d12a85b595713c5151263bab98e2fa9ec4"
    },
    {
      "label": "dist--index.js",
      "url": "https://registry.npmjs.org/@okx_ai/okx-trade-mcp/-/okx-trade-mcp-1.4.8.tgz",
      "sha256": "9b3b0f6f3ae25d20628eedc9c4d6dc5fdc4a8c2d700a3f3f0db13c0ba21d695f"
    }
  ],
  "evidenceIds": [
    "ev_c66e9c9640b6ecba8b4bfac914e9490a45f0fe7348e078568b9a894f547f09b0"
  ],
  "reportUrl": "/research/rea/okx-agent-trade-kit.json",
  "coverage": {
    "parsedFiles": 1,
    "parseFailures": 0,
    "semanticCoverage": "partial",
    "rootArtifactSha256": "d98283ddd292aeca258e6e4da0f6e530a6926ac75a536417ab19b7a7066cec53",
    "inputFileCount": 1,
    "inputBytes": 521863,
    "npmIntegrityVerified": true,
    "analysisResult": "completed"
  }
}