aegis-defi
Aegis is a DeFi safety MCP server that protects AI agents from malicious smart contracts, honeypots, and scams before executing on-chain transactions.
scan_contract: Analyze a smart contract's source code or bytecode against 165+ known exploit patterns, honeypot mechanics, rug-pull signals, and vulnerabilities — returns a risk score (0–100) with detailed findings.simulate_transaction: Dry-run a transaction on a forked chain to detect reverts, abnormal gas usage, and other red flags before real execution.check_token: Detect honeypot mechanics (inability to sell), concentrated holdings, fake ownership renouncement, and other scam indicators before trading.assess_risk: All-in-one safety check combining contract scanning, simulation, and token checks — returns an ALLOW, WARN, or BLOCK decision with a signed attestation for swaps, approvals, transfers, and other DeFi interactions.trace_transaction: Trace every internal call of a transaction and scan each contract encountered for potential issues.search_solodit: Cross-reference detected patterns against 50K+ real audit findings from Cyfrin, Sherlock, Code4rena, and more.
Additionally, the AegisGateway contract can verify attestations and enforce safety checks on-chain, and AegisSafetyHook can block unverified swaps in Uniswap v4 pools. Aegis integrates with agent frameworks such as Claude Code, ElizaOS, and AgentKit.
Provides a safety layer for DeFi operations on Ethereum-compatible networks by scanning smart contracts for vulnerabilities, simulating transactions to detect malicious logic, and enforcing risk assessments through on-chain attestations via the AegisGateway.
Enables automated analysis of Solidity smart contract source code to identify malicious patterns such as asymmetric taxes, hidden administrative functions, and fraudulent ownership renouncements.
Aegis
Safety layer for autonomous DeFi agents. | Website | Docs
AI agents trading on-chain have no way to tell a legitimate token from a honeypot. Aegis fixes that. It's an MCP server that any agent can plug into, backed by on-chain contracts that enforce the safety checks.
Before an agent swaps, Aegis scans the target contract, simulates the transaction, and returns a simple go/no-go. If the contract has a 99% sell tax or a hidden pause function, the agent never touches it.
Why this exists
We watched an agent lose its entire wallet to a honeypot token in under 30 seconds. The token looked fine on the surface - verified contract, decent liquidity, active trading. But buried in the code was a 99% sell tax and a hidden owner behind a fake renounceOwnership().
No agent framework had a way to catch this. So we built one.
Related MCP server: pharos-guardskill
How it works
Agent -> Aegis (scan + simulate + decide) -> ChainAgent connects to Aegis via MCP (one line of config)
Before any swap/approve/transfer, agent calls
assess_riskAegis scans the contract source, simulates the tx, checks for honeypot patterns
Returns ALLOW, WARN, or BLOCK with a risk score (0-100)
On-chain: the AegisGateway contract enforces attestations before forwarding the transaction
Quick Start
# Add to Claude Code
claude mcp add aegis npx aegis-defi
# Or clone and try the demo
git clone https://github.com/StanleytheGoat/aegis
cd aegis && npm install
npx tsx demo/catch-honeypot.tsThe demo deploys a deliberately malicious token (99% sell tax, fake ownership renounce, hidden admin) and watches Aegis catch every red flag:
Aegis Risk Assessment
Risk Score: 100/100
Findings:
[CRITICAL] Fake Ownership Renounce
[CRITICAL] Asymmetric Buy/Sell Tax (99% sell)
[CRITICAL] Sell Pause Mechanism
[HIGH] Hidden Max Sell Amount
[HIGH] Hidden Admin Functions
Decision: BLOCKTools
MCP Server (TypeScript) - 6 tools available to any MCP-compatible agent:
Tool | Purpose |
| Pattern matching against 165 known exploit types |
| Dry-run on a forked chain |
| Anti-honeypot checks (sellability, concentrated holdings) |
| All-in-one risk assessment with signed attestation |
| Traces every internal call, scans each contract |
| Cross-references against 50K+ real audit findings |
Smart Contracts (Solidity) - deployed on Base mainnet:
Contract | Address | Purpose |
AegisGateway | Safety wrapper for any DeFi interaction. Verifies attestations, checks risk scores. | |
AegisSafetyHook | Uniswap v4 |
Docs
Agent Integration Guide - how to connect your agent
Project Integration Guide - how to integrate Aegis into a product
Flaunch Integration - safety checks for Flaunch memecoin trading
ElizaOS Plugin - native Aegis actions for ElizaOS agents
AgentKit Provider - Coinbase AgentKit ActionProvider for Aegis
llms.txt - machine-readable description for agentic search
Security
Built following Ethereum security best practices (informed by ethskills):
Signatures: Chain ID + contract address in all signed messages (no cross-chain replay). EIP-2 s-value malleability check. ecrecover validated against address(0).
Fee math: Multiply before divide. Explicit overflow guards. Basis points (not percentages).
Access control: OZ Ownable + ReentrancyGuard on Gateway. Immutable owner on Hook. Immutable fee recipient.
