Skip to content

Magneta Contract Risk

by Bosacks · remote · no sign-in to list tools · v0.1.1 · published by GitHub user Bosacks

Smart-contract risk reports for AI agents on 20 EVM chains, paid per call via x402 ($0.02 USDC).

Changes · 1
CompareRegistry entry

4 tools: 1 change things and 3 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http magneta-contract-risk https://x402.magneta.finance/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 1Claude Code: ask
  • contract_quick_flagsFree, no payment: bytecode-only preview of a deployed smart contract.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
    Description, as the server wrote it
    Free, no payment: bytecode-only preview of a deployed smart contract. Covers proxy/upgradeability, ERC-20 probe (name, symbol, owner, paused), risky selectors found in the bytecode (mint, blacklist, fee/tax setters, pause, upgrade), SELFDESTRUCT/DELEGATECALL opcodes, and a partialScore/partialLevel computed from those on-chain signals only. Does NOT cover source verification (Blockscout, Sourcify) nor aderyn static analysis, so partialScore can be lower than the real risk. contract_risk_summary ($0.02 in USDC via x402) is the full report. Read-only, no side effects; an EOA is rejected; identical requests within 10 minutes return the cached result; the HTTP twin GET /v1/flags/:chainId/:address is rate limited to 30 requests per minute per IP.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
Only reads 3Claude Code: allow
  • contract_risk_summaryAnalyze a deployed smart contract and return a deterministic risk report: 0-100 score with level (low/medium/high/critical), proxy/upgradeability, owner and pause state, risky sele…No findings

    Why it is in this group

    • The description's first verb is "analyze": a word for reading.
    Description, as the server wrote it
    Analyze a deployed smart contract and return a deterministic risk report: 0-100 score with level (low/medium/high/critical), proxy/upgradeability, owner and pause state, risky selectors found in the bytecode (mint, blacklist, fee/tax setters, pause, upgrade), SELFDESTRUCT/DELEGATECALL opcodes, source verification (Blockscout, Sourcify) and aderyn static-analysis findings. Use it before trading, bridging, approving or integrating a token or protocol contract; Use contract_quick_flags first for a free bytecode-only preview when you are not sure the full report is worth paying for. Use supported_chains first if you are unsure the chain id is covered, and scoring_rubric to interpret the score. Paid: $0.02 in USDC on Base per call via x402. The first call answers with an x402 payment challenge; an x402-enabled client pays automatically and the same call then returns the report. Read-only, no side effects; failed analyses (not a contract, upstream data source down) are not charged; identical requests within 10 minutes return the cached report.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: true
  • scoring_rubricReturn the exact rubric behind contract_risk_summary scores: points per flag, the level thresholds and what each flag means.No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Return the exact rubric behind contract_risk_summary scores: points per flag, the level thresholds and what each flag means. Free, read-only, no parameters. Call it to explain a score to a user or to decide your own threshold before acting on a report.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false
  • supported_chainsList the EVM chains contract_risk_summary can analyze, as { chainId, name, testnet } objects.No findings

    Why it is in this group

    • The description's first verb is "list": a word for reading.
    Description, as the server wrote it
    List the EVM chains contract_risk_summary can analyze, as { chainId, name, testnet } objects. Free, read-only, no payment and no parameters. Call it when you need to map a chain name to its id or to check coverage before paying for a report.

    Annotations the server declares

    • readOnlyHint: true
    • destructiveHint: false
    • idempotentHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 0.1.1. Values in angle brackets are yours to fill in.

claude mcp add --transport http magneta-contract-risk https://x402.magneta.finance/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__magneta-contract-risk__contract_risk_summary",
      "mcp__magneta-contract-risk__supported_chains",
      "mcp__magneta-contract-risk__scoring_rubric"
    ],
    "ask": [
      "mcp__magneta-contract-risk__contract_quick_flags"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as magneta-contract-risk. Review it before you use it.