🛰️ DeFi Security Sentinel Agent

An autonomous AI agent that monitors Base chain DeFi protocols for security anomalies and alerts via MCP tools. Built for the Orion Builder Hackathon — $5K USDT prize pool, deadline Sep 2, 2026.

Live Demo: https://orion-sentinel.vercel.app Source: https://github.com/0xConsole/orion-sentinel

🎯 The Problem

Base chain DeFi is growing fast — Aerodrome, Morpho, Moonwell, Seamless, and a long tail of newer protocols. But security monitoring is still either:

• Manual — humans staring at Basescan, reacting after the fact

• Expensive — paid indexer subscriptions (The Graph paid tiers, Alchemy/QuickNode enhanced APIs, Forta)

• Gated — closed-source bots run by large funds, not accessible to smaller protocols or independent auditors

When a protocol gets drained, the first 5 minutes matter. Most teams find out from a Twitter post, not from their own monitoring.

Related MCP server: defi-yield-scanner-mcp

💡 The Solution

DeFi Security Sentinel is an AI agent that:

1. Polls Base mainnet public RPCs — no paid APIs, no indexer subscriptions, no API keys

2. Runs 5 anomaly detectors on every block — whale transfers, gas spikes, transfer-volume outliers, token velocity bursts (drain pattern), and first-touch of unknown contracts

3. Exposes 5 MCP tools — so any AI agent (Claude, GPT, any MCP client) can call detect_anomalies, check_large_transfers, produce_security_report, etc.

4. Persists alerts to SQLite — a queryable audit trail with severity classification

5. Generates a markdown security report — one call, ready to paste into a postmortem or audit

6. Ships a web dashboard — live status, monitored protocols, alert log, one-click demo

Unique Angle

This is the only hackathon entry that is itself an MCP server. Most "AI agent" submissions consume tools — this one provides them. Any other agent in the Orion ecosystem can connect to the Sentinel as an MCP client and ask "is this protocol safe right now?" That composability is the moat.

We also run entirely on free public infrastructure: public Base RPCs, Vercel free tier, SQLite in /tmp. Zero paid services. The entire stack can be forked and deployed by anyone in under 5 minutes.

🏗️ Architecture

┌─────────────┐     ┌──────────────┐     ┌─────────────────┐     ┌──────────────┐
│  Base RPC   │────▶│  Agent Loop  │────▶│  5 Detectors    │────▶│   SQLite     │
│ (public)    │     │  (poller)    │     │  (pure fns)     │     │  (alerts)    │
└─────────────┘     └──────┬───────┘     └────────┬────────┘     └──────┬───────┘
                           │                      │                      │
                           ▼                      ▼                      ▼
                    ┌──────────────┐     ┌─────────────────┐     ┌──────────────┐
                    │  FastAPI     │     │  MCP Server     │     │  Web UI      │
                    │  REST API    │     │  (5 tools)      │     │  (dashboard) │
                    └──────────────┘     └─────────────────┘     └──────────────┘
                           │                      │
                           ▼                      ▼
                    ┌──────────────┐     ┌─────────────────┐
                    │  /api/demo   │     │  Any MCP client │
                    │  /api/report │     │  (Claude, etc.) │
                    └──────────────┘     └─────────────────┘

Data flow: Base RPC → Agent Loop fetches blocks + Transfer logs → Detectors flag anomalies → Alerts persisted to SQLite → exposed via REST API + MCP tools + Web UI.

