Contract Security Scanner

io.github.fino-ossPublished by GitHub account fino-ossv1.0.0Updated Oct 24, 2026

Scans Base L2 smart contracts for security risks. Risk score 0-100, detects backdoors & proxies.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Scans Base L2 smart contracts for security risks, returning a 0-100 risk score, backdoor and proxy checks, and a use recommendation.

What you can do
  • Scan a single Base contract for source verification, risky function selectors, age and activity
  • Compare up to five contracts side by side in a batch scan
  • Get an actionable verdict (SAFE, CAUTION, HIGH_RISK, DO_NOT_USE) with a 0-100 risk score
  • Check for mint, blacklist, pause, backdoor and upgradeable proxy patterns
When to use it
Useful when you want an assistant to vet a Base L2 token or contract before approving, buying or interacting with it, or to compare several similar contracts. Read-only checks make it a low-commitment addition for on-chain due diligence.
Requirements
Runs locally as a Node.js stdio process (npm package @fino314-oss/contract-scanner-mcp) configured in an MCP client such as Claude Desktop, Cursor or Cline. Needs network access to Base mainnet RPC and BaseScan. An optional BASESCAN_API_KEY environment variable enables full source analysis; basic bytecode checks work without it. No wallet is required.
Before you install
Results are heuristic risk scores, not an audit or guarantee, and the README itself notes that the free BaseScan tier limits source analysis without BASESCAN_API_KEY. Contract addresses you scan are sent to BaseScan and Base RPC endpoints. The README lists an agent wallet address; do not send funds to it. Read-only, so it does not sign or move assets.

Installation

In SourceWeft

  1. Open Contract Security Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Contract Security Scanner — MCP Server

[contract-scanner-mcp MCP server]

Scan any Base L2 smart contract for security risks directly from your AI assistant.

3 tools exposed:

  • scan_contract — Full security scan (source verification, risky selectors, age, activity)
  • batch_scan — Compare up to 5 contracts side by side
  • interpret_risk — Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)

Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.

Installation

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

json
{  "mcpServers": {    "contract-scanner": {      "command": "node",      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]    }  }}

Restart Claude Desktop. The tools appear automatically.

Cursor

Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

json
{  "mcpServers": {    "contract-scanner": {      "command": "node",      "args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]    }  }}

Cline (VS Code extension)

  1. Open Cline settings → MCP Servers → Add server
  2. Set type: stdio
  3. Command: node /Users/sam/Desktop/samDev/p8/mcp/server.js

Any MCP client (generic)

The server uses stdio transport — just pipe JSON-RPC messages:

bash
node /Users/sam/Desktop/samDev/p8/mcp/server.js

Usage examples

Once connected, just ask your AI assistant naturally:

"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."
"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"

What gets analyzed

CheckSource
Source code verified?BaseScan API
Mint / burn functionsBytecode selector scan
Pause / freezeBytecode selector scan
Blacklist / whitelistBytecode selector scan
Backdoors (rescueTokens, withdrawAll)Bytecode selector scan
Upgradeable proxyBaseScan + delegatecall detection
Contract ageBaseScan transaction history
Activity levelBaseScan recent txs

Risk scoring

ScoreLabelMeaning
0-9SAFENo red flags
10-29LOWMinor concerns
30-49MEDIUMElevated risk — review before interacting
50-69HIGHSignificant risk — small amounts only
70+CRITICALAvoid — potential rug or backdoor

Technical notes

  • Chain: Base L2 only (https://mainnet.base.org)
  • API: BaseScan free tier (no key needed for basic checks; set BASESCAN_API_KEY env var for full source analysis)
  • No wallet needed: read-only RPC calls only
  • Latency: ~2-5s per contract (network dependent)

Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e

Source: README.md at commit 4992549

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.