Contract Guard Mcp

io.github.eltociearPublished by GitHub account eltociearv1.1.0Updated Oct 24, 2026

EVM contract/token risk check + ERC20 approval (proxy, EIP-7702, unlimited-allowance). Zero deps.

VerifiedSTDIODesktop onlyFinance Security & Monitoring

Server details

Identifier: io.github.eltociear/contract-guard-mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified the GitHub account eltociear for this listing. That does not show the account is the product's maker.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.github.eltociear%2Fcontract-guard-mcp.svg)](https://sourceweft.com/mcp/io.github.eltociear%2Fcontract-guard-mcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Local MCP server that runs pre-interaction risk checks on EVM contracts and tokens, flagging proxies, EIP-7702 delegations and unlimited ERC20 approvals.

What you can do: Check an EVM address on Base or Ethereum: contract vs externally owned account or self-destructed, EIP-7702 delegated-EOA detection, upgradeable proxy detection (EIP-1967 and legacy zeppelinos), ERC20 name, symbol, decimals and totalSupply, plus a risk score with actionable flags.
Audit ERC20 allowances for a token, owner and spender pair, flagging unlimited approvals.
Read-only lookups over public JSON-RPC; no signing and no dependencies.
When to use it: Useful when an assistant is about to approve, swap with, or otherwise trust a token or contract address and you want a quick risk signal first, or when you want to audit existing ERC20 allowances before revoking them.
Requirements: Runs as a local process over stdio, either from the published container image or by running the Python server script. Needs network access to public JSON-RPC endpoints for Base and Ethereum. No accounts, API keys, environment variables or headers are declared.

Before you install

The risk score and flags are heuristic signals, not an audit; treat them as one input before approving or interacting with a contract. The README also advertises a separate paid per-call HTTP endpoint that charges USDC from an agent's wallet, and paid audit subscriptions from the same author; the local MCP server itself is described as free and does not sign transactions.

Installation

In SourceWeft

Open Contract Guard Mcp in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

contract-guard-mcp

[smithery badge] [MCP Registry]

MCP server for a pre-interaction risk check on any EVM contract/token — what an agent needs before it approves, swaps, or trusts an address.

Tool: check_contract(address, chain="base") →

is-contract vs EOA / self-destructed
EIP-7702 delegated-EOA detection
upgradeable proxy detection (EIP-1967 + legacy zeppelinos)
ERC20 metadata (name / symbol / decimals / totalSupply)
risk score + actionable flags

Chains: Base, Ethereum. Pure public JSON-RPC, zero dependencies, no signing.

Also available as a pay-per-call x402 HTTP endpoint: https://eltociear-contract-guard.hf.space (POST /check, $0.005 USDC on Base).

Run

MIT licensed.

Tools

check_contract(address, chain) — is-contract/EOA, EIP-7702, proxy, ERC20 metadata, risk score
check_approval(token, owner, spender, chain) — ERC20 allowance audit; flags unlimited approvals (the #1 drain vector)

Free MCP vs paid x402

This MCP server is free (run it locally / via your client). For server-side, batch, or no-install use, the same engine is a pay-per-call x402 HTTP API — POST https://eltociear-contract-guard.hf.space/check ($0.005 USDC on Base, no signup). Your agent's wallet pays per call.

Professional audit services

Maintained by the same author — paid services on Polar (Stripe checkout):

MCP Security Audit Report — $5 — one-off audit of your MCP server: 68 attack patterns, severity-rated PDF report with concrete fixes.
Security Pulse — $5/mo (annual $50) — monthly briefing on newly disclosed MCP server vulnerabilities, scan stats across 100+ tracked repos, mitigation playbooks.
Pro Audit Stack — $20/mo — for teams running MCP servers in CI/CD: 50 hosted scans/month, Discord access, 24h SLA on vulnerability questions.

Full catalog: polar.sh/eltociear

Also live: clean-read ($0.005 / call)

Same operator, same x402 rails: clean-read turns any URL into clean Markdown for AI agents — fetches the page, strips nav/ads/boilerplate (trafilatura), returns the main content with title and word count. POST https://eltociear-skill-audit.hf.space/read — $0.005 USDC on Base, no signup.

Source: README.md at commit f435081

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.1.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts