Provides auditing of smart contracts on the Ethereum blockchain, analyzing verified source code and on-chain state for risks like upgradeable proxies, owner powers, and honeypot patterns.
Provides auditing of smart contracts on the Optimism blockchain, leveraging Sourcify for verified source code and live RPC checks for owner status and dangerous operations.
Provides auditing of smart contracts on the Polygon blockchain, including source verification via Sourcify and heuristic scanning for centralization and rug-pull risks.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@contract-auditor Audit contract 0xdAC17F958D2ee523a2206206994597C13D831ec7 on Ethereum"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Quick-scan a smart contract for rug / honeypot / centralization risk before you approve or send funds.
contract-auditor is an MCP server and a pay-per-call x402 HTTP API. Give it a deployed contract address + chain (or raw Solidity source) and it returns a SAFE / CAUTION / HIGH-RISK verdict with an explained risk score.
It combines three things an AI agent can't gather on its own from a chat:
Verified source from Sourcify (key-less, multi-chain) — or the absence of it (a strong red flag).
Live on-chain state via public RPC — is there code at all? Is it an upgradeable proxy (owner can swap the code)? Who is the owner, and is it a single EOA, a multisig, or renounced?
Heuristic Solidity scan for the real ways a contract takes or freezes your funds.
⚠️ Heuristic quick-scan, not a formal audit. Absence of findings is not proof of safety. Always do your own research before sending funds.
🔁 Upgradeable proxy | EIP-1967 / 1167 / beacon — the owner can replace the audited code |
👑 Owner powers | mint, pause, blacklist, owner-adjustable fees/tax, max-tx limits, trading on/off, withdraw/sweep |
💀 Dangerous primitives |
|
🍯 Honeypot signals | can't-sell patterns: blacklist + uncapped tax + trading switch + wallet/tx caps |
🔓 Owner status | live on-chain: renounced, single EOA (one key), or multisig/timelock? |
❓ Unverified | no verified source on Sourcify = you can't read what you're trusting |
Related MCP server: base-security-scanner-mcp
{
"mcpServers": {
"contract-auditor": { "command": "npx", "args": ["-y", "contract-auditor-mcp"] }
}
}Tool: audit_contract — params: address, chain (alias or chainId), source (optional raw Solidity), deep (boolean).
Or connect over HTTP at POST /mcp.
GET https://contract-auditor-ivory.vercel.app/audit?address=0xdAC17F958D2ee523a2206206994597C13D831ec7&chain=ethereum
GET https://contract-auditor-ivory.vercel.app/audit?address=0x...&chain=baseSupported chains: ethereum, base, optimism, arbitrum, polygon, bsc, avalanche, gnosis, celo (or a numeric chainId). Free tier is rate-limited to 30 requests/hour/IP.
The /pro/audit route is gated by x402. Your agent pays $0.25 USDC per call automatically — no sign-up, no API key — settling on-chain (USDC on Base) to the operator wallet.
GET /pro/audit?address=0x...&chain=ethereum # 402 → pay → resultSource is fetched from Sourcify by (chainId, address). If a contract is only verified on a native explorer and not mirrored to Sourcify, it shows as unverified here — pass the source directly to scan it.
On-chain checks use public RPCs (best-effort, community endpoints). If a chain's RPC is briefly down the audit degrades to a source-only verdict.
The Solidity scan is static pattern/heuristic analysis with comment-stripping and owner-gating context. It is tuned for low false-alarm on well-known patterns, but it is not symbolic execution or a formal verifier.
MIT
Run a security QUICK-SCAN on a smart contract BEFORE you interact with it or send funds. Give it a deployed contract address + chain (or raw Solidity source) and it returns a SAFE / CAUTION / HIGH-RISK verdict with an explained risk score. It fetches the VERIFIED source from Sourcify (key-less), reads LIVE on-chain state via public RPC (is there code? is it an upgradeable proxy? who is the owner and is it a single EOA or renounced?), and statically scans the Solidity for owner-controlled mint/pause/blacklist/fee, selfdestruct, delegatecall, tx.origin auth, reentrancy shape and honeypot patterns (can't sell, owner-adjustable taxes). Use whenever you're about to approve, buy, fund, or integrate a contract you don't fully trust. Heuristic, not a formal audit.
Inputs: address, chain, source, deep.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 1 tool
With only one tool, there is no possibility of confusion between tools. The tool's purpose is clearly described.
Single tool has a clear verb_noun name ('audit_contract'), which is consistent with itself and follows a predictable pattern.
One tool is borderline but acceptable given the narrow focus of the server. The tool is comprehensive and not trivial.
The server fully covers its stated purpose of performing a quick security scan. No obvious gaps for the intended use case.
Instant rug-check for any EVM or Solana token, distilled to one clear 0-10 risk verdict.
Send a token/contract address (Base, Ethereum, BSC), get a deterministic verdict (LOW_RISK / CAUTION
Honeypot detection & token risk scan for ERC-20s. Risk score 0-100, tax, source verification.
Solana token/wallet rug-risk scoring. Free scan; $2 SOL unlocks full wallet report. No signup.