Undocumented OpenSea MCP server reportedly minted API keys and exposed wallet usernames

A security researcher reports that OpenSea operates an undocumented MCP server whose tools let anyone mint an API key and resolve Ethereum addresses to OpenSea usernames. The claim, detailed in a bug bounty write-up on dev.to by TinyCoder Studio, has been filed with OpenSea's Bugcrowd program and is awaiting triage.

What the write-up describes

According to the post, the server sits at mcp.opensea.io/mcp and does not appear in OpenSea's public documentation. MCP, the Model Context Protocol, is an open standard that lets AI assistants and other clients discover and call external tools; a server like this advertises its capabilities to whoever can reach it.

The author says the find came from manual exploration of OpenSea's tooling, not automated scanning. One advertised tool, get_instant_api_key, drew attention first. As described, a single POST request to api.opensea.io/api/v2/auth/keys, with no sign-in or other verification, returned a working API key. With that credential, a second tool, get_profile, mapped any Ethereum address holding an OpenSea profile to the account's username. The author tested the chain on a personal wallet and a well-known address, and both resolved immediately.

The permission model mostly held

Not everything was reachable. The write-up notes that state-changing tools, the example given being cancel_orders, correctly required a wallet-signed JWT carrying the write:orders scope, and calls without it failed with a clean MISSING_SCOPE error. The author's reading is that OpenSea's authorisation design for privileged operations is sound; the gap was in the entry layer, where a handful of read-oriented tools accepted a key that anyone could self-issue.

Disclosure status and caveats

The finding went to OpenSea's Bugcrowd program with a full write-up and proof of concept, and it now sits in triage. The researcher self-assessed it as P4 informational, treating it as username enumeration, with official severity still to be assigned. The post also warns other researchers not to probe the endpoint themselves, since testing live systems without authorisation breaks program rules, and notes that a free PDF covering the recon methodology, containing no exploit code, accompanies the write-up.

One caveat worth stating plainly: this is a single-source account. OpenSea has not publicly confirmed the endpoint, the key-issuing behaviour, or any remediation, so details may change once Bugcrowd triage concludes.

Why it matters

• Wallet pseudonymity is a working assumption across the NFT ecosystem. As the author points out, a resolver that links addresses to usernames makes it easier to correlate several wallets to one person, tie a wallet to a real identity, or build target profiles for phishing and social engineering.
• For the MCP ecosystem specifically, the incident is a reminder that undocumented servers widen attack surface in ways public API reviews may never catch. The failure mode described here was not broken authorisation on sensitive tools but a permissive front door, key issuance and tool discovery, sitting in front of them.
• Severity may well land low, as the researcher's own P4 estimate suggests. But as organisations rush to expose MCP servers for AI clients, the OpenSea case argues for auditing the boring entry points, not just the write-scope endpoints behind them.