Contract Scanner

A local MCP server that scans smart contracts for vulnerabilities, assigns risk scores and decodes calldata for an AI assistant.

What you can do

Scan smart contracts for security vulnerabilities and receive risk scores for the findings, according to the registry description. Decode calldata so an assistant can explain what a transaction or function call is doing. Fetch verified contract source code through the Basescan or Etherscan API keys when scanning contracts on those networks. Point scans at a chosen RPC endpoint, which defaults to Base mainnet. The manifest lists no individual tools, so the exact commands and outputs are not documented here.

When to use it

Useful when reviewing or auditing smart contracts and you want an assistant to surface vulnerabilities, risk ratings and decoded transaction data in the same conversation. Suited to developers or security reviewers working on EVM contracts, especially on Base or networks covered by Etherscan.

Requirements

Runs as a local process installed from the npm package, so Node.js is needed. Requires a BASESCAN_API_KEY and/or ETHERSCAN_API_KEY to fetch verified source code, and an optional RPC_URL (defaults to Base mainnet). A THRYX_API_KEY is offered for unlimited scans. Network access to the relevant APIs and RPC endpoint is required.