io.github.Bosacks/magneta-contract-risk

Est-ce que io.github.Bosacks/magneta-contract-risk est sûr ?

Au dernier audit MCP Hub, le serveur MCP « io.github.Bosacks/magneta-contract-risk » est classé « Non encore testé ». Référencé dans l'annuaire. Seul le pentest comportemental fait foi, et il n'a pas encore été exécuté sur ce serveur. Le verdict est réévalué en continu ; consultez la fiche pour l'état à jour.

Méthode : MCP Hub analyse la description de chaque outil (couche 1) et, pour le verdict fort, exécute le serveur dans une micro-VM isolée avec leurres et réseau bloqué (couche 2). On publie des noms et des compteurs, jamais le contenu brut renvoyé par un outil.

Les 3 outils

• contract_quick_flags≈ 364 tokens

  Free, no payment: bytecode-only preview of a deployed smart contract. Covers proxy/upgradeability, ERC-20 probe (name, symbol, owner, paused), risky selectors found in the bytecode (mint, blacklist, fee/tax setters, pause, upgrade), SELFDESTRUCT/DELEGATECALL opcodes, and a partialScore/partialLevel computed from those on-chain signals only. Does NOT cover source verification (Blockscout, Sourcify) nor aderyn static analysis, so partialScore can be lower than the real risk. contract_risk_summary ($0.02 in USDC via x402) is the full report. Read-only, no side effects; an EOA is rejected; identical requests within 10 minutes return the cached result; the HTTP twin GET /v1/flags/:chainId/:address is rate limited to 30 requests per minute per IP.

  Paramètres, retour & exemple (2)

  Paramètres

  • address · string · requis
    Contract address, 0x followed by 40 hex characters
  • chainId · integer · requis
    EVM chain id, one of: 1, 10, 56, 100, 130, 137, 146, 480, 5000, 8453, 42161, 42220, 43114, 59144, 81457, 84532, 421614, 534352, 11155111, 11155420

  Exemple d'appel

  {"name": "contract_quick_flags", "arguments": {"address": "texte", "chainId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• contract_risk_summary≈ 448 tokens

  Analyze a deployed smart contract and return a deterministic risk report: 0-100 score with level (low/medium/high/critical), proxy/upgradeability, owner and pause state, risky selectors found in the bytecode (mint, blacklist, fee/tax setters, pause, upgrade), SELFDESTRUCT/DELEGATECALL opcodes, source verification (Blockscout, Sourcify) and aderyn static-analysis findings. Use it before trading, bridging, approving or integrating a token or protocol contract; Use contract_quick_flags first for a free bytecode-only preview when you are not sure the full report is worth paying for. Use supported_chains first if you are unsure the chain id is covered, and scoring_rubric to interpret the score. Paid: $0.02 in USDC on Base per call via x402. The first call answers with an x402 payment challenge; an x402-enabled client pays automatically and the same call then returns the report. Read-only, no side effects; failed analyses (not a contract, upstream data source down) are not charged; identical requests within 10 minutes return the cached report.

  Paramètres, retour & exemple (2)

  Paramètres

  • address · string · requis
    Contract address, 0x followed by 40 hex characters (an EOA is rejected without charge)
  • chainId · integer · requis
    EVM chain id, one of: 1, 10, 56, 100, 130, 137, 146, 480, 5000, 8453, 42161, 42220, 43114, 59144, 81457, 84532, 421614, 534352, 11155111, 11155420

  Exemple d'appel

  {"name": "contract_risk_summary", "arguments": {"address": "texte", "chainId": 1}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• scoring_rubric≈ 136 tokens

  Return the exact rubric behind contract_risk_summary scores: points per flag, the level thresholds and what each flag means. Free, read-only, no parameters. Call it to explain a score to a user or to decide your own threshold before acting on a report.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "scoring_rubric", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

• supported_chains≈ 134 tokens

  List the EVM chains contract_risk_summary can analyze, as { chainId, name, testnet } objects. Free, read-only, no payment and no parameters. Call it when you need to map a chain name to its id or to check coverage before paying for a report.

  Paramètres, retour & exemple (0)

  Exemple d'appel

  {"name": "supported_chains", "arguments": {}}

  Exemple de retour

  {"content": [{"type": "text", "text": "…"}]}

C'est votre serveur ?

Revendiquez-le sur l'espace créateur (preuve GitHub, domaine ou npm) pour afficher le badge « propriétaire vérifié » et lancer un pentest comportemental à la demande afin d'obtenir le badge « Vérifié ».

Créer un compte / revendiquer →

Source

https://x402.magneta.finance/mcp