Skip to main content
Glama
Sign In
DeFi Guard MCP

DeFi Guard MCP

by iinniitt
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Remote

DeFi Guard MCP

npm License: MIT

The safety layer that checks a DeFi transaction or token before your agent (or you) signs — on Base L2. Sits in front of execution MCPs (it pairs with them, it doesn't compete): honeypot detection, owner-power scans, approval-drain checks, position health, and executable prices — all from live on-chain state.

No API keys required — works out of the box against public Base RPCs (bring your own RPC for speed via BASE_RPC_URL). Read-only: it never holds keys, signs, or submits.

Guard-before-signing tools

Tool

What it answers

token_safety_screen

"Is this token safe to buy/approve before I sign?" — honeypot detection (can you actually sell it back?), real round-trip cost (fees + tax both ways), and whether ownership is renounced (a live owner can often change taxes / pause / mint). One risk verdict.

scan_dangerous_capabilities

"What can the owner do to me?" — scans the deployed bytecode for owner-only powers: mint, pause, blacklist, adjustable fees/taxes, max-tx limits, trading toggles, proxy upgradeTo. Flags the capability, no explorer key needed.

approval_risk

"Is this approval dangerous?" — reads the live allowance an owner granted a spender, flags unlimited approvals (the allowance-drain vector) and whether the spender is a contract or an EOA. Current exposure = what could be pulled right now.

Related MCP server: Crest Counterparty Intelligence

Data tools

Tool

What it answers

aave_position_health

"Is this Aave V3 position safe?" — live health factor, collateral/debt in USD, LTV, liquidation threshold, and a plain risk level (healthy / elevated / critical / LIQUIDATABLE).

quote_swap

"What would this swap actually return right now?" — exact-input quote via Uniswap V3 QuoterV2, best of all 4 fee tiers, with gas estimate. Executable price, not an oracle.

token_risk_snapshot

"Can I get out of this token?" — ERC-20 metadata + real market depth measured by round-trip quotes (WETH → token → WETH) at two sizes. High round-trip loss = thin or trapped liquidity, whatever the chart says.

Why round-trip depth instead of "liquidity" numbers

TVL and pool-size numbers are easy to fake and easy to misread. A round-trip quote against live state measures the only thing that matters: what you lose entering and exiting right now (fees + price impact, both ways). If a token can be bought but not sold, this tool says so (UNTRADABLE).

Install

npx @iniit/defi-guard-mcp        # or from source: npm install && npm run build

Claude Code

claude mcp add defi-guard -- npx -y @iniit/defi-guard-mcp

Any MCP client (Cursor, Windsurf, etc.)

{
  "mcpServers": {
    "defi-guard": {
      "command": "npx",
      "args": ["-y", "@iniit/defi-guard-mcp"],
      "env": { "BASE_RPC_URL": "https://your-rpc-if-you-have-one" }
    }
  }
}

BASE_RPC_URL is optional; without it the server rotates across public Base endpoints with automatic fallback and retries.

Example

"Before I approve TOKEN X to this router, is any of it risky?"

The agent calls token_safety_screen (can I sell it back? is ownership renounced?), scan_dangerous_capabilities (can the owner mint/blacklist/pause?), and approval_risk (is this an unlimited allowance to an EOA?) — and answers with live on-chain facts instead of vibes, before you sign.

Honesty notes (read this)

  • Quotes are simulations against live state (eth_call). Real execution adds slippage between quote and inclusion.

  • Contract addresses (Aave V3 Pool, QuoterV2) are Base mainnet constants, validated against live chain state.

  • This is a read-only tool. It never holds keys, signs, or submits transactions.

  • Not financial advice; it reports on-chain state, decisions are yours.

Test

npm run build   # tsc — type-checks and emits dist/. Tools are verified against live Base state.

License

MIT

Available Tools

6 tools
aave_position_healthA

Check the live health of an Aave V3 position on Base: health factor, total collateral/debt (USD), LTV and liquidation threshold. A health factor below 1.0 means the position is liquidatable.

