Contract Security Scanner
- Updated March 17, 2026
- fino-oss/contract-scanner-mcp
Contract Security Scanner is a MCP server that scans Base L2 smart contracts and returns a 0–100 risk score with backdoor and proxy detection.
About
Contract Security Scanner is a stdio MCP server from fino-oss that scans smart contracts on Base L2 and returns a normalized risk score from 0 to 100 while highlighting concerns such as backdoors and proxy patterns. Developers shipping wallets, dashboards, or agent tools that interact with on-chain contracts can install the npm package in Claude Code or Cursor and run scans before mainnet or user-facing release. Placement on Ship → security reflects its role as a gate before you ship Web3 integrations, not as initial idea research. Optional BASESCAN_API_KEY unlocks richer source-level analysis via BaseScan while basic bytecode scanning remains available without secrets. Treat scores as automated triage to pair with human review and formal audits, not as a sole go-live decision.
- Risk score from 0–100 for Base L2 smart contracts
- Detects backdoors, proxies, and related security risk patterns
- npm stdio package @fino314-oss/contract-scanner-mcp v1.0.0
- Bytecode scan works without BaseScan API key; key enables deeper source analysis
- GitHub fino-oss/contract-scanner-mcp for local agent wiring
Contract Security Scanner by the numbers
- Data as of Jul 7, 2026 (Skillselion catalog sync)
claude mcp add --env BASESCAN_API_KEY=YOUR_BASESCAN_API_KEY contract-scanner -- npx -y @fino314-oss/contract-scanner-mcpAdd your badge
Show developers this MCP server is listed on Skillselion. Paste this into your README.
| Package | @fino314-oss/contract-scanner-mcp |
|---|---|
| Transport | STDIO |
| Auth | Required |
| Last updated | March 17, 2026 |
| Repository | fino-oss/contract-scanner-mcp ↗ |
What it does
Let your agent score Base L2 smart contract risk (0–100) and flag backdoors and proxies before users touch unknown addresses.
Who is it for?
Best when you're shipping Base L2 features and want agent-driven contract triage during security review sprints.
Skip if: Skip if you need full mainnet multi-chain audit firms, non-EVM chains only, or compliance sign-off without any human security review.
What you get
After installing the stdio MCP server, your agent can return scored Base contract risk signals and named findings before you wire addresses into production flows.
- 0–100 contract risk score for Base L2 targets
- Findings oriented around backdoors, proxies, and related risk patterns
- Agent-invokable local stdio security scan workflow
By the numbers
- Risk score range 0–100 documented in server description
- Package version 1.0.0 @fino314-oss/contract-scanner-mcp
- Transport stdio; BASESCAN_API_KEY optional for enhanced analysis
README.md
Contract Security Scanner — MCP Server
Scan any Base L2 smart contract for security risks directly from your AI assistant.
3 tools exposed:
scan_contract— Full security scan (source verification, risky selectors, age, activity)batch_scan— Compare up to 5 contracts side by sideinterpret_risk— Get an actionable recommendation (SAFE / CAUTION / HIGH_RISK / DO_NOT_USE)
Risk score: 0-100. Analyzes: mint/blacklist/backdoor functions, proxy patterns, source verification, contract age, transaction activity.
Installation
Claude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"contract-scanner": {
"command": "node",
"args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
}
}
}
Restart Claude Desktop. The tools appear automatically.
Cursor
Add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):
{
"mcpServers": {
"contract-scanner": {
"command": "node",
"args": ["/Users/sam/Desktop/samDev/p8/mcp/server.js"]
}
}
}
Cline (VS Code extension)
- Open Cline settings → MCP Servers → Add server
- Set type:
stdio - Command:
node /Users/sam/Desktop/samDev/p8/mcp/server.js
Any MCP client (generic)
The server uses stdio transport — just pipe JSON-RPC messages:
node /Users/sam/Desktop/samDev/p8/mcp/server.js
Usage examples
Once connected, just ask your AI assistant naturally:
"Scan this contract before I approve: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913"
"Compare the risk of these 3 Aave clones: 0x... 0x... 0x..."
"Is this token safe to buy? 0x4ed4e862860bed51a9570b96d89af5e1b0efefed"
What gets analyzed
| Check | Source |
|---|---|
| Source code verified? | BaseScan API |
| Mint / burn functions | Bytecode selector scan |
| Pause / freeze | Bytecode selector scan |
| Blacklist / whitelist | Bytecode selector scan |
| Backdoors (rescueTokens, withdrawAll) | Bytecode selector scan |
| Upgradeable proxy | BaseScan + delegatecall detection |
| Contract age | BaseScan transaction history |
| Activity level | BaseScan recent txs |
Risk scoring
| Score | Label | Meaning |
|---|---|---|
| 0-9 | SAFE | No red flags |
| 10-29 | LOW | Minor concerns |
| 30-49 | MEDIUM | Elevated risk — review before interacting |
| 50-69 | HIGH | Significant risk — small amounts only |
| 70+ | CRITICAL | Avoid — potential rug or backdoor |
Technical notes
- Chain: Base L2 only (
https://mainnet.base.org) - API: BaseScan free tier (no key needed for basic checks; set
BASESCAN_API_KEYenv var for full source analysis) - No wallet needed: read-only RPC calls only
- Latency: ~2-5s per contract (network dependent)
Built on Base. Agent wallet: 0x804dd2cE4aA3296831c880139040e4326df13c6e
Recommended MCP Servers
1Claw VaultHSM-backed vault secrets for AI agents (JIT fetch) plus prompt-injection and threat scanning.2
1passwordMCP server for 1Password service accounts — tools and resources for vaults and credentials18
402sentinel McpAssess an x402 counterparty's risk BEFORE paying: allow/review/block, scored on-chain (Base).1
A2adependencyinspector McpRemote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
A2a Governance Bridge McpA2A Governance Bridge MCP server.A2aidentitytoll McpRemote MCP for A2A caller identity, scope policy, verdict receipts, and audit history.How it compares
Base L2 contract risk MCP scanner, not a hosted equities broker or CI/CD pipeline.
FAQ
Who is Contract Security Scanner for?
It is for developers building on Base who want coding agents to run quick smart contract risk scans with a 0–100 score before launch.
When should I use Contract Security Scanner?
Use it in Ship during security review when evaluating contract addresses, integrations, or dependencies on Base L2 before users rely on them.
How do I add Contract Security Scanner to my agent?
Install @fino314-oss/contract-scanner-mcp via npm, configure the stdio MCP entry in your client, and optionally set BASESCAN_API_KEY for source-level BaseScan analysis.