feat: add onchain-mcp MCP server package

[JAORMX]

Description

This PR adds packaging configuration for the onchain-mcp MCP server, which provides blockchain data interaction through the Bankless API.

Details

• Package: @bankless/onchain-mcp v1.0.6
• Repository: https://github.com/Bankless/onchain-mcp
• Protocol: npx (Node.js)
• Description: MCP server for blockchain data interaction through the Bankless API

Features

The onchain-mcp server provides comprehensive blockchain operations:

• Contract Operations: read_contract, get_proxy, get_abi, get_source
• Event Operations: get_events, build_event_topic
• Transaction Operations: get_transaction_history_for_user, get_transaction_info
• Token Operations: get_token_balances_on_network
• Block Operations: get_block_info

Security Configuration

security:
  allowed_issues:
    - code: "W001"
      reason: |
        The read_contract tool description contains the word "important:" as part of legitimate
        technical documentation explaining how to handle tuple types and nested structs in
        blockchain smart contracts. This is necessary technical guidance for proper usage
        of the tool, not a prompt injection attempt.
    - code: "TF001"
      reason: |
        Data leak toxic flow is expected and required for blockchain data operations. The server:
        - Reads blockchain state and contract data (get_source, get_abi, read_contract)
        - Processes transaction history and token balances (get_transaction_history_for_user, get_token_balances_on_network)
        - Returns this data to users for analysis
        This combination is essential for blockchain data analysis, allowing agents to query,
        analyze, and report on blockchain state and transactions.

Testing

✅ Validated spec.yaml configuration
✅ Generated Dockerfile successfully
✅ Security scan passes with properly documented allowlisted issues (10 tools scanned)

Container Image

Once merged, this will build and publish:

ghcr.io/stacklok/dockyard/npx/onchain-mcp:1.0.6

Checklist

• Created spec.yaml following the packaging guidelines
• Used exact version (1.0.6)
• Validated with task build
• Security scan passes with documented allowlist
• Placed in correct protocol directory (npx/)

[github-actions]

🔒 MCP Security Scan Results

✅ onchain-mcp

• Status: Passed
• Tools scanned: 10
• Result: No security issues detected

---

Summary: Scanned 1 MCP server(s), all passed security checks. ✅