1. Conduid
  2. Security
  3. Contract Security Scanner
MCP server · Security

Contract Security Scanner

· github.com/fino-oss/contract-scanner-mcp

Scans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.

Unclaimed security
InstallView source
37Low

Scored 6 months ago · breakdown

About Contract Security Scanner

Contract Security Scanner is an MCP server in the Security category: scans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.

Install

Claude Code
claude mcp add contract-security-scanner -- npx -y @fino314-oss/contract-scanner-mcp
npx
npx -y @fino314-oss/contract-scanner-mcp

This server has no ConduID identity, so agent calls to it are not receipted. Pin the version you install and review the source before granting it credentials.

Ask AI

✦

Ask AI about Contract Security Scanner

Powered by Claude · Grounded in docs

I know everything about Contract Security Scanner. Ask me about installation, configuration, usage, or troubleshooting.

Security checks

  • ✓README presentThe repository ships documentation.

5 checks have not been run yet.

README

Contract Security Scanner — MCP Server

contract-scanner-mcp MCP server

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

  • scan_contract — Full security scan (source verification, risky selectors, age, activity)
  • batch_scan — Compare up to 5 contracts side by side
  • interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Cline (VS Code extension)

  1. Open Cline settings → MCP Servers → Add server
  2. Set type: stdio
  3. Command: node /Users/sam/Desktop/samDev/p8/mcp/server.js

Any MCP client (generic)

The server uses stdio transport — just pipe JSON-RPC messages:

node /Users/sam/Desktop/samDev/p8/mcp/server.js

Usage examples

Once connected, just ask your AI assistant naturally:

"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."

"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What gets analyzed

Check Source
Source code verified? BaseScan API
Mint / burn functions Bytecode selector scan
Pause / freeze Bytecode selector scan
Blacklist / whitelist Bytecode selector scan
Backdoors (rescueTokens, withdrawAll) Bytecode selector scan
Upgradeable proxy BaseScan + delegatecall detection
Contract age BaseScan transaction history
Activity level BaseScan recent txs

Risk scoring

Score Label Meaning
0-9 SAFE No red flags
10-29 LOW Minor concerns
30-49 MEDIUM Elevated risk — review before interacting
50-69 HIGH Significant risk — small amounts only
70+ CRITICAL Avoid — potential rug or backdoor

Technical notes

  • Chain: Base L2 only (https://mainnet.base.org)
  • API: BaseScan free tier (no key needed for basic checks; set BASESCAN_API_KEY env var for full source analysis)
  • No wallet needed: read-only RPC calls only
  • Latency: ~2-5s per contract (network dependent)

Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e

README copy captured when this server was indexed; it may lag the repository. The original is authoritative.

Questions

About Contract Security Scanner

How do I install Contract Security Scanner?

Run claude mcp add contract-security-scanner -- npx -y @fino314-oss/contract-scanner-mcp, then add the server to your MCP client's configuration.

Is Contract Security Scanner safe to use with an AI agent?

Its trust score is 37 out of 100 (low). It passes 1 of the 1 static security checks run so far. It has no ConduID identity yet, so agent calls to it are not receipted.

Is Contract Security Scanner still maintained?

Conduid hasn't recorded a commit date for this repository yet. Check the repository directly for recent activity.