DeFi Guard MCP
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@DeFi Guard MCPCheck token safety for 0x1234567890abcdef before I buy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
DeFi Guard MCP
The safety layer that checks a DeFi transaction or token before your agent (or you) signs — on Base L2. Sits in front of execution MCPs (it pairs with them, it doesn't compete): honeypot detection, owner-power scans, approval-drain checks, position health, and executable prices — all from live on-chain state.
No API keys required — works out of the box against public Base RPCs (bring your own RPC for speed via BASE_RPC_URL). Read-only: it never holds keys, signs, or submits.
Guard-before-signing tools
Tool | What it answers |
| "Is this token safe to buy/approve before I sign?" — honeypot detection (can you actually sell it back?), real round-trip cost (fees + tax both ways), and whether ownership is renounced (a live owner can often change taxes / pause / mint). One risk verdict. |
| "What can the owner do to me?" — scans the deployed bytecode for owner-only powers: |
| "Is this approval dangerous?" — reads the live allowance an owner granted a spender, flags unlimited approvals (the allowance-drain vector) and whether the spender is a contract or an EOA. Current exposure = what could be pulled right now. |
Related MCP server: Crest Counterparty Intelligence
Data tools
Tool | What it answers |
| "Is this Aave V3 position safe?" — live health factor, collateral/debt in USD, LTV, liquidation threshold, and a plain risk level ( |
| "What would this swap actually return right now?" — exact-input quote via Uniswap V3 QuoterV2, best of all 4 fee tiers, with gas estimate. Executable price, not an oracle. |
| "Can I get out of this token?" — ERC-20 metadata + real market depth measured by round-trip quotes (WETH → token → WETH) at two sizes. High round-trip loss = thin or trapped liquidity, whatever the chart says. |
Why round-trip depth instead of "liquidity" numbers
TVL and pool-size numbers are easy to fake and easy to misread. A round-trip quote against live state measures the only thing that matters: what you lose entering and exiting right now (fees + price impact, both ways). If a token can be bought but not sold, this tool says so (UNTRADABLE).
Install
npx @iniit/defi-guard-mcp # or from source: npm install && npm run buildClaude Code
claude mcp add defi-guard -- npx -y @iniit/defi-guard-mcpAny MCP client (Cursor, Windsurf, etc.)
{
"mcpServers": {
"defi-guard": {
"command": "npx",
"args": ["-y", "@iniit/defi-guard-mcp"],
"env": { "BASE_RPC_URL": "https://your-rpc-if-you-have-one" }
}
}
}BASE_RPC_URL is optional; without it the server rotates across public Base endpoints with automatic fallback and retries.
Example
"Before I approve TOKEN X to this router, is any of it risky?"
The agent calls token_safety_screen (can I sell it back? is ownership renounced?), scan_dangerous_capabilities (can the owner mint/blacklist/pause?), and approval_risk (is this an unlimited allowance to an EOA?) — and answers with live on-chain facts instead of vibes, before you sign.
Honesty notes (read this)
Quotes are simulations against live state (
eth_call). Real execution adds slippage between quote and inclusion.Contract addresses (Aave V3 Pool, QuoterV2) are Base mainnet constants, validated against live chain state.
This is a read-only tool. It never holds keys, signs, or submits transactions.
Not financial advice; it reports on-chain state, decisions are yours.
Test
npm run build # tsc — type-checks and emits dist/. Tools are verified against live Base state.License
MIT
Available Tools
6 toolsaave_position_healthA
Check the live health of an Aave V3 position on Base: health factor, total collateral/debt (USD), LTV and liquidation threshold. A health factor below 1.0 means the position is liquidatable.