Deployment: Safe Singleton Factory CREATE2 deployer. Source verified on Basescan. Ownership transferred to Safe multisig.
Testing: 165 tests (42 contract + 123 TypeScript). Fork tests against real Base mainnet state.
Tests
npm test # TypeScript unit tests (123)
npm run test:contracts # Solidity contract tests (42)
npm run demo # Honeypot detection demoChangelog
v0.5.0 (Current)
Hook attestation support -
assess_risknow returns both gateway and hook attestations for Uniswap v4 protected poolsEVM address validation - all MCP tool inputs validate proper address format
Expanded well-known contracts - Paraswap, Balancer Vault, CoW Protocol, Permit2, Uniswap V4 PoolManager
SDK exports - attester and solodit modules now available for programmatic use
Hardened fetching - response.ok checks, 10s timeouts on all external requests
Security headers and SEO files for landing page
v0.4.0
Solodit integration -
search_solodittool queries 50K+ real audit findings from Cyfrin, Sherlock, Code4rena, Trail of Bits, and othersAuto-enrichment -
assess_riskcross-references detected patterns against real audit findings whenSOLODIT_API_KEYis setOpt-in API key model - each agent provisions their own Solodit key, no shared rate limits
v0.3.0
165 exploit patterns across 25 categories (up from 22)
Trace-level analysis -
trace_transactiontool follows every internal call and scans each contract
v0.2.0
22 exploit patterns (up from 12) - metamorphic contracts, oracle manipulation, MEV sandwich
Agent Skills - installable skill files for Claude Code
Flaunch SDK integration - safety scanning for memecoin launches on Uniswap v4 pools
License
MIT
Available Tools
4 toolsassess_riskA
Comprehensive risk assessment combining contract scanning, transaction simulation, and token checks. This is the recommended all-in-one safety check before any DeFi interaction. Returns a go/no-go recommendation.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | Type of action being assessed | |
| targetContract | Yes | The contract being interacted with | |
| chainId | No | Chain ID | |
| from | Yes | The agent's wallet address | |
| transactionData | No | Calldata for the transaction (hex) | |
| value | No | ETH value (in wei) | 0 |
| tokenAddress | No | Token address if this involves a token swap |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses the tool's comprehensive nature and returns a 'go/no-go recommendation', but lacks details on permissions, rate limits, or potential side effects. It adequately describes the core behavior but misses deeper operational context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence, uses two efficient sentences total with zero wasted words, and clearly communicates the tool's value proposition and recommendation status without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 7-parameter tool with no annotations and no output schema, the description is reasonably complete. It explains the tool's integrative nature, when to use it, and the output type ('go/no-go recommendation'), though it could elaborate more on behavioral risks or error handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no specific parameter details beyond what the schema provides, but it contextualizes the inputs as part of a 'comprehensive risk assessment' for DeFi safety checks, which slightly enhances understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('combining contract scanning, transaction simulation, and token checks') and resources ('DeFi interaction'), and distinguishes it from sibling tools by positioning it as the 'recommended all-in-one safety check' that integrates their functions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool ('before any DeFi interaction') and implies alternatives by naming sibling tools (check_token, scan_contract, simulate_transaction) as components it combines, making it the comprehensive choice over piecemeal approaches.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_tokenA
Check if a token is safe to trade. Detects honeypot mechanics (can't sell), concentrated holdings, fake ownership renouncement, and other scam indicators. Use this before swapping into any unfamiliar token.
| Name | Required | Description | Default |
|---|---|---|---|
| tokenAddress | Yes | The token contract address to check | |
| chainId | No | Chain ID (1=Ethereum, 8453=Base) | |
| holderAddress | No | Optional: address to check balance for |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It describes what the tool does (detects scam indicators) and its intended use case, but lacks details on behavioral traits such as rate limits, authentication needs, response format, or error handling. The description is informative but incomplete for operational transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence and follows with specific use guidance. Both sentences are essential, with no wasted words, making it highly efficient and well-structured for quick understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (assessing token safety with scam detection) and lack of annotations and output schema, the description is moderately complete. It covers the purpose and usage well but lacks details on behavioral aspects and output, which are critical for an AI agent to invoke it correctly. It meets minimum viability but has clear gaps in operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters (tokenAddress, chainId, holderAddress) with descriptions. The description does not add any parameter-specific semantics beyond what the schema provides, such as explaining the significance of holderAddress in scam detection. Baseline score of 3 is appropriate as the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('check', 'detects') and resources ('token'), identifying scam indicators like honeypot mechanics, concentrated holdings, and fake ownership renouncement. It distinguishes from siblings by focusing on token safety assessment rather than general risk assessment, contract scanning, or transaction simulation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use this tool: 'before swapping into any unfamiliar token.' This provides clear context for usage and implies alternatives (e.g., not using it for familiar tokens or after swapping). While it doesn't name specific sibling tools, the guidance is direct and actionable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_contractA
Analyze a smart contract's source code or bytecode for known exploit patterns, honeypot mechanics, rug-pull signals, and security vulnerabilities. Returns a risk score (0-100) and detailed findings. Use this BEFORE interacting with any unfamiliar contract.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Solidity source code of the contract to analyze | |
| bytecode | No | Contract bytecode (hex) to analyze if source is unavailable | |
| contractAddress | No | Contract address - if provided, will attempt to fetch source from block explorer | |
| chainId | No | Chain ID (1=Ethereum, 8453=Base, 84532=Base Sepolia) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does well by disclosing key behaviors: it analyzes for specific exploit patterns, returns a risk score and findings, and has a precautionary use case. However, it lacks details on rate limits, authentication needs, or error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, followed by usage guidance, all in two efficient sentences with zero wasted words, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (security analysis with 4 parameters) and no output schema, the description is mostly complete, covering purpose, usage, and output types. However, it could benefit from more details on behavioral aspects like performance or limitations to fully compensate for the lack of annotations and output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters well. The description adds no additional parameter semantics beyond implying analysis can be done on source, bytecode, or via address, which is already covered in the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('analyze', 'returns') and resources ('smart contract's source code or bytecode'), distinguishing it from siblings like 'assess_risk' or 'check_token' by focusing on contract analysis for security patterns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use this tool ('BEFORE interacting with any unfamiliar contract'), providing clear context and distinguishing it from alternatives like 'simulate_transaction' by focusing on pre-interaction analysis rather than simulation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_transactionA
Simulate a transaction on a forked chain WITHOUT actually executing it. Detects reverts, abnormal gas usage, and other red flags. Use this to preview what will happen before sending a real transaction.
| Name | Required | Description | Default |
|---|---|---|---|
| chainId | No | Chain ID to simulate on | |
| from | Yes | Sender address | |
| to | Yes | Target contract address | |
| data | Yes | Transaction calldata (hex) | |
| value | No | ETH value to send (in wei) | 0 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it's a simulation (non-destructive), detects specific issues (reverts, abnormal gas usage, red flags), and operates on a forked chain. It doesn't mention rate limits, authentication needs, or detailed output format, but covers essential safety and scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero waste: first defines the tool's purpose and key features, second provides usage guidance. Every phrase adds value, and it's front-loaded with the core functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description does well by explaining the tool's behavior, safety profile (non-execution), and use case. It could improve by hinting at return values (e.g., simulation results), but for a 5-parameter tool with good schema coverage, it's largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds no additional parameter semantics beyond implying the simulation context, which aligns with the schema. Baseline 3 is appropriate as the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('simulate a transaction'), the resource ('on a forked chain'), and the key distinction from actual execution ('WITHOUT actually executing it'). It differentiates from siblings like 'assess_risk' or 'scan_contract' by focusing on transaction simulation rather than general risk assessment or contract scanning.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool: 'to preview what will happen before sending a real transaction.' This provides clear context for usage versus alternatives, indicating it's for pre-execution testing rather than live operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose: assess_risk is a comprehensive all-in-one safety check, check_token focuses on token-specific scams, scan_contract analyzes contract code/bytecode, and simulate_transaction previews transaction outcomes. There is no overlap or ambiguity between these tools.
All tool names follow a consistent verb_noun pattern (assess_risk, check_token, scan_contract, simulate_transaction), using snake_case throughout. The naming is predictable and readable across the entire set.
With 4 tools, this server is well-scoped for DeFi security. Each tool earns its place by covering distinct aspects of safety assessment: holistic risk, token checks, contract analysis, and transaction simulation. This count is appropriate and avoids bloat.
The tool set provides complete coverage for DeFi security workflows: it includes comprehensive risk assessment (assess_risk), targeted checks for tokens and contracts, and transaction simulation. There are no obvious gaps—agents can perform end-to-end safety evaluations before any DeFi interaction.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
DeFi safety layer for AI agents: wallet safety, token risk, tx decode/simulate. 20 tools.
Solana pre-trade safety for agents: rug check, honeypot sell-sim, drainer scan, tx preflight.
Solana token safety for AI agents — rug-pull, honeypot & Token-2022 trap detection before you buy.
Pay-per-call safety checks for AI agents: screen a crypto address or URL before you transact.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenancePre-execution safety layer for autonomous agent wallets. Risk scoring, transaction simulation, and policy enforcement via MCP.MIT
- FlicenseNot gradedqualityCmaintenancePre-transaction security gate for Pharos AI agents that analyzes contract bytecode and on-chain state to assess risks like upgradeability and honeypot controls.
- AlicenseBqualityDmaintenanceReal-time smart contract security for autonomous AI agents, offering tools for contract verification, wallet monitoring, drain detection, threat reporting, and leaderboards.1921MIT
- AlicenseNot gradedqualityCmaintenanceSecurity layer for AI agents that evaluates transaction intents and returns verdicts (ALLOW/WARN/DENY) using deterministic rules, on-chain checks, and simulation.11MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/StanleytheGoat/aegis'
If you have feedback or need assistance with the MCP directory API, please join our Discord server