Inputs: address (required).

approval_riskA

Assess the risk of an existing ERC-20 approval on Base BEFORE it can be abused: reads the live allowance an owner has granted a spender, flags UNLIMITED approvals (the allowance-drain vector — a compromised or malicious spender can pull up to the allowance), and reports whether the spender is a contract. Unlimited allowance to an EOA is a classic scam setup. Use before signing an approval, or to audit standing approvals.

Inputs: owner (required), token (required), spender (required).

quote_swapA

Real exact-input swap quote on Base via Uniswap V3 QuoterV2. Tries all fee tiers (0.01%, 0.05%, 0.3%, 1%) and returns the best executable output. Amounts are human units (e.g. '0.5').

Inputs: tokenIn (required), amountIn (required), tokenOut (required).

scan_dangerous_capabilitiesA

Scan a token/contract's DEPLOYED BYTECODE on Base for owner-only powers that can harm holders — mint, pause, blacklist, adjustable fees/taxes, max-tx limits, trading toggles, and proxy upgradeability. Flags the PRESENCE of each capability (a selector match in the code), i.e. what the operator COULD do, independent of the token's claims. No explorer API key needed. Heuristic: matches 4-byte selectors in runtime bytecode; a minimal proxy hides its real logic in the implementation (reported).

Inputs: token (required).

token_risk_snapshotA

Liquidity risk snapshot of an ERC-20 on Base: metadata plus REAL market depth measured by round-trip quotes (WETH -> token -> WETH) at two trade sizes. High round-trip loss = thin/illiquid or high-fee market; a token you cannot exit is a risk regardless of its chart.

Inputs: token (required).

token_safety_screenA

Pre-trade safety screen for an ERC-20 on Base — the 'is this safe to buy/approve BEFORE I sign' check. Verifies you can actually SELL it back (honeypot detection), measures the real round-trip cost (buy+sell fees/tax), and reports whether ownership is renounced (a live owner can often change taxes, pause, or mint). Returns a single risk verdict. On-chain only; no oracle, no trust in the token's own claims.

Inputs: token (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A4.2/5.0

    Scored across 6 tools

    Disambiguation5/5

    Each tool addresses a distinct aspect of DeFi safety: position health, swap quoting, token liquidity, token safety, contract capabilities, and approval risk. There is no meaningful overlap; even the two token-focused tools (token_risk_snapshot and token_safety_screen) target different concerns (market depth vs. trade-ability/ownership).

    Naming Consistency4/5

    All tool names use lowercase with underscores and follow a compound noun or verb-noun structure. Most start with a noun (aave_position_health, token_risk_snapshot, approval_risk), while two start with verbs (quote_swap, scan_dangerous_capabilities), which is a minor inconsistency but not confusing.

    Tool Count5/5

    With 6 tools, the server is tightly scoped to its DeFi guard purpose. Each tool covers a core risk area and none feel redundant or excessive. This is an ideal size for the stated domain.

    Completeness4/5

    The tool set covers major DeFi risk vectors: position health, swap pricing, token liquidity, honeypot/tax checks, dangerous contract capabilities, and approval exposure. A minor gap is the lack of a comprehensive transaction simulation or portfolio-level risk assessment, but the core safety workflows are well supported.

    Maintenance

    ActivityInactive
    ResponsivenessLimited data

    Resources

    Related MCP Connectors

    Related MCP Servers

    • Guardian MCP

      izmiradami
      A
      license
      Not graded
      quality
      D
      maintenance
      Security layer for AI agents that evaluates transaction intents and returns verdicts (ALLOW/WARN/DENY) using deterministic rules, on-chain checks, and simulation.
      8 npm
      MIT

    • basescope

      chasdaddy
      A
      license
      A
      quality
      D
      maintenance
      basescope is a read-only onchain safety layer for AI agents: it answers "is this token/contract/approval safe?" on Base and EVM chains (honeypot/rug checks, risky-approval detection, verified-source lookup, balances, ENS/Basenames, gas, prices), with no private keys and no required API keys.
      13
      9 npm
      MIT