Contract Security Scanner

Name: Contract Security Scanner
Author: fino-oss

Local

github.com/fino-ossSecurity0Updated 32w ago

Repository

About Contract Security Scanner

Contract Security Scanner is an MCP server for assessing smart-contract risks on Base L2. Its tools inspect contract code and activity, compare contracts, and return a risk score with an action label.

Key features

01Scan source verification and contract activity
02Detect risky selectors and proxy patterns
03Score risks from 0 to 100
04Compare up to five contracts
05Return actionable risk labels

Use cases

01Check a Base contract before interacting
02Compare several token contracts
03Review potential mint, blacklist or backdoor functions

MCP support

Exposes contract scanning, batch comparison and risk interpretation tools to MCP clients. It uses read-only RPC calls and BaseScan data for Base L2 contracts.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config

{
  "mcpServers": {
    "fino-oss-contract-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "@fino314-oss/contract-scanner-mcp"
      ],
      "env": {
        "BASESCAN_API_KEY": "<BASESCAN_API_KEY>"
      }
    }
  }
}

Run commandnpx -y @fino314-oss/contract-scanner-mcp

Environment variables to set

BASESCAN_API_KEYSecretBaseScan API key for source code analysis (optional — basic bytecode scan works without it)

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages

npm@fino314-oss/contract-scanner-mcp1.0.0stdio

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Contract Security Scanner — MCP Server

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

scan_contract — Full security scan (source verification, risky selectors, age, activity)
batch_scan — Compare up to 5 contracts side by side
interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "contract-scanner": {
      "command": "node",
      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
    }
  }
}

Cline (VS Code extension)

Open Cline settings → MCP Servers → Add server
Set type: stdio
Command: node /Users/sam/Desktop/samDev/p8/mcp/server.js

Any MCP client (generic)

The server uses stdio transport — just pipe JSON-RPC messages:

node /Users/sam/Desktop/samDev/p8/mcp/server.js

Usage examples

Once connected, just ask your AI assistant naturally:

"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"

"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."

"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What gets analyzed

Check	Source
Source code verified?	BaseScan API
Mint / burn functions	Bytecode selector scan
Pause / freeze	Bytecode selector scan
Blacklist / whitelist	Bytecode selector scan
Backdoors (rescueTokens, withdrawAll)	Bytecode selector scan
Upgradeable proxy	BaseScan + delegatecall detection
Contract age	BaseScan transaction history
Activity level	BaseScan recent txs

Risk scoring

Score	Label	Meaning
0-9	SAFE	No red flags
10-29	LOW	Minor concerns
30-49	MEDIUM	Elevated risk — review before interacting
50-69	HIGH	Significant risk — small amounts only
70+	CRITICAL	Avoid — potential rug or backdoor

Technical notes

Chain: Base L2 only (https://mainnet.base.org)
API: BaseScan free tier (no key needed for basic checks; set BASESCAN_API_KEY env var for full source analysis)
No wallet needed: read-only RPC calls only
Latency: ~2-5s per contract (network dependent)

Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

Read the getting-started guide

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.