Contract Auditor — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Contract Auditor (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Quick-scan a smart contract for rug / honeypot / centralization risk before you approve or send funds.
contract-auditor is an MCP server and a pay-per-call x402 HTTP API. Give it a deployed contract address + chain (or raw Solidity source) and it returns a SAFE / CAUTION / HIGH-RISK verdict with an explained risk score.
It combines three things an AI agent can't gather on its own from a chat:
⚠️ Heuristic quick-scan, not a formal audit. Absence of findings is not proof of safety. Always do your own research before sending funds.
| 🔁 Upgradeable proxy | EIP-1967 / 1167 / beacon — the owner can replace the audited code |
| 👑 Owner powers | mint, pause, blacklist, owner-adjustable fees/tax, max-tx limits, trading on/off, withdraw/sweep |
| 💀 Dangerous primitives | selfdestruct, delegatecall, tx.origin auth, arbitrary external calls, inline assembly |
| 🍯 Honeypot signals | can't-sell patterns: blacklist + uncapped tax + trading switch + wallet/tx caps |
| 🔓 Owner status | live on-chain: renounced, single EOA (one key), or multisig/timelock? |
| ❓ Unverified | no verified source on Sourcify = you can't read what you're trusting |
{
"mcpServers": {
"contract-auditor": { "command": "npx", "args": ["-y", "contract-auditor-mcp"] }
}
}Tool: `audit_contract` — params: address, chain (alias or chainId), source (optional raw Solidity), deep (boolean).
Or connect over HTTP at POST /mcp.
GET https://contract-auditor-ivory.vercel.app/audit?address=0xdAC17F958D2ee523a2206206994597C13D831ec7&chain=ethereum
GET https://contract-auditor-ivory.vercel.app/audit?address=0x...&chain=baseSupported chains: ethereum, base, optimism, arbitrum, polygon, bsc, avalanche, gnosis, celo (or a numeric chainId). Free tier is rate-limited to 30 requests/hour/IP.
The /pro/audit route is gated by x402. Your agent pays $0.25 USDC per call automatically — no sign-up, no API key — settling on-chain (USDC on Base) to the operator wallet.
GET /pro/audit?address=0x...&chain=ethereum # 402 → pay → result(chainId, address). If a contract is only verified on a native explorer and not mirrored to Sourcify, it shows as unverified here — pass the source directly to scan it.MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.