| Name | Required | Description | Default |
|---|---|---|---|
| address | Yes | EVM address of the position owner |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses the output metrics and clarifies that a health factor below 1.0 means liquidatable, which is valuable interpretive context. It does not mention potential errors or data sources, but the core behavior is well described.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the action, and concisely lists the key metrics and their interpretation. No extraneous information is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema and no output schema, the description adequately explains what the tool returns and what the health factor means. It is complete enough for an agent to invoke and interpret results, though it does not mention edge cases like positions with no collateral.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single address parameter, and the schema already describes it as 'EVM address of the position owner.' The description adds no additional parameter-level detail, so it meets the baseline but does not exceed it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks Aave V3 position health on Base, listing specific metrics (health factor, collateral/debt, LTV, liquidation threshold). This specific verb+resource distinguishes it from sibling tools like quote_swap or token_risk_snapshot.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for monitoring liquidation risk but does not explicitly state when to use it versus alternatives or provide exclusions. No sibling tool is mentioned for comparison, so guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
approval_riskA
Assess the risk of an existing ERC-20 approval on Base BEFORE it can be abused: reads the live allowance an owner has granted a spender, flags UNLIMITED approvals (the allowance-drain vector — a compromised or malicious spender can pull up to the allowance), and reports whether the spender is a contract. Unlimited allowance to an EOA is a classic scam setup. Use before signing an approval, or to audit standing approvals.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | Yes | The wallet that granted the approval | |
| token | Yes | The ERC-20 token address | |
| spender | Yes | The address allowed to spend (router, contract, or EOA) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well by disclosing it reads live allowance, flags unlimited approvals, and reports contract status. It also explains the unlimited-allowance drain vector and EOA scam setup, adding useful behavioral context, though it omits return format or explicit read-only confirmation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense, well-structured sentences lead with the core purpose, unpack behavior via a colon, and end with concrete use cases. Every sentence earns its place with no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description covers the key outputs (flags unlimited approvals, reports contract status) and provides purpose, chain, and use cases. It does not detail return shape or error behavior, but enough context is present for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes all three parameters with 100% coverage, but the description adds risk-specific meaning by tying owner/token/spender to the allowance-drain vector and describing spender as a router, contract, or EOA. This enriches the bare field names and helps correct usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action (assess risk), resource (existing ERC-20 approval on Base), and key behaviors (reads live allowance, flags unlimited approvals, reports spender contract status). This distinguishes it from sibling tools focused on swaps, token risk, or position health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states when to use: before signing an approval or to audit standing approvals. It does not name alternative tools or exclusions, but the use cases are unambiguous and clearly differentiate it from the listed siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quote_swapA
Real exact-input swap quote on Base via Uniswap V3 QuoterV2. Tries all fee tiers (0.01%, 0.05%, 0.3%, 1%) and returns the best executable output. Amounts are human units (e.g. '0.5').
| Name | Required | Description | Default |
|---|---|---|---|
| tokenIn | Yes | Input token address | |
| amountIn | Yes | Human-readable input amount, e.g. '0.5' | |
| tokenOut | Yes | Output token address |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It adds useful details like trying all fee tiers and returning the best executable output, and specifies human units. However, it does not disclose whether the call is read-only, what happens on failure (e.g., no liquidity), or the exact return format beyond 'best executable output'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action, and includes only relevant specifics (fee tiers, human units). No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no annotations and no output schema, so the description must fully cover behavior. It explains the quoting mechanism and human units but leaves out the return format (e.g., amountOut, fee tier chosen) and error scenarios. Given the moderate complexity, the description is adequate but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions like 'Input token address' and 'Human-readable input amount, e.g. '0.5''. The description reinforces 'Amounts are human units' but adds no additional meaning beyond the schema for any parameter. Baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('quote') and names the exact resource ('swap on Base via Uniswap V3 QuoterV2'). It clearly distinguishes from sibling tools (which focus on risk/health) by focusing on quote generation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies clear usage: use when you need an exact-input swap quote on Base. It does not explicitly state when not to use or name alternatives, but the context is unambiguous given the sibling tools are unrelated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scan_dangerous_capabilitiesA
Scan a token/contract's DEPLOYED BYTECODE on Base for owner-only powers that can harm holders — mint, pause, blacklist, adjustable fees/taxes, max-tx limits, trading toggles, and proxy upgradeability. Flags the PRESENCE of each capability (a selector match in the code), i.e. what the operator COULD do, independent of the token's claims. No explorer API key needed. Heuristic: matches 4-byte selectors in runtime bytecode; a minimal proxy hides its real logic in the implementation (reported).
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | Contract/token address on Base |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description fully explains the heuristic method (4-byte selector matching), the meaning of results (presence of capability, not actual operation), and the proxy limitation (logic hidden in implementation is reported). It also mentions no API key is needed, giving a complete behavioral picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences efficiently pack purpose, semantics, heuristic, and limitations without filler. Each clause adds value, though slightly dense for a quick read.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers what is scanned, specific capabilities, heuristic meaning, proxy limitation, and operational detail (no API key). It does not specify exact output structure, but 'flags presence' is sufficient for a simple single-parameter tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already describes the single parameter fully ('Contract/token address on Base'), and the description adds no additional format, validation, or usage detail beyond the schema. Baseline of 3 applies due to high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool scans deployed bytecode for owner-only powers (mint, pause, blacklist, etc.) using a specific verb and resource. It differentiates from sibling risk/safety tools by focusing specifically on selector-based capability detection, independent of token claims.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies usage for verifying a token's actual on-chain capabilities versus its stated claims, but no explicit when-to-use or when-not-to-use guidance is given. It does not reference alternative sibling tools like token_safety_screen, leaving the choice implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_risk_snapshotA
Liquidity risk snapshot of an ERC-20 on Base: metadata plus REAL market depth measured by round-trip quotes (WETH -> token -> WETH) at two trade sizes. High round-trip loss = thin/illiquid or high-fee market; a token you cannot exit is a risk regardless of its chart.
