Skip to main content
Glama

scan_contract

Security scan of a verified EVM smart contract: who controls it now (owner / proxy admin: renounced, single-key EOA or Safe multisig), every owner/role-gated function (mint, pause, blacklist, upgrade, fees), proxy status, and Slither static-analysis findings ranked by impact. Use before approving, depositing into or buying a token. Chains: 1 Ethereum, 8453 Base, 42161 Arbitrum, 10 Optimism, 137 Polygon, 56 BNB.

Input Schema

NameRequiredDescriptionDefault
addressYes0x contract address (must be verified on Sourcify)
chainIdYesEVM chain id, e.g. 8453 for Base

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does well: it discloses the prerequisite scope (contract must be verified), the exact categories of findings returned, that findings are ranked by impact, and that ownership control is classified (renounced / EOA / Safe multisig). It omits failure behaviour for unverified contracts and any cost, latency or rate-limit context, so it is strong but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and returned artefacts are front-loaded in the first sentence, the usage trigger follows, and the compact chain list closes it out. Dense but every clause earns its place; nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description compensates well by describing the return contents and ranking. What remains missing is the behaviour when a contract is unverified or the scan fails, and whether results are paginated or time-bounded, which matters for a scan tool an agent may call speculatively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, and the description adds genuine value by enumerating the supported chain IDs (1, 8453, 42161, 10, 137, 56), which materially constrains and validates the otherwise open-ended chainId parameter. The Sourcify verification requirement reinforces the address parameter's constraint.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (security scan) plus precise resource (verified EVM smart contract) with an explicit enumeration of what is returned: ownership control, owner/role-gated functions, proxy status, and Slither findings. It is clearly distinguishable from siblings like address_info and check_token by scoping itself to contract-security analysis.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a concrete decision trigger: 'Use before approving, depositing into or buying a token.' That tells the agent the moment of use, but it names no alternatives or exclusions (e.g. what to use for an unverified contract), so it stops short of full when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources