Weakspot MCP server

by weakspot.dev·dev.weakspot/weakspot·v0.1.1

Audit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402.

C58/100grade C

What users say

No reviews yet

Safety scan

C58/100

Adoption

New

37 downloads/wk

Reviews

Nobody has reviewed Weakspot yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

weakspot_audit
Commission a security audit of Solidity or Rust/Anchor source files. THIS SPENDS REAL MONEY (USDC on Base,
weakspot_audit_status
Poll an audit by jobId. Free, no wallet needed. `stage` moves static-analysis -> batches -> verify ->
weakspot_estimate_price
Price a Weakspot audit before committing to it. $1 per 10 files, rounded up, capped at 40 files.
weakspot_wallet_status
Show which wallet this server pays from and its USDC balance. Use when a payment fails, to tell an unfunded

scanner v0.1.9 · 2026-09-20 · same rubric, same numbers if you re-run it

1 low

Code scan2 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitystatic API keys via environment variables6/15
Maintenanceno repository listed3/15
Maintainer identityverified namespace with website, no repo4/10

Overall 58/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

Runs npx -y weakspot-mcp on your machine. Read the scan report first; the gateway never runs local packages.

claude mcp add weakspot -- npx -y weakspot-mcp

Is Weakspot MCP server safe?: With care: it is graded C, so read the findings first (58/100). Read the Weakspot safety report
How do I install Weakspot?: It runs on your machine. Copy the Claude Code, Claude Desktop or Cursor config from the install section.
Does Weakspot need an API key?: Yes. The registry entry asks for WEAKSPOT_PRIVATE_KEY.
Is Weakspot maintained?: The latest release is v0.1.1.

Local package. It runs on your machine, not through the gateway.

WEAKSPOT_PRIVATE_KEYsecretPrivate key of a funded Base wallet. This server SPENDS REAL USDC from it with no human in the loop — use a fresh wallet funded with only what you are willing to lose, never a personal or deployer key. Only weakspot_audit needs it; the pricing, status and wallet-status tools work without one.
WEAKSPOT_MAX_USDHard cap in USD on any single audit (default 4, the highest tier). Checked twice: against the tier price, and again against the amount the server actually quotes. An LLM decides when to call the paying tool, so this is the main spend control.
WEAKSPOT_URLBase URL of the Weakspot deployment to use. Defaults to https://weakspot.dev; override to point at staging or a self-hosted instance.
WEAKSPOT_RPC_URLBase RPC endpoint, used only to read the wallet's USDC balance in weakspot_wallet_status. Nothing else needs it.

Claim it to keep the listing current and reply to reviews. Claiming never changes the grade or hides a review.

Shows the safety grade and links back to this page. It updates itself after every scan and review.

[![mcp.market](https://mcp.market/badge/weakspot.svg)](https://mcp.market/server/weakspot)