Skip to content

Feature: add smart contract security scanning MCP tool alongside EVM tools #37

Description

@holistis

Love what you have built here. EVM MCP is the right foundation for AI agents working with on-chain systems.

One gap I keep seeing: agents can now read state and send transactions via MCP, but there is no equivalent tool for checking if a contract is safe before interacting with it. A security scan MCP tool would complete the workflow.

We built exactly this: Bug Bounty Intelligence is an MCP server that scans Solidity repos for vulnerabilities. It is trained on 27,681 real accepted findings from Sherlock and Code4rena audit contests.

The agent workflow becomes:

  1. Agent reads contract address/state via evm-mcp-server
  2. Agent resolves GitHub repo from verified contract source
  3. Agent calls scan_contract via Bug Bounty Intelligence MCP
  4. Agent gets ranked vulnerabilities before deciding to interact

Available as MCP: https://github.com/holistis/bug-bounty-intelligence-mcp
Live x402 API (agent-payable, $5 USDC on Base): https://wazir-x402.duckdns.org/.well-known/x402

Not asking you to include it directly in this repo, just flagging it as a companion tool for users who want the full stack. Happy to provide a free scan of any contracts in evm-mcp-server as a demo.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions