1
Add it to Claude Code
claude mcp add base-security-scanner -- npx -y base-security-scanner-mcp2
Make your agent remember this setup
base-security-scanner's config, env vars, and the gotchas you hit — recalled in every future Claude Code, Cursor, and Codex session.
npx conare@latestFree · one command · indexes the sessions already on disk. Set up in the browser instead →
What it does
- Automated detection of honeypots, rug pulls, and hidden mints
- Bytecode analysis to identify dangerous patterns and contract types
- Permission checking for owner-controlled functions like blacklisting or fee changes
- Comprehensive audit report generation
- Read-only execution requiring no private keys
Tools 8
scan_contractAnalyze a contract for security issues like reentrancy, access control, hidden mints, and proxy patterns.check_honeypotCheck if a token is a honeypot by simulating buy and sell transactions via Uniswap V2.detect_rug_riskScore rug pull risk 0-100 based on ownership, liquidity, permissions, and honeypot status.analyze_bytecodeDisassemble bytecode and identify contract type such as proxy, AMM, ERC-20, or diamond.check_token_permissionsCheck owner permissions including mint, pause, blacklist, fee changes, and trading disablement.get_contract_infoRetrieve basic contract metadata like verified status, bytecode size, ETH balance, and token info.compare_bytecodePerform clone detection to check if two contracts share the same bytecode.audit_reportGenerate a full security audit combining all checks into one comprehensive report.Environment Variables
RPC_URLBase mainnet RPC endpointTry it
→Scan the smart contract at address 0x... for any hidden minting functions or proxy vulnerabilities.
→Is the token at 0x... a honeypot? Please simulate a buy and sell transaction to check.
→What is the rug pull risk score for the contract at 0x... based on its current liquidity and ownership?
→Generate a full security audit report for the contract at 0x... and summarize the findings.
Original README from lordbasilaiassistant-sudo/base-security-scanner-mcp
base-security-scanner-mcp
MCP server for AI agents to scan smart contracts on Base mainnet for security vulnerabilities. Detect honeypots, rug pulls, hidden mints, proxy patterns, and generate full audit reports -- all read-only, no private key needed.
Install
npx -y base-security-scanner-mcp
Configure (Claude Desktop / Cursor)
{
"mcpServers": {
"base-security-scanner": {
"command": "npx",
"args": ["-y", "base-security-scanner-mcp"]
}
}
}
Tools (8)
| Tool | Description |
|---|---|
scan_contract |
Analyze a contract for security issues (reentrancy, access control, hidden mints, proxy patterns) |
check_honeypot |
Check if a token is a honeypot by simulating buy+sell via Uniswap V2 |
detect_rug_risk |
Score rug pull risk 0-100 based on ownership, liquidity, permissions, honeypot status |
analyze_bytecode |
Disassemble bytecode, identify contract type (proxy, AMM, ERC-20, diamond, etc.) |
check_token_permissions |
Check owner permissions: mint, pause, blacklist, change fees, disable trading |
get_contract_info |
Basic contract metadata: verified status, bytecode size, ETH balance, token info |
compare_bytecode |
Clone detection -- check if two contracts share the same bytecode |
audit_report |
Full security audit combining all checks into one comprehensive report |
Environment Variables
| Variable | Default | Description |
|---|---|---|
RPC_URL |
https://mainnet.base.org |
Base mainnet RPC endpoint |
How It Works
- Bytecode Analysis: Extracts PUSH4 opcodes to find function selectors, matches against 30+ known dangerous patterns
- Opcode Scanning: Detects DELEGATECALL, SELFDESTRUCT, CREATE, CREATE2
- Honeypot Detection: Simulates ETH->Token->ETH round-trip via Uniswap V2 router getAmountsOut
- Rug Scoring: Weighted algorithm combining ownership, liquidity depth, dangerous permissions, honeypot status
- Clone Detection: Jaccard similarity on function selector sets
Related MCP Servers
| Package | Tools | What it does |
|---|---|---|
obsd-launchpad-mcp |
14 | Deploy tokens, trade, earn OBSD |
base-security-scanner-mcp |
8 | Scan contracts for vulnerabilities |
base-price-oracle-mcp |
7 | On-chain price feeds from DEX pools |
base-multi-wallet-mcp |
8 | Coordinated multi-wallet trading |
base-gasless-deploy-mcp |
5 | Gasless ERC-20 token deployment |
base-flash-arb-mcp |
7 | Detect arbitrage opportunities |
base-token-sniper-mcp |
5 | Discover & trade new launches |
base-wallet-toolkit-mcp |
7 | Wallet balances, gas, tokens |
base-contract-reader-mcp |
6 | Read any smart contract (free) |
create-mcp-server-cli |
- | Scaffold a new MCP server |
License
MIT