Ctrl Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Ctrl Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <img src="hero.jpg" alt="ctrl/mcp" width="100%"> </p>
the mcp for on-chain automation. sign once, agent does the rest, forever.
ctrl is workflow automation for on-chain actions on base. you compose trigger → action → condition graphs in plain english, sign one batch to deploy a vault + spending caps, and a keeper runs your workflow under those caps forever.
this is the mcp surface. agents talk to it. users sign in their wallet.
$ claude mcp add ctrl https://ctrl.build/api/mcpor paste into your client's mcp config:
{
"mcpServers": {
"ctrl": {
"command": "npx",
"args": ["-y", "mcp-remote", "https://ctrl.build/api/mcp",
"--header", "Authorization:Bearer ${CTRL_API_KEY}"],
"env": { "CTRL_API_KEY": "sk_ctrl_..." }
}
}
}mint a key at ctrl.build/settings/api-keys.
<p align="center"> <img src="prompt.png" alt="example prompt — bankr snipe workflow" width="720"> </p>
seven tools. that's it.
| tool | what it does |
|---|---|
ctrl_get_vault_status | read user's vault address, balance, active rules |
ctrl_get_block_catalog | live list of every block + field schema |
ctrl_create_workflow | assemble + save a workflow draft from a prompt |
ctrl_activate | encode the eip-5792 batch the user signs to deploy |
ctrl_withdraw | encode the batch to pull funds out of the vault back to the user's wallet (eth, weth, or any erc-20) |
ctrl_fire_manual | fire a workflow once for testing — no waiting |
ctrl_get_execution_logs | basescan tx hashes, gas, status — keeper history |
triggers — time.interval, trigger.manual, price.above/below/change, pool.created (clanker / flaunch / zora / bankr), watch.whale, event.transfer, event.balance, trending.token
actions — cypher.swap, read.balance, notify.telegram, notify.discord, util.webhook
conditions — cond.price, cond.balance, cond.allowed_weekdays, cond.time_window
utilities — util.delay, util.note, util.log, util.stop, util.snapshot
the agent calls ctrl_get_block_catalog first to see the live shape. every block id maps 1:1 to keeper execution.
drop these into your agent and watch:
milady in the name, 0.005 eth each, auto-sell at 2x"vault-direct model. agent never holds keys.
maxPerSwap + maxPerDay. enforced by the vault contract.pauseVault() halts everything; revokeRule(id) kills one workflow. both 1-tx, user-callable.pool.created runs goplus honeypot + tax + score checks before any swap.verified contracts on base:
works with any mcp client. tested with:
~/.claude.json~/Library/Application Support/Claude/claude_desktop_config.json~/.cursor/mcp.jsonmit
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.