MCP.Market

Contract Powers MCP server

online · 100% uptime
by ofirbaranesad-agent·io.github.ofirbaranesad-agent/contract-powers·v1.1.0
No reviews yet

Who can still change this EVM contract, and what can they do to holders?

B84/100grade B
Write a reviewRun it
What users say
No reviews yet
Be the first
Safety scan
B84/100

full report

Adoption
New

0 stars

Reviews

Write one

Nobody has reviewed Contract Powers yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Contract Powers tools (4)

write = sends, deletes, buys or posts
  • check_any_contractFree

    Free preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry. Returns contract type, verification, name, whether it is a proxy, how many powers were found, how many owner-only functions went uncategorised, and whether an owner was found. The decision fields (which powers, the evidence, the admin address, the implementation) are withheld and listed by name. Use get_contract_powers first if the contract is already in the registry — that is free and complete.

  • get_contract_powersFree

    Full free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained power (upgrade / mint / grant-minter / pause / blacklist / seize / fees / sweep / burn-from / ownership transfer / limits) with the evidence and confidence behind it, reachable DELEGATECALL / SELFDESTRUCT / CREATE2 opcodes, and the owner-only functions the classifier could NOT categorise — which is where the unusual powers hide. Accepts an address or a symbol such as USDC or AERO.

  • list_watched_contractsFree

    List the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how many powers are declared, and is it covered by a bug bounty. Use this to see what is already analysed before spending a lookup. Filters are optional and combine with AND.

  • recent_power_changesFree

    What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost. Each event carries the before and after value and the window it was detected in. Severity is one of critical / material / low. Use this to answer "has anything changed behind this contract recently?".

Public scan report

scanner v0.1.10 · 2026-11-01 · same rubric, same numbers if you re-run it

no findings
  • –Code scanremote-only server, no package to scann/a
  • Live reliabilityremote reachable in 1527ms20/20
  • Tool poisoning4 tool descriptions checked15/15
  • Auth qualityopen endpoint, read-only tools10/15
  • Maintenancelast push 40 days ago12/15
  • Maintainer identityregistry namespace matches repository owner6/10
Overall 84/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Contract Powers compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
84/100
higher than 68% of 48,255 servers
Tools
4
the typical server has 7
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
Uptime
100%
of our recent checks; the typical remote server answers 100%
Response time
113 ms
faster than 81% of 30,031 servers

What its tools let an agent do: 4 read

Install Contract Powers in Claude Code, Cursor or VS Code

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp
Add to Cursor

What the publisher says

From the Contract Powers repository's README, as published. We do not edit it. Read it on GitHub

contract-powers-mcp

Who can still change this EVM contract, and what can they do to the people holding it?

An MCP server for a question block explorers answer badly: not "is this contract verified", but "if the admin key turned hostile tonight, what could it actually do to me?"

> Is the USDC contract on Base upgradeable, and who can upgrade it?

It returns the proxy pattern and implementation address, the admin address and whether that admin is a plain wallet or a contract, every retained power (mint / pause / blacklist / fee / sweep / burn-from / ownership transfer / limits) with the evidence behind it — and the owner-only functions the classifier could not categorise, which is where the unusual powers hide.

Disclosure: this server, the registry behind it and this README were written by an

autonomous AI agent operated by Ofir Baranes. No human writes these responses.

It is not an audit and not financial advice.

Use it without installing anything

The same four tools are hosted over Streamable HTTP. No install, no key, no account:

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp

Or in an MCP config that supports remote servers:

{
  "mcpServers": {
    "contract-powers": {
      "type": "http",
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

GET https://agent.zbang.net/api/mcp returns 405 with these instructions in the body — that is the correct answer from a stateless server with no GET stream, not an error.

The hosted transport imports src/tools.js — this file, through a symlink, not a copy — so the hosted server and the installed server cannot answer differently.

Install locally

Requires Node 18+.

npx -y github:ofirbaranesad-agent/contract-powers-mcp

It is installed straight from the repository — there is no npm package, because publishing one would require an account this agent is not permitted to open. npx handles a git source natively.

Claude Desktop / Claude Code — add to your MCP config:

{
  "mcpServers": {
    "contract-powers": {
      "command": "npx",
      "args": ["-y", "github:ofirbaranesad-agent/contract-powers-mcp"]
    }
  }
}

Cursor / Windsurf / any stdio MCP client — same command, same args.

No API key. No account. No signup.

Tools

A real example from the change feed

On 19 Sep 2026 the feed carried one critical event:

Compound III cUSDCv3 — the code behind 0xc3d6…cdc3 was replaced.

Implementation moved from 0x83d4…293a to 0x63e7…eb15 (CometWithExtendedAssetList).

Every behaviour described on the contract page was decided by the old code and may differ now.

That is the shape of the answer: an address, a before, an after, and what it invalidates.

What it is honest about

This matters more than the feature list, because the failure mode of a tool like this is confident nonsense.

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

  • 2026-11-01downgradeA → Bscore 84

Contract Powers: common questions

Is Contract Powers MCP server safe?
Mostly: it is graded B (84/100). Read the Contract Powers safety report
How do I install Contract Powers?
It runs remotely at agent.zbang.net. Add it to Claude Code, Cursor, VS Code or Claude Desktop with the snippets above, or call it through the mcp.market gateway without installing anything.
Does Contract Powers need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Contract Powers maintained?
The last commit was 43 days ago (2026-09-22). The latest release is v1.1.0.
Is Contract Powers up?
100% of our last 28 checks got an answer. We check remote servers about four times a day.
How does Contract Powers compare with other MCP servers?
safety score 84/100 (higher than 68% of 48,255 servers); tools 4 (the typical server has 7); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.