Skip to main content
Glama
Carlys17

MCP Contract Auditor

by Carlys17

Server Quality Checklist

58%
Profile completionA complete profile improves this server's visibility in search results.
  • Latest release: v1.0.0

  • Disambiguation4/5

    Tools are largely distinct with clear purposes. However, `audit_contract` is a composite that includes functionality of `scan_vulns` and `check_holders`, which could cause some confusion, but descriptions clarify the difference.

    Naming Consistency5/5

    All tools follow a consistent verb_noun pattern using snake_case (e.g., audit_contract, list_chains), making it easy for an agent to predict tool names.

    Tool Count5/5

    Five tools is well-scoped for a contract auditor server, covering the essential operations without being overwhelming or insufficient.

    Completeness4/5

    The tool set covers fetching, scanning, holder analysis, and full auditing with chain listing. Missing features like audit history or detailed chain info are minor gaps.

  • Average 3.5/5 across 5 of 5 tools scored. Lowest: 2.9/5.

    See the Tool Scores section below for per-tool breakdowns.

    • No community issues in the last 6 months
    • 2 commits in the last 12 weeks
    • No stable releases found
    • No critical vulnerability alerts
    • No high-severity vulnerability alerts
    • No code scanning findings
    • CI status not available
  • Add a LICENSE file by following GitHub's guide. Once GitHub recognizes the license, the system will automatically detect it within a few hours.

    If the license does not appear after some time, you can manually trigger a new scan using the MCP server admin interface.

    MCP servers without a LICENSE cannot be installed.

  • This repository includes a README.md file.

  • No tool usage detected in the last 30 days. Usage tracking helps demonstrate server value.

    Tip: use the "Try in Browser" feature on the server page to seed initial usage.

  • Add a glama.json file to provide metadata about your server.

  • If you are the author, simply .

    If the server belongs to an organization, first add glama.json to the root of your repository:

    {
      "$schema": "https://glama.ai/mcp/schemas/server.json",
      "maintainers": [
        "your-github-username"
      ]
    }

    Then . Browse examples.

  • Add related servers to improve discoverability.

How to sync the server with GitHub?

Servers are automatically synced at least once per day, but you can also sync manually at any time to instantly update the server profile.

To manually sync the server, click the "Sync Server" button in the MCP server admin interface.

How is the quality score calculated?

The overall quality score combines two components: Tool Definition Quality (70%) and Server Coherence (30%).

Tool Definition Quality measures how well each tool describes itself to AI agents. Every tool is scored 1–5 across six dimensions: Purpose Clarity (25%), Usage Guidelines (20%), Behavioral Transparency (20%), Parameter Semantics (15%), Conciseness & Structure (10%), and Contextual Completeness (10%). The server-level definition quality score is calculated as 60% mean TDQS + 40% minimum TDQS, so a single poorly described tool pulls the score down.

Server Coherence evaluates how well the tools work together as a set, scoring four dimensions equally: Disambiguation (can agents tell tools apart?), Naming Consistency, Tool Count Appropriateness, and Completeness (are there gaps in the tool surface?).

Tiers are derived from the overall score: A (≥3.5), B (≥3.0), C (≥2.0), D (≥1.0), F (<1.0). B and above is considered passing.

Tool Scores

  • Behavior2/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    With no annotations, the description carries full burden. It only states basic scanning capability without disclosing accuracy, output format, or whether it modifies state. Minimal behavioral context is provided.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness4/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single well-formed sentence, front-loaded with the main action. It is concise, though could benefit from additional details without becoming verbose.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness2/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    The tool scans for vulnerabilities but the description does not explain return values, output structure, or limitations. Without an output schema, more context is needed for completeness.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema coverage is 100%, so baseline is 3. The description adds a list of vulnerability types but does not enhance parameter understanding beyond what the schema provides.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose4/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description uses the verb 'Scan' and specifies the resource 'Solidity source code', listing example vulnerabilities (reentrancy, overflow, access control). It is clear but does not explicitly distinguish from sibling 'audit_contract', which may perform broader analysis.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description provides no guidance on when to use this tool versus alternatives (e.g., audit_contract). It lacks exclusions or context about prerequisites or limitations.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior2/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    With no annotations, the description carries the full burden of behavioral disclosure. It only states 'analyze', which implies read-only, but does not confirm whether it is a safe read operation, whether it makes external calls, or any potential side effects. No mention of data freshness, auth needs, or rate limits.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single, efficient sentence that conveys the core purpose without any extraneous words. It is front-loaded and earns its place.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness2/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given the complexity of analyzing token holder distribution for risk, the description lacks details about what constitutes a risk signal, how the analysis is performed, or the output format. With no output schema, the agent is left guessing about return values.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema coverage is 100%, and the schema already provides clear descriptions for both parameters ('Token contract address (0x...)' and 'Chain name: "ethereum", "base", "bsc", etc.'). The tool description adds no further meaning beyond the schema, so baseline score of 3 applies.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description uses a specific verb 'Analyze' and clearly identifies the resource 'token holder distribution' with the explicit purpose of assessing 'centralization and rug-pull risk'. This distinguishes it from sibling tools like 'audit_contract' (security audit) and 'scan_vulns' (vulnerability scanning).

