io.github.lordbasilaiassistant-sudo/contract-scanner

安全与合规

by lordbasilaiassistant-sudo

用于智能合约安全扫描,识别漏洞、评估风险分数,并支持 calldata 解码分析。

什么是 io.github.lordbasilaiassistant-sudo/contract-scanner

用于智能合约安全扫描,识别漏洞、评估风险分数,并支持 calldata 解码分析。

README

Thryx MCP Servers

Smart contract scanning, multi-wallet treasury, DeFi orchestration, and gas paymaster integration for AI agents on Base.

A monorepo of four MCP (Model Context Protocol) servers built for AI agents that need to actually do things on-chain — read contracts, manage wallets, execute swaps, sponsor gas — instead of just generating text about them.

All four are published to npm and combined are pulling ~850 monthly downloads as of April 2026.


Servers

PackageWhat it doesnpm
@thryx/contract-scanner-mcp-serverSolidity security scanning. Risk score 0–100, vulnerability detection (reentrancy, hidden mint, backdoors, proxy risks, access control), source verification, calldata decoder. Call this BEFORE interacting with any unfamiliar contract.npm
@thryx/multi-wallet-mcp-serverMulti-wallet management for Base/EVM. Generate, encrypt, balance-check, distribute ETH, execute coordinated swaps across many wallets at once.npm
@thryx/defi-orchestrator-mcp-serverMulti-step DeFi strategy orchestration. Simulate, execute, and monitor compound strategies across Uniswap, Aave, Aerodrome with safety rails.npm
@thryx/gas-paymaster-mcp-serverSponsored-gas integration via The Agent Cafe paymaster. Lets agents pay gas in tokens or skip gas entirely on Base mainnet.npm

Plus @thryx/mcp-shared — the shared rate-limiter, billing layer, and EVM helpers used by all four.


Install — 30 seconds per server

Add any of these to your MCP client config (Claude Desktop, Cursor, Continue, Cline, etc.):

jsonc
{
  "mcpServers": {
    "contract-scanner": {
      "command": "npx",
      "args": ["@thryx/contract-scanner-mcp-server"]
    },
    "multi-wallet": {
      "command": "npx",
      "args": ["@thryx/multi-wallet-mcp-server"]
    },
    "defi-orchestrator": {
      "command": "npx",
      "args": ["@thryx/defi-orchestrator-mcp-server"]
    },
    "gas-paymaster": {
      "command": "npx",
      "args": ["@thryx/gas-paymaster-mcp-server"]
    }
  }
}

Restart your MCP client and the servers are live.


Free + Pro tiers

Every server has a free tier with rate limits and a Pro tier with no limits and additional tools. The free tier is genuinely useful — you do not need a Pro key to evaluate the servers or use them in personal projects.

Pro keys are linked to a thryx.fun purchase. Pass yours via the api_key parameter on any tool call, or set the THRYX_API_KEY environment variable in your MCP client config.

Free-tier limits per server (subject to change):

  • contract-scanner — 5 scans/hour for scanner_analyze_contract and scanner_compare_contracts. scanner_check_address and scanner_decode_calldata are unlimited.
  • multi-wallet — read operations unlimited, write operations rate-limited.
  • defi-orchestrator — read operations unlimited, write operations rate-limited.
  • gas-paymaster — sponsored-tx counts gated by tier.

What "MCP" means if you've never heard of it

Model Context Protocol is the open standard for connecting AI assistants to real tools. Instead of an AI agent generating "I would call your API like this…", it actually calls the API. Servers like the ones in this monorepo expose capabilities to any MCP-compatible client (Claude, Cursor, Cline, Continue, etc.) without each client needing custom integration code.

If you're building an AI agent that needs to read from or write to a Base/EVM chain — these servers save you from rebuilding all of it yourself.


Bootstrapping a complete on-chain agent in two minutes

The MCP servers are tools — but tools are most useful when they have a platform to act on. THRYX (the gasless token launchpad these servers were built for) exposes an open /api/agent/register endpoint that gives any AI agent a wallet, an API key, and pre-sponsored gas in a single HTTP call. No KYC, no email verification, no account recovery flow — one call, you're live on Base mainnet.

bash
# 1. Register an agent on THRYX (one call → wallet + API key + gas)
curl -X POST https://thryx-launchpad.onrender.com/api/agent/register \
  -H "Content-Type: application/json" \
  -d '{"name": "my-agent"}'

# Response includes:
#   apiKey:  thryx_<base64url>
#   wallet:  0x...
#   gas:     "Gas is being sponsored to your wallet now (~5-10 seconds)"
jsonc
// 2. Add the @thryx/* MCP servers to your client config (with the API key from step 1)
{
  "mcpServers": {
    "contract-scanner": {
      "command": "npx",
      "args": ["@thryx/contract-scanner-mcp-server"],
      "env": { "THRYX_API_KEY": "thryx_..." }
    },
    "multi-wallet": {
      "command": "npx",
      "args": ["@thryx/multi-wallet-mcp-server"],
      "env": { "THRYX_API_KEY": "thryx_..." }
    },
    "defi-orchestrator": {
      "command": "npx",
      "args": ["@thryx/defi-orchestrator-mcp-server"],
      "env": { "THRYX_API_KEY": "thryx_..." }
    },
    "gas-paymaster": {
      "command": "npx",
      "args": ["@thryx/gas-paymaster-mcp-server"],
      "env": { "THRYX_API_KEY": "thryx_..." }
    }
  }
}

That's it. Your agent has a funded wallet on Base, can scan any contract before interacting with it (scanner_analyze_contract), can launch its own token gaslessly (POST /api/launch), can buy/sell on the THRYX bonding curves, and can withdraw earnings to any address (POST /api/agent/withdraw).

The MCP servers and the THRYX platform are designed to compose. You can use either alone — the servers work against any Base contract and the platform accepts any wallet — but together they're the fastest path from "I want to build a Base on-chain agent" to "my agent just made its first onchain trade."


Building from source

bash
git clone https://github.com/lordbasilaiassistant-sudo/mcp-servers.git
cd mcp-servers
cd shared && npm install && npm run build && cd ..
cd contract-scanner-mcp-server && npm install && npm run build && cd ..
# ... or any other server you want to work on

Each server is independently built and published. The shared package exports rate limiting, billing validation, EVM helpers, and chain configs.

Tech stack: TypeScript (strict), @modelcontextprotocol/sdk, ethers v6, zod for schema validation, vitest for tests, stdio transport. Builds with tsc only — no bundlers, no magic.


Status

  • Production for the four servers above. Live on npm, in active use by AI agents on Base mainnet.
  • In progress: token-deployer-mcp-server, webhook-worker (Cloudflare Worker for Stripe → API key delivery).
  • Roadmap: x402-based pay-per-call for the Pro tools (replacing the Stripe webhook flow with USDC micropayments — no API keys to manage, no subscriptions to revoke, agents pay per execution).

Author

Anthony Snider (drlordbasil@gmail.com) — building AI agent infrastructure on Base. Find more at thryx.fun.

License: MIT.

常见问题

io.github.lordbasilaiassistant-sudo/contract-scanner 是什么?

用于智能合约安全扫描,识别漏洞、评估风险分数,并支持 calldata 解码分析。

相关 Skills

安全专家

by alirezarezvani

Universal
热门

覆盖威胁建模、漏洞评估、安全架构设计、代码审计与渗透测试,内置 STRIDE、OWASP、加密模式和安全扫描流程,适合系统设计评审与上线前安全排查。

安全专家把威胁建模、漏洞分析到渗透测试串成一套流程,内置 STRIDE 与 OWASP 指南,做安全设计和排查更省心。

安全与合规
未扫描17.9k

安全运营

by alirezarezvani

Universal
热门

覆盖应用安全、漏洞管理与合规审计,支持代码/依赖扫描、CVE 评估、Secrets 检测和安全自动化,适合做安全基线落地、漏洞响应、审计检查与安全开发治理。

应用安全、漏洞管理和合规检查一套打通,还能自动化扫描与响应,帮团队更早发现并收敛风险。

安全与合规
未扫描17.9k

安全审计

by alirezarezvani

Universal
热门

安装前审计 Claude Code Skill 的代码执行、Prompt 注入和依赖供应链风险,支持本地目录或 Git 仓库扫描,输出 PASS/WARN/FAIL 结论及修复建议

把代码审查、漏洞扫描和合规检查串成一条线,帮团队更早发现风险,做安全治理更省心。

安全与合规
未扫描17.9k

相关 MCP Server

热门

搜索和分析 Sentry 错误报告,辅助调试。

把零散的 Sentry 错误报告变成可检索线索,帮你在海量报错里更快定位线上故障,排障调试明显省时。

安全与合规
725

为 AI agents 提供安全层:拦截 prompt injection、识别伪造 packages,并扫描漏洞风险。

给 AI Agent 补上关键安全层,能拦截 prompt 注入、识别伪造包并扫描漏洞风险,把防护前置更省心。

安全与合规
110

强化安全性的 NotebookLM MCP,集成 post-quantum encryption,提升数据防护能力。

安全与合规
68

评论