Contract Scanner
Scan EVM smart contracts from your coding agent for vulnerabilities, risk scores, and decoded calldata before you ship on-chain features.
Overview
io.github.lordbasilaiassistant-sudo/contract-scanner is a MCP server for the Ship phase that scans EVM smart contracts for vulnerabilities, risk scores, and calldata decoding from your agent.
What is this MCP server?
- Scans verified contract source via Basescan or Etherscan API keys
- Surfaces vulnerabilities and aggregated risk scores for triage
- Decodes transaction calldata for safer agent-driven debugging
- stdio npm package @thryx/contract-scanner-mcp-server v1.0.2
- Optional THRYX_API_KEY for premium unlimited scan quota
- Server schema version 1.0.2 with stdio transport
- 4 documented environment variables including optional THRYX_API_KEY
- npm package identifier @thryx/contract-scanner-mcp-server
Community signal: 1 GitHub stars.
What problem does it solve?
Reviewing contract risk by hand across explorers and bytecode is slow and easy to skip when you are shipping alone.
Who is it for?
Indie builders and agent authors iterating on Base/EVM contracts who want automated scan passes inside the IDE.
Skip if: Teams needing regulated compliance sign-off or formal third-party audit reports with legal liability coverage.
What do I get? / Deliverables
Your agent can fetch verified source, run scanner-backed checks, and return structured risk signal before you deploy or wire new integrations.
- Vulnerability-oriented scan output and risk scores for a target contract
- Decoded calldata context for specified transactions or calls
- Agent-ready security triage notes tied to explorer-verified source
Recommended MCP Servers
Journey fit
How it compares
On-chain security MCP integration, not a reusable agent skill or manual audit firm engagement.
Common Questions / FAQ
Who is contract-scanner for?
Solo and indie developers shipping smart contracts or agent tools on EVM networks who want vulnerability and risk context from their AI coding environment.
When should I use contract-scanner?
Use it during ship and security review whenever you add or change contract addresses, before mainnet deploys, or when decoding calldata for incident triage.
How do I add contract-scanner to my agent?
Install @thryx/contract-scanner-mcp-server, add the stdio MCP entry in Claude Code or Cursor, and set RPC_URL plus Basescan or Etherscan API keys (and THRYX_API_KEY if needed).