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines2/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    No guidance is provided on when to use this tool versus alternatives, nor are prerequisites or exclusions mentioned. The description merely states the tool's function without contextualizing its use relative to siblings.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior2/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations provided; the description only says 'fetch', implying a read operation. It lacks disclosure of potential rate limits, authentication needs, or whether the data is always up-to-date. Minimal behavioral context.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    A single sentence that efficiently communicates the core purpose. No filler or redundant information.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    The description states the output (source code and ABI) but does not specify the format (e.g., JSON) or potential error conditions. For a simple fetch tool, it is mostly adequate but could include a hint about the response structure.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Both parameters have clear descriptions in the input schema (address and chain). The description does not add any extra meaning beyond what the schema already provides, such as format or examples.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states the verb 'fetch', the resource 'verified smart contract source code and ABI', and the data source 'Blockscout', distinguishing it from sibling tools like audit_contract.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines3/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description implies usage for retrieving smart contract code and ABI, but does not explicitly state when to use this tool versus alternatives (e.g., for audits use audit_contract). No when-not-to-use advice.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations are provided, so the description carries the full burden. It lists the steps but does not disclose behavioral traits like time requirements, destructive actions, authentication needs, or rate limits. For a 'full audit', more transparency is needed.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness4/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single concise sentence with emoji, efficiently conveying the tool's purpose. It is front-loaded and brief, though it could benefit from structured bullet points for clarity.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness3/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Without an output schema or annotations, the description should detail what the report contains. It only mentions 'generate report' without specifying format or how results are presented, leaving gaps for a complex multi-step tool.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters3/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    Schema coverage is 100% with clear descriptions (address, chain list, include_holder_analysis default). The description adds context but not new parameter-level info beyond schema. Baseline 3 is appropriate.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states it's a full smart contract audit combining multiple sub-tasks (fetch source, scan vulnerabilities, analyze holders, generate report). It distinguishes from siblings like check_holders, fetch_contract, scan_vulns by being the one-stop solution.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines4/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description implies use for a comprehensive audit, with sibling tools for individual steps. However, it doesn't explicitly state when to use alternatives or provide exclusions, leaving some inference to the agent.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

  • Behavior3/5

    Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

    No annotations are provided. The description discloses that the tool lists chains, which is a safe read operation, but does not mention any potential behaviors like authentication needs or limitations. Given the simplicity, it is adequate but minimal.

    Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

    Conciseness5/5

    Is the description appropriately sized, front-loaded, and free of redundancy?

    The description is a single, clear 7-word sentence with no superfluous information. It is optimally concise and front-loaded.

    Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

    Completeness4/5

    Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

    Given the tool's simplicity (no parameters, no output schema), the description sufficiently explains its purpose. It could hint that listing chains is a prerequisite for other chain-specific tools, but this is not essential.

    Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

    Parameters4/5

    Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

    There are zero parameters, and schema coverage is 100%. The description does not need to add parameter details, meeting the baseline for no-parameter tools.

    Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

    Purpose5/5

    Does the description clearly state what the tool does and how it differs from similar tools?

    The description clearly states the verb 'list', the resource 'all supported EVM chains', and the context 'for contract auditing'. It effectively distinguishes from sibling tools like audit_contract or scan_vulns, which operate on specific chains.

    Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

    Usage Guidelines3/5

    Does the description explain when to use this tool, when not to, or what alternatives exist?

    The description does not provide explicit when-to-use or when-not-to-use guidance, nor does it mention alternatives. Usage is implied but not clarified.

    Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

GitHub Badge

Glama performs regular codebase and documentation scans to:

  • Confirm that the MCP server is working as expected.
  • Confirm that there are no obvious security issues.
  • Evaluate tool definition quality.

Our badge communicates server capabilities, safety, and installation instructions.

Card Badge

mcp-contract-auditor MCP server

Copy to your README.md:

Score Badge

mcp-contract-auditor MCP server

Copy to your README.md:

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Carlys17/mcp-contract-auditor'

If you have feedback or need assistance with the MCP directory API, please join our Discord server