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | ERC-20 token address on Base |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description discloses that market depth is 'REAL' and measured by round-trip quotes (WETH -> token -> WETH) at two trade sizes, indicating it uses quotes rather than executing trades. It also explains the interpretation of high round-trip loss, adding behavioral context beyond a simple snapshot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the tool's purpose, then adds the key measurement methodology and interpretation. Every sentence contributes meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, no-output-schema tool, the description sufficiently outlines what it returns (metadata plus round-trip quotes at two sizes) and how to interpret it. It could specify the exact metadata fields or trade sizes, but these details are not essential for a basic understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already fully describes the single parameter 'token' as an ERC-20 token address on Base. The description repeats this context without adding syntax, format, or edge-case details, so it adds no additional semantic value beyond the 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it produces a liquidity risk snapshot for an ERC-20 on Base, using round-trip quotes to measure market depth. It distinguishes from siblings by focusing specifically on illiquidity risk rather than safety, approvals, or quote conversion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use when assessing whether a token can be exited, noting high round-trip loss indicates thin/illiquid or high-fee markets. It provides context for when to use (risk assessment) but does not explicitly name alternative tools or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
token_safety_screenA
Pre-trade safety screen for an ERC-20 on Base — the 'is this safe to buy/approve BEFORE I sign' check. Verifies you can actually SELL it back (honeypot detection), measures the real round-trip cost (buy+sell fees/tax), and reports whether ownership is renounced (a live owner can often change taxes, pause, or mint). Returns a single risk verdict. On-chain only; no oracle, no trust in the token's own claims.
| Name | Required | Description | Default |
|---|---|---|---|
| token | Yes | ERC-20 token address on Base |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It discloses that the tool verifies sell-back ability, measures round-trip costs, checks ownership renunciation, returns a single risk verdict, and is on-chain only with no oracle or trust in token claims. This is robust behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose, and each sentence adds substantive value: what it checks, the details of the checks, the output, and the method. There is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single-parameter tool with no output schema and no annotations, the description is largely complete: it explains what it does, the input, and the output concept. A minor gap is lack of differentiation from sibling tool token_risk_snapshot, but overall the agent has enough context to select and invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the 'token' parameter as 'ERC-20 token address on Base' with 100% coverage. The description reinforces the parameter's role but adds no additional semantic detail beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a 'pre-trade safety screen for an ERC-20 on Base' and enumerates specific checks (honeypot detection, round-trip cost, ownership renounced). This verb+resource+scope formulation distinctly separates it from sibling tools like quote_swap or approval_risk.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context for when to use: the 'is this safe to buy/approve BEFORE I sign' check. However, it does not explicitly name alternative tools or exclusion criteria, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.2.0- First observed
aave_position_health - First observed
approval_risk - First observed
quote_swap - First observed
scan_dangerous_capabilities - First observed
token_risk_snapshot - First observed
token_safety_screen
TDQS
Scored across 6 tools
Each tool addresses a distinct aspect of DeFi safety: position health, swap quoting, token liquidity, token safety, contract capabilities, and approval risk. There is no meaningful overlap; even the two token-focused tools (token_risk_snapshot and token_safety_screen) target different concerns (market depth vs. trade-ability/ownership).
All tool names use lowercase with underscores and follow a compound noun or verb-noun structure. Most start with a noun (aave_position_health, token_risk_snapshot, approval_risk), while two start with verbs (quote_swap, scan_dangerous_capabilities), which is a minor inconsistency but not confusing.
With 6 tools, the server is tightly scoped to its DeFi guard purpose. Each tool covers a core risk area and none feel redundant or excessive. This is an ideal size for the stated domain.
The tool set covers major DeFi risk vectors: position health, swap pricing, token liquidity, honeypot/tax checks, dangerous contract capabilities, and approval exposure. A minor gap is the lack of a comprehensive transaction simulation or portfolio-level risk assessment, but the core safety workflows are well supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
On-chain security and market intelligence for trading agents on Base.
Check a Base contract, transaction or web page before you act. Free pricing, paid per call in USDC.
DeFi safety layer for AI agents: wallet safety, token risk, tx decode/simulate. 20 tools.
Pay-per-call safety checks for AI agents: screen a crypto address or URL before you transact.
Related MCP Servers
- AlicenseAqualityDmaintenanceSafety layer for autonomous DeFi agents. Scans contracts for exploit patterns, simulates transactions, blocks honeypots.4101MIT
- AlicenseNot gradedqualityCmaintenanceEnables agents to assess counterparty risk, token danger, and wallet creditworthiness on Base by analyzing contract powers and controlling wallet reputation.MIT
- AlicenseNot gradedqualityCmaintenanceSecurity layer for AI agents that evaluates transaction intents and returns verdicts (ALLOW/WARN/DENY) using deterministic rules, on-chain checks, and simulation.7MIT
- AlicenseAqualityDmaintenancebasescope is a read-only onchain safety layer for AI agents: it answers "is this token/contract/approval safe?" on Base and EVM chains (honeypot/rug checks, risky-approval detection, verified-source lookup, balances, ENS/Basenames, gas, prices), with no private keys and no required API keys.13201MIT