Contract Security Scanner

io.github.mastrophotPublished by GitHub account mastrophotv0.1.1Updated Oct 24, 2026

MCP smart contract scanner with NEAR-focused security context.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

A local MCP server that scans smart contract source code for common security weaknesses and returns a scored report with NEAR-specific notes.

What you can do
Scan contract source code in Solidity, Rust or TypeScript for heuristic patterns such as reentrancy, integer overflow, access control issues, front-running and oracle manipulation, returning a vulnerability list with severity, type and line, plus a security score and a NEAR-equivalent score with NEAR-specific notes and recommendations. Compare security models across languages. Produce an audit checklist for a chosen language.
When to use it
Useful when reviewing or auditing smart contract code and you want a quick heuristic pass, a checklist, or NEAR-oriented security context before a deeper manual audit.
Requirements
Runs as a local process installed from the npm package mcp-contract-security (Node.js required). No authentication, environment variables or headers are declared. Desktop client only.
Before you install
Detection is heuristic, so results are a starting point and not a substitute for a professional audit. Contract source code you submit is processed by the local tool; review the package before installing.

Installation

In SourceWeft

  1. Open Contract Security Scanner in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

mcp-contract-security

MCP server for smart contract security scanning.

Implements the required tools:

  • scan_contract
  • compare_security_models
  • audit_checklist

Supports languages:

  • solidity
  • rust
  • typescript

What it checks

scan_contract currently detects heuristic patterns for:

  • Reentrancy
  • Integer overflow/underflow risk
  • Access control issues
  • Front-running exposure
  • Oracle manipulation risk

The output includes:

  • vulnerability list with severity/type/line
  • security_score
  • near_equivalent_score
  • NEAR-specific security notes and recommendation

Install

bash
npm install -g mcp-contract-security

Published package:

MCP config (Claude Desktop)

json
{  "mcpServers": {    "contract-security": {      "command": "mcp-contract-security"    }  }}

Tool usage

scan_contract

Input:

json
{  "code": "contract source code here",  "language": "solidity"}

compare_security_models

Input (optional):

json
{  "language": "solidity"}

audit_checklist

Input (optional):

json
{  "language": "rust"}

Local development

bash
npm installnpm run check

Deliverable assets

Additional publish assets are prepared in deliverables/:

  • deliverables/mcp-registry-submission.md
  • deliverables/security-subreddit-posts.md
  • deliverables/blog-why-near-contracts-safer.md
  • server.json (MCP Registry metadata, schema-validated)

License

MIT

Source: README.md at commit 9f32ff1

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts