BaseLens

app.vercel.baselens-api/baselensbaselens-api.vercel.appstreamable-httpv1.1.0Scanned 57 minutes ago

Base on-chain data for agents: balances, prices, transfers, Basenames, contracts. x402 pay-per-call.

11 tools: 1 do something that can't be undone, 8 change things and 2 only read.

Reads private data · 0
Reads text others write · 10
Can send data out · 0
1 finding

Anlyon alternative

9 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

11 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

base_transfersRecent ERC-20 transfers in and out of an address on Base for up to 5 tokens (default USDC), newest first, over the last ~10k blocks (max 30k).Reads text others write1 finding
Why it is in this group
- The name "base_transfers" says "transfer": a word for a change that another call does not undo.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Findings
- Warn
  The server marks "base_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
  Matched text
  annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "base_transfers" says "transfer": a word for a change that another call does not undo.
  What this check looks for
Description, as the server wrote it
Recent ERC-20 transfers in and out of an address on Base for up to 5 tokens (default USDC), newest first, over the last ~10k blocks (max 30k). Check incoming payments or wallet activity. Costs $0.004 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

Changes things 8Creates or changes something that can be changed back.Claude Code: ask

base_addressBase (chain 8453) address snapshot: EOA vs contract vs EIP-7702, ETH balance, nonce, code size and native USDC balance, at the latest block.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Base (chain 8453) address snapshot: EOA vs contract vs EIP-7702, ETH balance, nonce, code size and native USDC balance, at the latest block. Costs $0.002 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_contractContract check on Base: is it a contract, code size, owner(), proxy implementation, and whether the source (and implementation) is verified on Sourcify, plus plain-language notes.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Contract check on Base: is it a contract, code size, owner(), proxy implementation, and whether the source (and implementation) is verified on Sourcify, plus plain-language notes. Not an audit. Costs $0.003 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_erc20_balanceERC-20 balance of any address for any token on Base, with symbol and decimals already applied (raw and human-readable).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
ERC-20 balance of any address for any token on Base, with symbol and decimals already applied (raw and human-readable). Costs $0.002 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_free_gas_sampleFree sample: latest Base block number and base fee (gwei).No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it
Free sample: latest Base block number and base fee (gwei). Use it to test the connection.
Annotations the server declares
- readOnlyHint: true
base_gasCurrent Base gas: base fee, gas price, suggested EIP-1559 max fee and priority fee (gwei), block fullness, and cost of a plain ETH transfer.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Current Base gas: base fee, gas price, suggested EIP-1559 max fee and priority fee (gwei), block fullness, and cost of a plain ETH transfer. Costs $0.001 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_priceOn-chain USDC price of any Base ERC-20: executable Uniswap v3 quote for 1 whole token (direct USDC pool or via WETH, best fee tier).Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
On-chain USDC price of any Base ERC-20: executable Uniswap v3 quote for 1 whole token (direct USDC pool or via WETH, best fee tier). No third-party price API. Costs $0.003 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_tokenToken facts on Base: name, symbol, decimals, total supply, contract code size, owner() and EIP-1967 proxy implementation, plus plain-language notes (upgradeable?Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Token facts on Base: name, symbol, decimals, total supply, contract code size, owner() and EIP-1967 proxy implementation, plus plain-language notes (upgradeable? owner renounced?). Read-only facts, not advice. Costs $0.003 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true
base_txHuman-readable summary of a Base transaction: status, block time, from/to, value, total fee (incl.Reads text others writeNo findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Human-readable summary of a Base transaction: status, block time, from/to, value, total fee (incl. L1 fee), and decoded ERC-20 Transfer events with token symbols and amounts. Handy to verify a payment landed. Costs $0.003 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

Only reads 2Looks things up and changes nothing.Show 2 read-only tools

base_catalogLists every BaseLens tool with price, inputs and the equivalent x402 HTTP URL.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "list": a word for reading.
What it can reach
- untrusted-inputThe description's first sentence says "list" and "http": it reads web pages, which anyone can write.
Description, as the server wrote it
Lists every BaseLens tool with price, inputs and the equivalent x402 HTTP URL.
Annotations the server declares
- readOnlyHint: true
base_nameResolve a Basename (name.base.eth) or ENS name to its Base/Ethereum address, or reverse-resolve an address to its primary ENS/Basename.Reads text others writeNo findings
Why it is in this group
- The description's first verb is "resolve": a word for reading.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
Description, as the server wrote it
Resolve a Basename (name.base.eth) or ENS name to its Base/Ethereum address, or reverse-resolve an address to its primary ENS/Basename. Includes avatar record. Costs $0.001 USDC on Base via x402.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: true

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

No private-data, untrusted-input, outbound path in this server alone: no tool is tagged private-data or outbound.

Reads private data0: Reads files, mail, messages, databases, secrets, calendars or repositories.
Reads text others write10: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; base_address
base_catalog
base_contract
base_erc20_balance
base_gas
base_name
base_price
base_token
base_transfers
base_tx
Can send data out0: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Findings

Matches of fixed checks, with the text they matched.

1 warn

Warnbase_transfers
The server marks "base_transfers" read-only (readOnlyHint: true), and its own name, description or input give the class "irreversible".
Matched text
annotations: {"readOnlyHint":true,"openWorldHint":true}; The name "base_transfers" says "transfer": a word for a change that another call does not undo.
What this check looks for

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http baselens https://baselens-api.vercel.app/mcp

claude mcp add --transport http baselens https://baselens-api.vercel.app/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__baselens__base_name",
      "mcp__baselens__base_catalog"
    ],
    "ask": [
      "mcp__baselens__base_address",
      "mcp__baselens__base_erc20_balance",
      "mcp__baselens__base_token",
      "mcp__baselens__base_tx",
      "mcp__baselens__base_gas",
      "mcp__baselens__base_price",
      "mcp__baselens__base_transfers",
      "mcp__baselens__base_contract",
      "mcp__baselens__base_free_gas_sample"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as baselens. Review it before you use it.

Capability tags behind 10 rules

mcp__baselens__base_address untrusted-input
mcp__baselens__base_erc20_balance untrusted-input
mcp__baselens__base_token untrusted-input
mcp__baselens__base_tx untrusted-input
mcp__baselens__base_gas untrusted-input
mcp__baselens__base_name untrusted-input
mcp__baselens__base_price untrusted-input
mcp__baselens__base_transfers untrusted-input
mcp__baselens__base_contract untrusted-input
mcp__baselens__base_catalog untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/app.vercel.baselens-api/baselens/verify?hash=f320603b3a29ce84e69a63183809332375d6fcad0c709a7f82b72a45a606e2cb" | jq -e '.changed == false'

Pinned hash f320603b3a29, from Oct 30, 2026, 14:17 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/app.vercel.baselens-api/baselens/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/app.vercel.baselens-api/baselens.svg)](https://anlyon.dev/servers/app.vercel.baselens-api/baselens)

Source: MCP Registry. Synced Oct 30, 2026, 14:17 UTC.