Skip to main content
Glama
holistis

bug-bounty-intelligence-mcp

scan_contract

Submit a public GitHub repo for automated smart contract security analysis. Uses a 7-gate framework to filter false positives and pinpoint real vulnerabilities.

Instructions

Submit a public GitHub repository for an automated smart contract security analysis. Runs the Al-Mizaan v3 7-gate framework (code, reachability, threat-model, invariant, protocol-intent, impact, formal proof) to filter out false positives before reporting anything — on a real benchmark run (3FLabs/grunt, 218 contracts) plain Slither reported 27 "High" findings with a 100% false-positive rate; see BENCHMARK.md for the full comparison. Pattern awareness is drawn from a corpus of 27,681 submitted Sherlock/Code4rena findings; the acceptance-rate numbers used elsewhere in this server (list_vulnerability_patterns) are limited to the 1,032 findings that could be exact-reconciled against contest outcomes — see METHODOLOGY.md. Cost: $5 USDC on Base (eip155:8453) via x402. Delivery is guaranteed within 24h — the sample run documented in README.md took about 25 minutes. Returns a job_id. Use get_scan_report to poll for results. If payment_required is true, pay $5 USDC to the payTo address on Base, then retry scan_contract with the same repo_url.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repo_urlYesPublic GitHub repo URL containing Solidity contracts (e.g. https://github.com/org/repo)
protocol_typeNoProtocol category for targeted analysis (optional, default GENERAL)

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv1.0.4

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden — and it delivers comprehensively: disclosed cost ($5 USDC on Base via x402), guaranteed 24h delivery with a ~25min sample, async job semantics (returns job_id), the payment retry flow, and the false-positive filtering behavior of the framework. Nothing about side effects or requirements is hidden. No contradiction with annotations (none exist).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The actionable purpose is front-loaded, but the description carries meaningful extraneous weight — the Slither 100%-FP benchmark stat and the 27,681/1,032 corpus reconciliation figures are trust-building context rather than invocation-critical information. It's dense and well-organized, but not every sentence earns its place for the core task of calling the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a payment-gated, asynchronous tool with no output schema and no annotations, the description covers every invocation concern: cost and payment rail, expected delivery time, return value (job_id), the polling sibling, and the retry-after-payment branch. The get_scan_report sibling fills the result-format gap. Nothing an agent needs to invoke correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters (repo_url with an example, protocol_type with its enum and default). The description adds a repo URL example and global workflow context but no per-parameter semantics beyond what the schema gives, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Submit a public GitHub repository for an automated smart contract security analysis.' It names the 7-gate framework and references both siblings (get_scan_report for polling, list_vulnerability_patterns for pattern data), so an agent can distinguish this from alternatives without reopening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs 'Use get_scan_report to poll for results' and lays out the end-to-end workflow including the payment-and-retry path when payment_required is true. It references list_vulnerability_patterns to disambiguate acceptance-rate numbers. It falls short only by not explicitly stating conditions under which this tool should NOT be used.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.