Weakspot

dev.weakspotPublished by weakspot.devv0.1.1Updated Oct 24, 2026

Audit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Weakspot audits Solidity and Rust smart contracts from the editor and pays for each audit in USDC over x402 from a funded Base wallet.

What you can do
Run smart contract audits on Solidity and Rust code from the editor, with payment handled per audit in USDC over x402. Check the configured wallet's USDC balance through a wallet status tool. Cap spending per audit with a USD limit that is checked against both the tier price and the quoted amount.
When to use it
Useful when you want contract security checks on Solidity or Rust code without leaving the editor and are willing to pay per audit in USDC from a dedicated Base wallet.
Requirements
Runs locally as an npm package over stdio, desktop only. Needs a funded Base wallet private key in WEAKSPOT_PRIVATE_KEY, a Base RPC endpoint in WEAKSPOT_RPC_URL for balance checks, and network access to the Weakspot deployment set by WEAKSPOT_URL (defaults to the hosted service). WEAKSPOT_MAX_USD caps each audit (default 4).
Before you install
WEAKSPOT_PRIVATE_KEY is the private key of a funded Base wallet, and the server spends real USDC from it with no human in the loop; use a fresh wallet holding only what you can afford to lose, never a personal or deployer key. Audits cost money, so keep WEAKSPOT_MAX_USD low. Contract code is sent to the Weakspot deployment for auditing.

Installation

In SourceWeft

  1. Open Weakspot in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

25% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • License10 pts

    Declare a license in the repository or the registry entry.