Lock Autopsy

io.github.DarkKitty-wPublished by GitHub account DarkKitty-wv0.2.0Updated Oct 29, 2026

On-chain token lock & vesting auditor: cancelable, revocable, transferable flags.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Read-only auditor that checks on-chain token lock and vesting contracts for cancel, revoke or transfer flags across several chains.

What you can do
  • Check a token's lock and vesting contracts on Base, Ethereum, Arbitrum, BNB Chain and Solana
  • Report which supported lockers (Sablier, Hedgey, UNCX, Team Finance, PinkLock, Streamflow) hold the token
  • Flag whether each position can be cancelled, revoked or transferred
  • Return block explorer links so findings can be verified independently
  • With a Pro key, add per-stream detail and a copyable investigation brief when sampled data supports it
When to use it
Useful when you want a quick read-only lead on whether a token's locked or vested supply could be pulled, cancelled or moved, for example before researching a project. Treat results as a starting point for manual verification, not as a safety verdict.
Requirements
Runs as a local npm package over stdio on desktop. No account or wallet connection is needed. Checks are executed on the provider's hosted service, so network access is required. An optional LOCK_AUTOPSY_PRO_KEY environment variable unlocks Pro detail; a paid Pro tier costs 19 USDC on Base.
Before you install
Coverage is partial: only configured lockers and bounded indexer samples are checked, so an empty or clean result is not proof a token is safe. The optional Pro key is a secret supplied via LOCK_AUTOPSY_PRO_KEY, and Pro requires a 19 USDC payment on Base. Token and contract queries are sent to the hosted service rather than audited locally.

Installation

In SourceWeft

  1. Open Lock Autopsy in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

LockAutopsy

Read-only on-chain check for token locks and vesting contracts — Sablier, Hedgey, UNCX, Team Finance, PinkLock, Streamflow — on Base, Ethereum, Arbitrum, BNB Chain and Solana.

It shows which locks can be cancelled, revoked or transferred. No account, no wallet connection, nothing to sign.

Run a free check →

What a report tells you

  • which supported lock contracts hold this token
  • whether each one exposes a setting that can cancel, revoke or transfer the position
  • a link to verify every finding yourself on the block explorer

What it cannot tell you

Coverage is partial: only configured lockers and bounded indexer samples are checked. Unlisted contracts, indexer lag and unverified flags can hide positions, so an empty or clean result is not proof that a token is safe. It is a lead to verify, never a safety verdict, and not financial advice.

Pro

One payment of 19 USDC on Base, no account. Adds per-stream detail and a copyable investigation brief when the sampled data supports it. Details and price. Every check still runs on the hosted service — nothing is audited on your machine.

Elsewhere

  • Command line and MCP client: npm
  • Userscript for DexScreener, GeckoTerminal and GMGN: GreasyFork
  • Firefox add-on: addons.mozilla.org
  • Machine payments (x402): the same deep report is sold per call at https://lock-autopsy.smither.workers.dev/api/v1/x402/deep-audit — $0.03 Base USDC, no account, no key. It is switched on in this deployment.

Privacy and licence

No token addresses and no IP addresses are stored — see PRIVACY.md. MIT — see LICENSE.

Contact: [email protected]

Source: README.md at commit 60f796a

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestOct 29, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts