{
  "id": 7020816,
  "title": "I Found an Undocumented MCP Server on OpenSea — and It Leaked Usernames for Any Wallet",
  "url": "https://urgent.news/2026/09/12/i-found-an-undocumented-mcp-server-on-opensea-and-it-leaked-usernames",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T23:52:09.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/tinycoder-studio/i-found-an-undocumented-mcp-server-on-opensea-and-it-leaked-usernames-for-any-wallet-5935"
  },
  "original_language": "en",
  "account": "A hidden server on OpenSea's website inadvertently exposed API keys, potentially allowing anyone to access usernames associated with any Ethereum wallet address. The discovery, documented by a security researcher, highlights the importance of securing undocumented internal APIs. Although OpenSea's internal tools properly required authentication for sensitive functions, the accidental exposure of API keys posed a significant privacy and security risk. The researcher reported the vulnerability to OpenSea's Bugcrowd program, where it is currently being assessed. To help others understand the risks and how to mitigate them, the researcher has created a free PDF guide called the OpenSea MCP Server Recon Kit.",
  "summary": "TL;DR: OpenSea runs an undocumented MCP server at mcp.opensea.io/mcp . One of its tools hands out API keys to anyone who asks, and another lets you resolve any Ethereum address with an OpenSea profile to its owner's username. Reported to Bugcrowd, now sharing the story and a free recon kit. The Setup I was poking around OpenSea's tooling one afternoon — just trying to understand how some of their…",
  "key_points": [
    "Undocumented MCP server on OpenSea exposed API keys",
    "Potential to access usernames for any Ethereum wallet",
    "Vulnerability reported to OpenSea's Bugcrowd program"
  ],
  "editors_take": "The exposure of API keys from an undocumented server on OpenSea's website creates a significant privacy and security risk by potentially allowing anyone to access usernames associated with any Ethereum wallet address.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}