The 5 MCP Tools

The 5 Detectors

🚀 Demo Flow (60 seconds)

1. Open the live URL — the dashboard loads showing RPC status, latest Base block, and protocol watch-list

2. Click ▶ Run Monitoring Cycle — the agent polls live Base RPC, scans 10 blocks, runs all 5 detectors

3. Watch alerts populate in real-time — velocity bursts, whale transfers, gas spikes

4. Click 📄 Security Report — generates a full markdown report with stats + alert breakdown

5. Try the REST bridge: POST /api/mcp/call with {"tool":"detect_anomalies","arguments":{"block_count":5}}

API Endpoints

🛠️ Local Development

# Install deps
pip install -r requirements.txt

# Run the MCP server standalone (exercises all 5 tools against live Base RPC)
python mcp_server.py

# Run one agent monitoring cycle
python agent.py

# Run the continuous agent loop (polls every 60s)
python agent.py --continuous --interval=60

# Start the FastAPI server
uvicorn api.index:app --reload --port 8000

# Then visit http://localhost:8000

Environment

No API keys, no paid services, no environment setup required. The agent uses public Base RPC endpoints with automatic failover.

🧱 Tech Stack

Total monthly cost: $0. The only cost in the entire hackathon pipeline is the Orion submission ignition fee (~$10 ETH on Base), which is a platform fee, not a project cost.

📁 Project Structure

orion-sentinel/
├── api/
│   └── index.py          # FastAPI app — all REST endpoints + UI serving
├── static/
│   └── index.html        # Web dashboard (single file, no build step)
├── chain.py              # Base chain RPC client (async, failover, no web3 dep)
├── detectors.py          # 5 anomaly detectors (pure functions)
├── mcp_server.py         # MCP server with 5 tools + REST-bridge implementations
├── agent.py              # Sentinel agent loop (poll → detect → alert → persist)
├── store.py              # SQLite store (protocols, alerts, runs, baselines)
├── requirements.txt      # FastAPI, httpx, mcp, pydantic, uvicorn
├── vercel.json           # Vercel serverless config
├── LICENSE               # Apache 2.0
└── README.md             # This file

🔌 Using the MCP Server

The Sentinel is also a standalone MCP server. Any MCP-compatible AI client can connect:

from mcp_server import create_mcp_server

mcp = create_mcp_server()
# Run over stdio, SSE, or in-process transport
# Tools: monitor_protocol, check_large_transfers, detect_anomalies,
#        generate_alert, produce_security_report

Or via the REST bridge (for non-MCP clients):

# Detect anomalies in the last 10 blocks
curl -X POST https://<your-url>/api/mcp/call \
  -H "Content-Type: application/json" \
  -d '{"tool":"detect_anomalies","arguments":{"block_count":10}}'

# Generate a security report
curl -X POST https://<your-url>/api/mcp/call \
  -H "Content-Type: application/json" \
  -d '{"tool":"produce_security_report","arguments":{"limit":50}}'

📊 Real Output (from live Base mainnet)

A monitoring cycle scanning 5 blocks at block ~49,840,211:

status:          ok
blocks_scanned:  5
total_transfers: 1,470
alerts_found:    210
elapsed_sec:     2.85
rpc_calls:       32
rpc_failures:    0

Sample alerts:
  [CRITICAL] velocity_anomaly: 452 0x833589fc... transfers in 5 blocks
  [CRITICAL] velocity_anomaly: 500 0xd7cb132e... transfers in 5 blocks
  [WARNING]  large_transfer: Whale transfer: 52,000.00 units

(0x833589fc is the native USDC bridge token on Base — 452 transfers in 5 blocks is real activity the detector correctly flagged.)

⚠️ Notes for Judges

• "If it is an AI agent and it works, it qualifies" — this agent works. Hit POST /api/demo and watch it scan live Base blocks in real-time.

• Usefulness: DeFi security monitoring is a real, paid category (Forta, OpenZeppelin Defender, ChainSecurity). This does a meaningful slice of it for $0.

• Execution: Every endpoint returns 200. The MCP server has 5 working tools. The agent successfully connects to live Base RPC and detects real anomalies. The dashboard is polished.

• Originality: This is an MCP server, not just a client — it provides tools that other agents can consume. That composability is novel in a hackathon setting.

📄 License

Apache 2.0 — see LICENSE.

🔗 Links

• Hackathon: Orion Builder Hackathon

• Live Demo: https://orion-sentinel.vercel.app

• Source: https://github.com/0xConsole/orion-sentinel

Built by 0xConsole for the Orion Builder Hackathon.