Defi Guard Mcp

io.github.iinniittPublished by GitHub account iinniittv0.2.0Updated Oct 24, 2026

DeFi safety checks on Base before you sign: honeypot, owner-power scan, approval risk, Aave health.

VerifiedSTDIODesktop onlyFinanceSecurity & Monitoring

Overview

AI-generated overview

Read-only MCP server that checks Base L2 tokens, approvals and Aave positions on-chain before an assistant or user signs a DeFi transaction.

What you can do
Screen tokens for honeypots, round-trip cost and renounced ownership, with one risk verdict per token. Scan deployed bytecode for owner-only powers such as mint, pause, blacklist, fee changes and proxy upgrades. Check live allowances for unlimited approvals and whether the spender is a contract or EOA. Read Aave V3 position health, collateral and debt in USD, LTV and liquidation risk level. Quote exact-input swaps across Uniswap V3 fee tiers with a gas estimate, and measure real market depth via round-trip quotes.
When to use it
Use it when an agent or user is about to buy, approve or swap a token on Base and wants live on-chain facts about honeypots, owner powers, approval exposure, liquidity depth or Aave liquidation risk before signing.
Requirements
Runs locally over stdio, typically via npx of the npm package. No API keys or accounts. Optional BASE_RPC_URL environment variable to supply a private Base RPC endpoint; otherwise it rotates across public Base endpoints. Network access to Base mainnet is required.
Before you install
Read-only: it does not hold keys, sign or submit transactions. Quotes are simulations against live state, so real execution adds slippage. It reports on-chain state only and is not financial advice. Requests go to public Base RPC endpoints unless BASE_RPC_URL is set.

Installation

In SourceWeft

  1. Open Defi Guard Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

DeFi Guard MCP

[npm] [smithery badge] [License: MIT]

The safety layer that checks a DeFi transaction or token before your agent (or you) signs — on Base L2. Sits in front of execution MCPs (it pairs with them, it doesn't compete): honeypot detection, owner-power scans, approval-drain checks, position health, and executable prices — all from live on-chain state.

No API keys required — works out of the box against public Base RPCs (bring your own RPC for speed via BASE_RPC_URL). Read-only: it never holds keys, signs, or submits.

Guard-before-signing tools

ToolWhat it answers
token_safety_screen"Is this token safe to buy/approve before I sign?" — honeypot detection (can you actually sell it back?), real round-trip cost (fees + tax both ways), and whether ownership is renounced (a live owner can often change taxes / pause / mint). One risk verdict.
scan_dangerous_capabilities"What can the owner do to me?" — scans the deployed bytecode for owner-only powers: mint, pause, blacklist, adjustable fees/taxes, max-tx limits, trading toggles, proxy upgradeTo. Flags the capability, no explorer key needed.
approval_risk"Is this approval dangerous?" — reads the live allowance an owner granted a spender, flags unlimited approvals (the allowance-drain vector) and whether the spender is a contract or an EOA. Current exposure = what could be pulled right now.

Data tools

ToolWhat it answers
aave_position_health"Is this Aave V3 position safe?" — live health factor, collateral/debt in USD, LTV, liquidation threshold, and a plain risk level (healthy / elevated / critical / LIQUIDATABLE).
quote_swap"What would this swap actually return right now?" — exact-input quote via Uniswap V3 QuoterV2, best of all 4 fee tiers, with gas estimate. Executable price, not an oracle.
token_risk_snapshot"Can I get out of this token?" — ERC-20 metadata + real market depth measured by round-trip quotes (WETH → token → WETH) at two sizes. High round-trip loss = thin or trapped liquidity, whatever the chart says.

Why round-trip depth instead of "liquidity" numbers

TVL and pool-size numbers are easy to fake and easy to misread. A round-trip quote against live state measures the only thing that matters: what you lose entering and exiting right now (fees + price impact, both ways). If a token can be bought but not sold, this tool says so (UNTRADABLE).

Install

bash
npx @iniit/defi-guard-mcp        # or from source: npm install && npm run build

Claude Code

bash
claude mcp add defi-guard -- npx -y @iniit/defi-guard-mcp

Any MCP client (Cursor, Windsurf, etc.)

json
{  "mcpServers": {    "defi-guard": {      "command": "npx",      "args": ["-y", "@iniit/defi-guard-mcp"],      "env": { "BASE_RPC_URL": "https://your-rpc-if-you-have-one" }    }  }}

BASE_RPC_URL is optional; without it the server rotates across public Base endpoints with automatic fallback and retries.

Example

"Before I approve TOKEN X to this router, is any of it risky?"

The agent calls token_safety_screen (can I sell it back? is ownership renounced?), scan_dangerous_capabilities (can the owner mint/blacklist/pause?), and approval_risk (is this an unlimited allowance to an EOA?) — and answers with live on-chain facts instead of vibes, before you sign.

Honesty notes (read this)

  • Quotes are simulations against live state (eth_call). Real execution adds slippage between quote and inclusion.
  • Contract addresses (Aave V3 Pool, QuoterV2) are Base mainnet constants, validated against live chain state.
  • This is a read-only tool. It never holds keys, signs, or submits transactions.
  • Not financial advice; it reports on-chain state, decisions are yours.

Test

bash
npm run build   # tsc — type-checks and emits dist/. Tools are verified against live Base state.

License

MIT

Source: README.md at commit db89dc4

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.2.0LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts