3ilm Mcp

io.github.holistisPublished by GitHub account holistisv1.0.1Updated Nov 3, 2026

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

VerifiedSTDIODesktop onlyKnowledge & MemorySecurity & Monitoring

Overview

AI-generated overview

Local MCP server that lets an assistant search 1,032 verified smart contract vulnerability findings from Sherlock audit contests by pattern.

What you can do
  • Search vulnerability findings by keyword across 12 pattern categories, with acceptance rates and examples
  • Get full stats for one pattern: totals, acceptance rate, Sherlock-specific note and accepted/rejected examples
  • List all 12 patterns ranked by volume with acceptance indicators
When to use it
Useful when researching smart contract bug classes, triage outcomes or acceptance rates for audit findings, or when an assistant needs structured reference data on which vulnerability patterns get paid on Sherlock.
Requirements
Runs locally via npx from the npm package 3ilm-mcp; Node.js and network access to fetch the package. No authentication, environment variables or headers declared.
Before you install
Read-only lookup of a bundled dataset; no credentials or payments involved. The README notes the numbers are copied from a separate public dataset rather than independently computed, and that a related server offers a paid contract scan, which this one does not.

Installation

In SourceWeft

  1. Open 3ilm Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

3ilm MCP Server

MCP server exposing 3ilm, a curated knowledge base of 1,032 smart contract vulnerability findings from 10 fully-reconciled Sherlock audit contests.

Built for AI agents, security researchers, and audit tools that need structured data on which bug classes get paid, at what rates, and why.

What it is

3ilm (Arabic: علم, "knowledge") contains:

  • 1,032 verified findings from 10 Sherlock contests (fully reconciled against contest outcomes)
  • 12 vulnerability pattern categories with real acceptance rates, not estimates
  • Accepted and rejected examples per category, to learn what passes triage

Tools

ToolDescription
search_vulnerabilitiesKeyword search across all 12 categories. Returns matching patterns with acceptance rates and examples.
get_pattern_detailsFull stats table for one specific pattern: totals, acceptance rate, Sherlock-specific note, examples.
list_patternsAll 12 patterns ranked by volume with 🟢🟡🔴 acceptance indicators.

Install

bash
npx 3ilm-mcp

Add to Claude / Cursor

Claude Desktop (add to claude_desktop_config.json):

json
{  "mcpServers": {    "3ilm": {      "command": "npx",      "args": ["-y", "3ilm-mcp"]    }  }}

Cursor (add to .cursor/mcp.json):

json
{  "mcpServers": {    "3ilm": {      "command": "npx",      "args": ["-y", "3ilm-mcp"]    }  }}

Example queries

Ask your AI assistant:

  • "What is the acceptance rate for oracle manipulation findings on Sherlock?"
  • "Show me all vulnerability patterns and their payout rates"
  • "Search for reentrancy vulnerabilities: what percentage get accepted?"
  • "What does a accepted flash loan finding look like vs a rejected one?"

Data source

Same underlying dataset as vulnerability-acceptance-rates.json, CC0, downloadable directly, no server required. That file is the canonical, publicly reproducible source; the numbers here are copied from it, not independently computed. Findings are reconciled against actual contest outcomes, no scraping, no estimates. See METHODOLOGY.md for the exact reconciliation method.

The 12 patterns: fee-miscalculation, dos-griefing, reentrancy, trusted-actor, overflow, staleness, rounding, access-control, oracle-manipulation, mev-slippage, liquidation, flash-loan.

How this relates to bug-bounty-intelligence-mcp

Both MCP servers read the same verified data. They differ in scope:

3ilm-mcp (this repo)bug-bounty-intelligence-mcp
Pattern search / acceptance ratesFreeFree (list_vulnerability_patterns)
Full-repo contract scanNot offered$5 USDC via x402 (scan_contract)
CostAlways free, no paid tierFree tools + one paid tool
Best forJust want the pattern data via MCP, nothing elseAlso want an actual scan of your own contracts

If you only need to query acceptance rates, either server works identically for that. Use 3ilm-mcp if you want the smaller, free-only package; use bug-bounty-intelligence-mcp if you also want the paid full-repo scan tool.

Related

  • HTTP API (pay-per-query, USDC on Base): https://wazir-x402.duckdns.org/api/vuln-search?q=oracle
  • x402 Tollbooth: all endpoints listed at /api/status

License

MIT

Source: README.md at commit 7ecf9b2

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.0.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts