Skip to main content
Glama
Sign In
deenesjakoruzh
mcp-contract-security

mcp-contract-security

by mastrophot
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

mcp-contract-security

MCP server for smart contract security scanning.

Implements the required tools:

  • scan_contract

  • compare_security_models

  • audit_checklist

Supports languages:

  • solidity

  • rust

  • typescript

What it checks

scan_contract currently detects heuristic patterns for:

  • Reentrancy

  • Integer overflow/underflow risk

  • Access control issues

  • Front-running exposure

  • Oracle manipulation risk

The output includes:

  • vulnerability list with severity/type/line

  • security_score

  • near_equivalent_score

  • NEAR-specific security notes and recommendation

Related MCP server: meok-mcp-injection-scan-mcp

Install

npm install -g mcp-contract-security

Published package:

MCP config (Claude Desktop)

{
  "mcpServers": {
    "contract-security": {
      "command": "mcp-contract-security"
    }
  }
}

Tool usage

scan_contract

Input:

{
  "code": "contract source code here",
  "language": "solidity"
}

compare_security_models

Input (optional):

{
  "language": "solidity"
}

audit_checklist

Input (optional):

{
  "language": "rust"
}

Local development

npm install
npm run check

Deliverable assets

Additional publish assets are prepared in deliverables/:

  • deliverables/mcp-registry-submission.md

  • deliverables/security-subreddit-posts.md

  • deliverables/blog-why-near-contracts-safer.md

  • server.json (MCP Registry metadata, schema-validated)

License

MIT

Available Tools

3 tools
audit_checklistB

Return a practical smart contract security checklist with NEAR-specific items.

Inputs: language.

compare_security_modelsB

Compare NEAR vs Ethereum security architecture and risk profile.

Inputs: language.

scan_contractB

Scan contract code for common vulnerabilities and include NEAR-specific security notes.

Inputs: code (required), language (required).

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 3 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose: scanning contracts for vulnerabilities, comparing architectures, and providing checklists. There is no meaningful overlap that would cause an agent to select the wrong tool.

    Naming Consistency4/5

    Two tools follow a verb_noun pattern (scan_contract, compare_security_models), while audit_checklist is more of a noun phrase. The pattern is mostly predictable and readable, with only a minor deviation.

    Tool Count4/5

    Three tools is a reasonable scope for a focused contract security server. It is slightly small but each tool serves a distinct, justified function within the domain.

    Completeness4/5

    The toolset covers scanning, comparative analysis, and actionable guidance, which gives agents a solid workflow. It lacks deeper features like detailed report generation or code fixes, but the core security assessment use case is well covered.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • agent-audit

      piiiico
      A
      license
      Not graded
      quality
      C
      maintenance
      Security scanner for MCP servers. Detects prompt injection, command injection, auth bypass, and excessive permissions across tools, resources, and prompts.
      24 npm
      3
      MIT

    • Smart Contract Security

      uitkhoanna
      F
      license
      Not graded
      quality
      D
      maintenance
      An MCP server that statically audits Solidity smart contracts for common vulnerabilities like reentrancy and access control, enabling developers to identify and fix security issues via natural language.
      -

    • smart-contract-scanner-api

      lazymac2x
      A
      license
      Not graded
      quality
      D
      maintenance
      Enables scanning Solidity smart contracts for 13 vulnerability classes using pattern-based analysis; provides full audit, quick scan, gas analysis, and detector catalog through MCP tools.
      MIT