Contract Security Scanner

fino-oss/contract-scanner-mcp

Exposes three tools for scanning Base L2 smart contracts through BaseScan's API: scan_contract for full security analysis, batch_scan to compare up to five contracts, and interpret_risk for actionable recommendations. Returns a 0-100 risk score by detecting mint functions, blacklist selectors, pause mechanisms, backdoors, proxy patterns, and checking source verification and contract age. Useful when evaluating tokens before swaps, auditing DeFi protocols, or vetting contracts in Claude without switching to Etherscan. Works read-only over RPC with no wallet required. Supports stdio transport across Claude Desktop, Cursor, and Cline with optional BASESCAN_API_KEY for deeper source code analysis.

tools: 3
auth: Secret needed
transport: STDIO
env var: 1
last updated: Mar 17, 2026

View on GitHub

Tools

3 tools

Public tool metadata for what this MCP can expose to an agent.

scan_contractFull security scan (source verification, risky selectors, age, activity)

Full security scan (source verification, risky selectors, age, activity)

No parameter schema in public metadata yet.

batch_scanCompare up to 5 contracts side by side

Compare up to 5 contracts side by side

No parameter schema in public metadata yet.

interpret_riskGet an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

No parameter schema in public metadata yet.

Configuration

BASESCAN_API_KEYsecret

BaseScan API key for source code analysis (optional — basic bytecode scan works without it)

Readme

Contract Security Scanner — MCP Server

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

scan_contract — Full security scan (source verification, risky selectors, age, activity)
batch_scan — Compare up to 5 contracts side by side
interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

View the full README on GitHub

Details

Repository: github.com/fino-oss/contract-scanner-mcp
Category: Security & Pentesting
Package: @fino314-oss/contract-scanner-mcp
Transport: STDIO
Auth: Required
Registry: MCP registry, active

Related Security & Pentesting MCP servers

View all

Garita MCPgaritalab5/garita-mcp-server30 security tools + the Vigia agent to audit MCP servers before you connect.0stars

Securecodejuanisidoro/securecode-mcpSecrets vault for Claude Code with audit logs, access rules, and AES-256 encryption.0stars

Bridgeguard Mcpkota1026/quantum-shieldBridgeGuard MCP Server - Cross-chain bridge security audit tools for AI coding agents. Scan bri...0stars

Quantumguard Mcpkota1026/quantum-shieldPost-quantum cryptography security scanner. Detect ECDSA/RSA vulnerabilities, NIST compliance.0stars

Smartguard Mcpkota1026/quantum-shieldSmartGuard MCP Server - AI-powered smart contract security audit tools for Claude Code, Cursor,...0stars

Vaultguard Mcpkota1026/quantum-shieldVaultGuard MCP Server - Yearn V3 / DeFi vault security and analysis tools for AI coding agents....0stars