mcpField
C
contract-security-scanner

contract-security-scanner

Local
github.com/mastrophotSecurity0Updated 32w ago
Repository

About contract-security-scanner

contract-security-scanner is an MCP server for heuristic smart-contract security scans, with security context focused on NEAR. It supports Solidity, Rust, and TypeScript and reports findings with severity, type, and line information.

Key features

  1. 01Scan Solidity, Rust, and TypeScript
  2. 02Detect five heuristic risk patterns
  3. 03Report severity, type, and line
  4. 04Provide security and NEAR-equivalent scores
  5. 05Offer NEAR-specific notes and recommendations

Use cases

  1. 01Review a contract for common security risks
  2. 02Compare security models by language
  3. 03Use a language-specific audit checklist

MCP support

Exposes `scan_contract`, `compare_security_models`, and `audit_checklist` tools to MCP clients. Scan results include vulnerability findings and NEAR-focused security context.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "mastrophot-contract-security-scanner": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-contract-security"
      ]
    }
  }
}
Run commandnpx -y mcp-contract-security

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmmcp-contract-security0.1.1

Tools

3

Saved tool list · updated 2w ago

ParameterTypeRequiredDescription
codestringYes
languageenumYesrust | solidity | typescript

Details

From the project README

mcp-contract-security

MCP server for smart contract security scanning.

Implements the required tools:

  • scan_contract
  • compare_security_models
  • audit_checklist

Supports languages:

  • solidity
  • rust
  • typescript

What it checks

scan_contract currently detects heuristic patterns for:

  • Reentrancy
  • Integer overflow/underflow risk
  • Access control issues
  • Front-running exposure
  • Oracle manipulation risk

The output includes:

  • vulnerability list with severity/type/line
  • security_score
  • near_equivalent_score
  • NEAR-specific security notes and recommendation

Install

npm install -g mcp-contract-security

Published package:

MCP config (Claude Desktop)

{
  "mcpServers": {
    "contract-security": {
      "command": "mcp-contract-security"
    }
  }
}

Tool usage

scan_contract

Input:

{
  "code": "contract source code here",
  "language": "solidity"
}
compare_security_models

Input (optional):

{
  "language": "solidity"
}
audit_checklist

Input (optional):

{
  "language": "rust"
}

Local development

npm install
npm run check

Deliverable assets

Additional publish assets are prepared in deliverables/:

  • deliverables/mcp-registry-submission.md
  • deliverables/security-subreddit-posts.md
  • deliverables/blog-why-near-contracts-safer.md
  • server.json (MCP Registry metadata, schema-validated)

License

MIT

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.