Contract Security Scanner

authSTDIOregistry active

Summary

Exposes three tools for scanning Base L2 smart contracts through BaseScan's API: scan_contract for full security analysis, batch_scan to compare up to five contracts, and interpret_risk for actionable recommendations. Returns a 0-100 risk score by detecting mint functions, blacklist selectors, pause mechanisms, backdoors, proxy patterns, and checking source verification and contract age. Useful when evaluating tokens before swaps, auditing DeFi protocols, or vetting contracts in Claude without switching to Etherscan. Works read-only over RPC with no wallet required. Supports stdio transport across Claude Desktop, Cursor, and Cline with optional BASESCAN_API_KEY for deeper source code analysis.

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

inference shell

create and run specialised agents in minutes

build now →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

inference shell

create and run specialised agents in minutes

build now →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

Contract Security Scanner — MCP Server

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

scan_contract — Full security scan (source verification, risky selectors, age, activity)
batch_scan — Compare up to 5 contracts side by side
interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Cline (VS Code extension)

Open Cline settings → MCP Servers → Add server
Set type: stdio
Command: node /Users/sam/Desktop/samDev/p8/mcp/server.js

Any MCP client (generic)

The server uses stdio transport — just pipe JSON-RPC messages:

node /Users/sam/Desktop/samDev/p8/mcp/server.js

Usage examples

Once connected, just ask your AI assistant naturally:

"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."

"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What gets analyzed

Check	Source
Source code verified?	BaseScan API
Mint / burn functions	Bytecode selector scan
Pause / freeze	Bytecode selector scan
Blacklist / whitelist	Bytecode selector scan
Backdoors (rescueTokens, withdrawAll)	Bytecode selector scan
Upgradeable proxy	BaseScan + delegatecall detection
Contract age	BaseScan transaction history
Activity level	BaseScan recent txs

Risk scoring

Score	Label	Meaning
0-9	SAFE	No red flags
10-29	LOW	Minor concerns
30-49	MEDIUM	Elevated risk — review before interacting
50-69	HIGH	Significant risk — small amounts only
70+	CRITICAL	Avoid — potential rug or backdoor

Technical notes

Chain: Base L2 only (https://mainnet.base.org)
API: BaseScan free tier (no key needed for basic checks; set BASESCAN_API_KEY env var for full source analysis)
No wallet needed: read-only RPC calls only
Latency: ~2-5s per contract (network dependent)

Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e

Featured

CodeRabbit

AI writes the code. CodeRabbit catches the slop.

Try For Free →

inference shell

create and run specialised agents in minutes

build now →

MCP-ready Email Sending

Plug Mailtrap into your AI workflow and let it handle the email.

Connect Mailtrap MCP →

Make your agent a DeFi expert

Agent, run crypto. Access onchain data & trade routes via 1inch.

Install now →

Capacitor - Shared memory for your team’s coding agents.

Make coding agent sessions - Searchable, Shareable, Vendor-neutral & Scored.

Try For Free →

CodeScene MCP Server

Your agent targets a perfect 10 Code Health score. Deterministic. Every commit.

Try For Free →

Give your AI the whole web as clean markdown

Integrate web data into your AI product. One API to scrape website & brand data.

Get API Key Now →

belt - the only tool your agent needs

belt cli automatically finds the best tools and skills for your agent. image, video, music, tts...

one prompt install →

Configuration

BASESCAN_API_KEYsecret

BaseScan API key for source code analysis (optional — basic bytecode scan works without it)

Contract Security Scanner — MCP Server

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

scan_contract — Full security scan (source verification, risky selectors, age, activity)
batch_scan — Compare up to 5 contracts side by side
interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Cline (VS Code extension)

Open Cline settings → MCP Servers → Add server
Set type: stdio
Command: node /Users/sam/Desktop/samDev/p8/mcp/server.js

Any MCP client (generic)

The server uses stdio transport — just pipe JSON-RPC messages:

node /Users/sam/Desktop/samDev/p8/mcp/server.js

Usage examples

Once connected, just ask your AI assistant naturally:

"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."

"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What gets analyzed

Check	Source
Source code verified?	BaseScan API
Mint / burn functions	Bytecode selector scan
Pause / freeze	Bytecode selector scan
Blacklist / whitelist	Bytecode selector scan
Backdoors (rescueTokens, withdrawAll)	Bytecode selector scan
Upgradeable proxy	BaseScan + delegatecall detection
Contract age	BaseScan transaction history
Activity level	BaseScan recent txs

Risk scoring

Score	Label	Meaning
0-9	SAFE	No red flags
10-29	LOW	Minor concerns
30-49	MEDIUM	Elevated risk — review before interacting
50-69	HIGH	Significant risk — small amounts only
70+	CRITICAL	Avoid — potential rug or backdoor

Technical notes

Chain: Base L2 only (https://mainnet.base.org)
API: BaseScan free tier (no key needed for basic checks; set BASESCAN_API_KEY env var for full source analysis)
No wallet needed: read-only RPC calls only
Latency: ~2-5s per contract (network dependent)

Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e

Contract Security Scanner

Contract Security Scanner — MCP Server

Installation

Claude Desktop

Cursor

Cline (VS Code extension)

Any MCP client (generic)

Usage examples

What gets analyzed

Risk scoring

Technical notes

Configuration

Contract Security Scanner

Contract Security Scanner — MCP Server

Installation

Claude Desktop

Cursor

Cline (VS Code extension)

Any MCP client (generic)

Usage examples

What gets analyzed

Risk scoring

Technical notes

Configuration

Related Security & Pentesting MCP Servers

Related Security & Pentesting MCP Servers