MCP.Market

Contract Security Scanner MCP server

by mastrophot·io.github.mastrophot/contract-security-scanner·v0.1.1
No reviews yet

MCP smart contract scanner with NEAR-focused security context.

B75/100grade B
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
B75/100

full report

Adoption
New

0 stars33 downloads/wk

Reviews

Write one

Nobody has reviewed Contract Security Scanner yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Contract Security Scanner tools (3)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • audit_checklist

    Return a practical smart contract security checklist with NEAR-specific items.

  • compare_security_models

    Compare NEAR vs Ethereum security architecture and risk profile.

  • scan_contract

    Scan contract code for common vulnerabilities and include NEAR-specific security notes.

Public scan report

scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it

no findings
  • Code scan4 source files scanned25/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 195 days ago4/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10
Overall 75/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Contract Security Scanner compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
75/100
higher than 40% of 915 Security servers
Tools
3
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Downloads a week
33
more than 20% of 248 Security servers with a package

What its tools let an agent do: 3 read

Install Contract Security Scanner in Claude Code, Cursor or VS Code

Runs npx -y mcp-contract-security on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add contract-security-scanner -- npx -y mcp-contract-security
Add to Cursor

What the publisher says

From the Contract Security Scanner repository's README, as published. We do not edit it. Read it on GitHub

mcp-contract-security

MCP server for smart contract security scanning.

Implements the required tools:

  • scan_contract
  • comparesecuritymodels
  • audit_checklist

Supports languages:

  • solidity
  • rust
  • typescript

What it checks

scan_contract currently detects heuristic patterns for:

  • Reentrancy
  • Integer overflow/underflow risk
  • Access control issues
  • Front-running exposure
  • Oracle manipulation risk

The output includes:

  • vulnerability list with severity/type/line
  • security_score
  • nearequivalentscore
  • NEAR-specific security notes and recommendation

Install

npm install -g mcp-contract-security

Published package:

  • npm: https://www.npmjs.com/package/mcp-contract-security
  • MCP Registry: https://registry.modelcontextprotocol.io/v0/servers/io.github.mastrophot%2Fcontract-security-scanner/versions/0.1.1

MCP config (Claude Desktop)

{
  "mcpServers": {
    "contract-security": {
      "command": "mcp-contract-security"
    }
  }
}

Tool usage

scan_contract

Input:

{
  "code": "contract source code here",
  "language": "solidity"
}

comparesecuritymodels

Input (optional):

{
  "language": "solidity"
}

audit_checklist

Input (optional):

{
  "language": "rust"
}

Local development

npm install
npm run check

Deliverable assets

Additional publish assets are prepared in deliverables/:

  • deliverables/mcp-registry-submission.md
  • deliverables/security-subreddit-posts.md
  • deliverables/blog-why-near-contracts-safer.md
  • server.json (MCP Registry metadata, schema-validated)

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Contract Security Scanner: common questions

Is Contract Security Scanner MCP server safe?
Mostly: it is graded B (75/100). Read the Contract Security Scanner safety report
How do I install Contract Security Scanner?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Contract Security Scanner need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Contract Security Scanner maintained?
The last commit was 233 days ago (2026-03-16). The latest release is v0.1.1.
What can I use instead of Contract Security Scanner?
Servers from other publishers that do the same job: CodeInspectus MCP server, SafeWeave MCP server and n8n MCP Community MCP server.
How does Contract Security Scanner compare with other Security MCP servers?
safety score 75/100 (higher than 40% of 915 Security servers); tools 3 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Contract Security Scanner

Same job from other publishers: the closest match first, then the best rated.

  • CodeInspectus
    Local-first MCP security scanner and CLI for AI-generated applications.
    C
  • SafeWeave
    Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
    C
  • n8n MCP Community
    A security-focused MCP server for self-hosted n8n Community Edition.
    B
  • Bawbel Scanner
    Security scanner for MCP servers and skill files. Detects AVE vulnerabilities before production.
    B
  • Security Suite
    Bundle of secret-scanner, dependency-auditor, ssl-inspector, and dns-intelligence
    More from 4hmetuyar →
    A