io.github.AutomatonColony由 GitHub 帳號 AutomatonColony 發布v1.2.0更新於 Oct 24, 2026
Screen Base smart contracts and B20 tokens: free on-chain check, paid Flash Audit over x402 (USDC).
對 Base 智慧合約與 B20 代幣做篩檢：免費鏈上檢查，以及透過 x402 以 USDC 付費購買的 Flash Audit 報告。
Web executable，透過 Streamable HTTP。 遠端服務在工作區中設定後即可從網頁執行環境執行。
把這段提示詞貼上到 Claude Code、Codex、Cursor 等代理程式，或 SourceWeft 對話中。代理程式會讀取該伺服器的安裝指南，先向你展示發布者、端點和登入方式，經你同意後再把它新增到你的客戶端。金鑰不會寫進任何命令。
閱讀 https://sourceweft.com/mcp/io.github.AutomatonColony%2Fautomaton-colony/install.md，並按其中說明把這個 MCP 伺服器接入我的客戶端。修改任何設定之前，先告訴我它的發布者、端點和登入方式，等我確認。不要把 API 金鑰寫進命令或我會提交的檔案；問我金鑰應從哪裡取得。把它新增到你客戶端的 mcpServers 設定中。
{
"mcpServers": {
"automaton-colony": {
"type": "http",
"url": "https://colony.automatoncolony.xyz/mcp"
}
}
}An independent verifier for automatoncolony.xyz, a contract screening service running on Base.
Every report bought on-chain through the store's escrow has its SHA-256 written into that public contract by the transaction that delivers it. The script in this repository reads that hash straight from the chain and compares it with the file on your disk. It never contacts automatoncolony.xyz. A buyer who has to ask the seller whether the report was edited has no answer worth having.
Node 18 or newer. There are no dependencies and nothing to install.
The invoice id is the 0x value shown in the purchase confirmation, 64 hexadecimal characters. The
path is the report file exactly as it was downloaded, with no reformatting: a single added newline
changes the hash.
There are four possible endings. MATCH means the file has not been altered since it was
delivered. MISMATCH means the file differs from what the chain recorded, whether by an edit or
by a truncated download. An invoice id that exists in neither escrow gets its own message, which
is also what a mistyped id produces. And a purchase that exists with no content committed, which
is the case after a refund and also while a delivery is still pending, ends with a line saying
so, because there is nothing to compare the file against.
Exit codes are 0 for a match, 2 for a usage error, and 1 for everything else, so the script
can be used from another program.
One limit is worth knowing before relying on the check. The escrow records one delivery per purchase, so the reports generated afterwards with Sniper Pass credits are not anchored separately: their fingerprint travels inside the report itself, and this script cannot check them. Verifying a credit report against the pass's invoice id produces a MISMATCH that means nothing.
A second limit: a report bought over x402 never passes through the escrow. That route settles directly to the treasury and nothing writes the report hash on chain, so there is no invoice id and this script has nothing to compare. On that route the buyer's proof is the settlement transaction together with their own SHA-256 of the bytes received.
Queries go to https://mainnet.base.org by default. That endpoint is shared and rate limited; set
BASE_RPC_URL to use your own.
The script makes one kind of network call, an eth_call to the RPC endpoint, and believes the
answer. An endpoint that lies can produce a false MATCH. When that assumption matters, point
BASE_RPC_URL at a node under your own control, or repeat the read on BaseScan and compare the
two results. The hashing of the local file happens offline, with Node's own crypto module.
The script queries the two escrows and nothing else. The other two rows are here because they appear inside every purchase: USDC is the token the payment is denominated in, and the policy registry holds the product descriptor, terms and privacy hashes that were in force when the purchase was paid.
Both escrows are queried, newest first. v9 has been live since 21 August 2026, and reports bought before that date are committed in v8, whose buyers deserve a verifier that still works.
The two versions return the same struct with one difference: v9 inserted paymentToken in the
second slot, which shifted every field after it by one word. The script reads fields by name from
a per-version list. A hard-coded index is what broke the first client that met v9.
Escrow v9 and the policy registry are verified on BaseScan, so the source behind those addresses can be read there.
Nothing here depends on the script. The same check runs on BaseScan with no code at all:
read purchases(invoiceId) on the escrow, take the contentSha256 field, and compare it with
sha256sum of your file. The walkthrough is in
How to verify a security report was not edited afterwards.
Written for the person about to spend the money, and kept on the site so there is one copy of
each. The index is in guides/.
The store is built for machines as much as for people. An agent has four ways in:
https://automatoncolony.xyz/mcp (Streamable HTTP, JSON-RPC 2.0 by POST). Tools:
check_contract_free, flash_audit_terms, buy_flash_audit (paid over x402 inside the tool,
following the @x402/mcp convention) and collect_flash_audit. In Claude Code:
claude mcp add --transport http automaton-colony https://automatoncolony.xyz/mcp.skills/automaton-colony/SKILL.md teaches an agent
when and how to use the free check, the paid report and the verifier.POST /api/v1/x402/flash-audit answers 402 with the terms; described in
openapi.json and in the RFC 9727 catalogue at
/.well-known/api-catalog./.well-known/agent-registration.json.Plain-text summary for language models: llms.txt.
Security issues go to the address in SECURITY.md. Please do not open a public issue for anything that touches funds in escrow.
The verifier is published under the MIT licence, so it can be read, run, copied and adapted by anyone. A verifier nobody is allowed to reuse would not be much of a verifier.
來源：README.md，提交 85ad467
Free check of a Base contract
Free, no wallet. Observed on-chain facts about a Base address with no verdict and no score: verified source, proxy detection, admin selectors, holder concentration, and for B20 native tokens the issuer powers. Rate limited; a monthly quota applies.
address必填Flash Report payment terms (x402)
Returns the x402 v2 PaymentRequired document for the paid Flash Report: amount in USDC base units, network, asset, payTo and the request schema. Free. It also says how a person without a wallet can buy the report in the web store.
無需輸入參數。
Buy a Flash Report (paid, x402)
Paid over x402 in USDC on Base. Without a payment in _meta["x402/payment"] it returns the PaymentRequired document (isError), followed by how a person without a wallet can buy the same report in the web store. With a valid PaymentPayload it validates, settles asynchronously and returns an orderKey to collect with collect_flash_audit. If the payment is read but does not pass (wrong amount or recipient, insufficient balance, bad signature, expired or already-used authorization), it returns the PaymentRequired document again (isError) with the x402 errorReason in its "error" field; this call charges nothing.
languagetargetAddress必填Collect a Flash Report order
Status of an x402 order while it settles and generates; once DELIVERED, the report JSON itself. Poll every 10-15 seconds. Free.
orderKey必填What single facts are for sale, and at what price
Free, no wallet. Lists the individual on-chain facts about a Base contract that can be bought one call at a time, with the price in USDC and how long each answer stays valid. Read this before paying: the bundle costs less than buying the parts.
無需輸入參數。
Buy one on-chain fact about a Base contract
Paid over x402 in USDC on Base, from 0.0049 per call. Unlike buy_flash_audit, the answer comes back in THIS call: there is no order to poll. A first read of an address can take up to 60s: keep the connection open. If it drops before the answer arrives, send the SAME payment again within 10 minutes: the same authorization is never charged twice. Every answer carries the block it was read at and that block's hash, so it can be re-read against the chain. Call contract_data_catalog first for the list and prices. Without a payment in _meta["x402/payment"] it returns the PaymentRequired document, followed by what can be done for free without a wallet. If the payment is read but does not pass (wrong amount or recipient, insufficient balance, bad signature, expired or already-used authorization), it returns the PaymentRequired document again (isError) with the x402 errorReason in its "error" field; this call charges nothing.
product必填targetAddress已滿足適用檢查項的 100%
該評分衡量此收錄條目的完整程度，依據註冊中心條目、端點與公開來源計算得出。它不是對伺服器本身的評價，也不表示伺服器安全或目前可用：可連通性是帶日期的檢查結果，評分也不包含安裝量或使用者評價。
node verify-report.mjs <invoiceId> <path-to-report>escrow 0x85b98F29C0d52c435a4514A6f4843c3b7B6bc06e (v9)state RELEASEDbytes on-chain 6367bytes local 6367sha256 on-chain 0xe7914e36629ba27cec2906d0513bf2b9bc9507d91934ebcfe09b3782c6077edbsha256 local 0xe7914e36629ba27cec2906d0513bf2b9bc9507d91934ebcfe09b3782c6077edb
MATCH. This file is byte-for-byte the one committed on-chain when the report was delivered.BASE_RPC_URL=https://your-endpoint node verify-report.mjs 0x… report.json