MCP server for AI agents to scan and audit smart contracts on Base for security vulnerabilities. Det
MCP server for AI agents to scan and audit smart contracts on Base for security vulnerabilities. Det. The base mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 8 defined tools rather than through you.
MCP server for AI agents to scan smart contracts on Base mainnet for security vulnerabilities. Detect honeypots, rug pulls, hidden mints, proxy patterns, and generate full audit reports -- all read-only, no private key needed.
base-security-scanner-mcp on npm is all you need. Most clients run it directly, so configuration is a few lines and a restart.
Everything the assistant can do here goes through one of these:
scan_contract — Analyze a contract for security issues (reentrancy, access control, hidden mints, proxy patterns)check_honeypot — Check if a token is a honeypot by simulating buy+sell via Uniswap V2detect_rug_risk — Score rug pull risk 0-100 based on ownership, liquidity, permissions, honeypot statusanalyze_bytecode — Disassemble bytecode, identify contract type (proxy, AMM, ERC-20, diamond, etc.)check_token_permissions — Check owner permissions: mint, pause, blacklist, change fees, disable tradingget_contract_info — Basic contract metadata: verified status, bytecode size, ETH balance, token infocompare_bytecode — Clone detection -- check if two contracts share the same bytecodeaudit_report — Full security audit combining all checks into one comprehensive reportThis sits in the developer tooling group, where several servers overlap in what they claim to do but differ sharply once you actually set them up. Base's toolset — scan_contract, check_honeypot, detect_rug_risk and 5 more — is a fair guide to whether it matches your workflow. It is maintained by lordbasilaiassistant-sudo; worth a glance at recent repository activity before you build anything load-bearing on it.
We check each listing at SyncDev against the project's documentation before it goes live — if something here drifts out of date, it is a bug worth reporting.
| Tool | What it does |
|---|---|
| scan_contract | Analyze a contract for security issues (reentrancy, access control, hidden mints, proxy patterns) |
| check_honeypot | Check if a token is a honeypot by simulating buy+sell via Uniswap V2 |
| detect_rug_risk | Score rug pull risk 0-100 based on ownership, liquidity, permissions, honeypot status |
| analyze_bytecode | Disassemble bytecode, identify contract type (proxy, AMM, ERC-20, diamond, etc.) |
| check_token_permissions | Check owner permissions: mint, pause, blacklist, change fees, disable trading |
| get_contract_info | Basic contract metadata: verified status, bytecode size, ETH balance, token info |
| compare_bytecode | Clone detection -- check if two contracts share the same bytecode |
| audit_report | Full security audit combining all checks into one comprehensive report |
{
"mcpServers": {
"base-security-scanner": {
"command": "npx",
"args": ["-y", "base-security-scanner-mcp"]
}
}
}Add to claude_desktop_config.json, then restart Claude Desktop.
Kill hallucinated APIs — version-accurate, up-to-date library documentation injected straight into context.
Microsoft's official browser automation server — drive a real browser through the accessibility tree, no screenshots needed.
GitHub's official server — repos, issues, pull requests, Actions and code security, straight from your assistant.
Issue tracking at the speed of conversation — Linear's official hosted server with OAuth and zero install.
Local repository surgery — status, diffs, commits, branches and history for any repo on disk.
Timezone sanity for AI — current time anywhere and correct conversions, without the model doing date math.