mcp-contract-security

MCP server for smart contract security scanning.

Implements the required tools:

• scan_contract
• compare_security_models
• audit_checklist

Supports languages:

• solidity
• rust
• typescript

What it checks

scan_contract currently detects heuristic patterns for:

• Reentrancy
• Integer overflow/underflow risk
• Access control issues
• Front-running exposure
• Oracle manipulation risk

The output includes:

• vulnerability list with severity/type/line
• security_score
• near_equivalent_score
• NEAR-specific security notes and recommendation

Install

npm install -g mcp-contract-security

Published package:

• npm: https://www.npmjs.com/package/mcp-contract-security
• MCP Registry: https://registry.modelcontextprotocol.io/v0/servers/io.github.mastrophot%2Fcontract-security-scanner/versions/0.1.1

MCP config (Claude Desktop)

{
  "mcpServers": {
    "contract-security": {
      "command": "mcp-contract-security"
    }
  }
}

Tool usage

scan_contract

Input:

{
  "code": "contract source code here",
  "language": "solidity"
}

compare_security_models

Input (optional):

{
  "language": "solidity"
}

audit_checklist

Input (optional):

{
  "language": "rust"
}

Local development

npm install
npm run check

Deliverable assets

Additional publish assets are prepared in deliverables/:

• deliverables/mcp-registry-submission.md
• deliverables/security-subreddit-posts.md
• deliverables/blog-why-near-contracts-safer.md
• server.json (MCP Registry metadata, schema-validated)

License

MIT