ContractScan MCP Server — multi-engine Solidity vulnerability scanner for LLM agents
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"contractscan-mcp","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# ContractScan MCP Server Expose ContractScan's multi-engine Solidity vulnerability scanner as a **Model Context Protocol (MCP)** server. Once connected, any MCP-compatible AI tool (Claude Desktop, Cursor, Windsurf, Cline, …) can scan smart contracts directly from a conversation. ## Why MCP? | Tool | Engines | |------|---------| | Slither-MCP | Slither only | | Aderyn-MCP | Aderyn only | | **ContractScan MCP** | Slither + Semgrep + Mythril + AI cross-verification | ## Requirements - Python 3.11+ - `pip install contractscan-mcp` - `solc` installed (`solc-select install 0.8.20 && solc-select use 0.8.20`) ## Quick Start ### Install ```bash pip install contractscan-mcp ``` ### Test it works ```bash contractscan-mcp --help ``` --- ## IDE Setup ### Claude Desktop (macOS / Windows) Edit `~/Library/Application Support/Claude/claude_desktop_config.json` (macOS) or `%APPDATA%\Claude\claude_desktop_config.json` (Windows): ```json { "mcpServers": { "contractscan": { "command": "contractscan-mcp", "env": { "ANTHROPIC_API_KEY": "sk-ant-...", "GOOGLE_API_KEY": "AIza..." } } } } ``` Restart Claude Desktop. You should see **ContractScan** in the MCP tools list. --- ### Cursor Open **Cursor Settings → MCP** (or edit `~/.cursor/mcp.json`): ```json { "mcpServers": { "contractscan": { "command": "contractscan-mcp", "env": { "ANTHROPIC_API_KEY": "sk-ant-...", "GOOGLE_API_KEY": "AIza..." } } } } ``` Restart Cursor. ContractScan tools will appear in the Composer context. --- ### Windsurf Edit `~/.codeium/windsurf/mcp_config.json`: ```json { "mcpServers": { "contractscan": { "command": "contractscan-mcp", "env": { "ANTHROPIC_API_KEY": "sk-ant-...", "GOOGLE_API_KEY": "AIza..." } } } } ``` Restart Windsurf. ContractScan will be available in Cascade. --- ### Cline (VS Code) In VS Code, open Cline settings and add to **MCP Server…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.