Skip to content

Contract Powers

by ofirbaranesad-agent · remote · no sign-in to list tools · v1.1.0 · published by GitHub user ofirbaranesad-agent

Who can still change this EVM contract, and what can they do to holders?

Changes · 2
CompareRegistry entry

4 tools: 2 change things and 2 only read.

Scanned Oct 21, 2026

No check matched anything in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

4 tools

Changes things 2Claude Code: ask
  • check_any_contractFree preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    Free preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry. Returns contract type, verification, name, whether it is a proxy, how many powers were found, how many owner-only functions went uncategorised, and whether an owner was found. The decision fields (which powers, the evidence, the admin address, the implementation) are withheld and listed by name. Use get_contract_powers first if the contract is already in the registry — that is free and complete.
  • recent_power_changesWhat actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    Description, as the server wrote it
    What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost. Each event carries the before and after value and the window it was detected in. Severity is one of critical / material / low. Use this to answer "has anything changed behind this contract recently?".
Only reads 2Claude Code: allow
  • get_contract_powersFull free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained …No findings

    Why it is in this group

    • The name "get_contract_powers" says "get": a word for reading.
    Description, as the server wrote it
    Full free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained power (upgrade / mint / grant-minter / pause / blacklist / seize / fees / sweep / burn-from / ownership transfer / limits) with the evidence and confidence behind it, reachable DELEGATECALL / SELFDESTRUCT / CREATE2 opcodes, and the owner-only functions the classifier could NOT categorise — which is where the unusual powers hide. Accepts an address or a symbol such as USDC or AERO.
  • list_watched_contractsList the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how ma…No findings

    Why it is in this group

    • The name "list_watched_contracts" says "list": a word for reading.
    Description, as the server wrote it
    List the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how many powers are declared, and is it covered by a bug bounty. Use this to see what is already analysed before spending a lookup. Filters are optional and combine with AND.

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 1.1.0. Values in angle brackets are yours to fill in.

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__contract-powers__list_watched_contracts",
      "mcp__contract-powers__get_contract_powers"
    ],
    "ask": [
      "mcp__contract-powers__check_any_contract",
      "mcp__contract-powers__recent_power_changes"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as contract-powers. Review it before you use it.