Skip to main content
Glama

pactlint: scan a deployed contract by address

scan_contract_address

pactlint: static security scan of a deployed contract on Ethereum or Base, by address. Input: address (0x + 40 hex) and chain (ethereum | base); optional include_* flags. Fetches the verified source from Sourcify, then runs the same analysis as scan_contract_source: solc + Slither + custom detectors for recurring DeFi bug classes (unchecked ERC-20 returns, zero slippage limits, stale or spot-price oracles, ERC-4626 share inflation, signature replay and more), triaged and de-duplicated. Returns the JSON report plus a Markdown rendering. Contracts without verified source are refused (not_verified) and not charged; for those, use check_contract_before_interaction (txpeek). Price: USD 0.25 up to 3,000 normalised source lines (nSLOC), USD 0.75 up to 15,000; larger inputs are refused. Refused inputs are never charged. Free: 3 scans or 30 txpeek checks per IP per UTC day (one shared pool). Typically 3-30 s depending on the contract's size; at most 60 s per scan (past it: status timeout), one scan at a time; a request waits at most 25 s in a queue of 3 (less when paid, so every answer arrives within about 90 s), otherwise 503 with Retry-After, not charged. Automated and heuristic, not an audit: findings can be false positives and an empty report does not prove the code is free of bugs.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
chainYesChain the contract is deployed on.
addressYesContract address (0x + 40 hex).
include_noisyNo
include_dependenciesNo
include_informationalNo

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so: it discloses refusal semantics (not_verified, refused inputs never charged), exact pricing tiers and the 15,000 nSLOC ceiling, free-tier quotas, latency bounds (3-30 s typical, 60 s cap), concurrency and queue behavior with 503/Retry-After, and the crucial caveat that findings are heuristic and an empty report is not proof of safety. This is unusually rich disclosure for a mutation-free scan tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Dense but front-loaded: the operation, inputs, and the not_verified routing rule come first, followed by price, quota, and timing details. Nearly every clause carries operational weight, though the pricing/latency block could be tightened without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description still names the return shape ('JSON report plus a Markdown rendering'). Combined with refusal handling, pricing, quotas, timing, and the audit-vs-heuristic caveat, an agent has everything needed to call this correctly and set expectations for the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 40%, and the three undocumented parameters are exactly the opaque ones: include_noisy, include_dependencies, include_informational. The description only refers to them collectively as 'optional include_* flags' without saying what each controls or why an agent would enable it. It does restate address and chain formats, but those are already in the schema, so the coverage gap is not compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('static security scan of a deployed contract on Ethereum or Base, by address') and explicitly positions itself relative to siblings: same analysis as scan_contract_source, and check_contract_before_interaction for unverified contracts. An agent can distinguish it from all three siblings without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit routing rule for the failure case ('Contracts without verified source are refused (not_verified) ... for those, use check_contract_before_interaction'), and the reference to scan_contract_source implies when this address-based variant is appropriate. It stops short of stating the inverse condition (use scan_contract_source when you already have source), so it is clear context rather than fully enumerated alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources