{
  "markdown": "# Bug Bounty Intelligence — MCP Server\n\nAI-powered smart contract security analysis for AI agents and developers.\n\n**Drawn from a corpus of 27,681 submitted findings across 105 Sherlock and Code4rena contests.**\n**Cost: $5 USDC on Base (eip155:8453) via x402.**\n**Free tool: `list_vulnerability_patterns` — no payment needed.**\n\n`list_vulnerability_patterns`' acceptance-rate numbers are computed only from the subset where\nresults could be exactly reconciled against Sherlock's own published outcomes — 1,032 findings\nacross 10 contests. We'd rather show fewer, verified numbers than a bigger set we can't stand\nbehind. See [METHODOLOGY.md](METHODOLOGY.md) for exactly why, and how to reproduce it.\n\n## Free dataset — no server, no MCP, no payment\n\n[`vulnerability-acceptance-rates.json`](vulnerability-acceptance-rates.json) is the same data\n`list_vulnerability_patterns` serves, as a static file. No API call, no account, no network\ndependency at all — download it, or copy it into your own tool's rule set. CC0 licensed, use it\nhowever you want, credit optional.\n\n```bash\ncurl -sO https://raw.githubusercontent.com/holistis/bug-bounty-intelligence-mcp/main/vulnerability-acceptance-rates.json\n```\n\nIf you're building a local-first / offline security scanner and the paid `scan_contract` tool\nbelow isn't a fit for your project's architecture, this file might still be useful on its own.\n\n## Just want pattern search, nothing paid? Use 3ilm-mcp instead\n\n[3ilm-mcp](https://github.com/holistis/3ilm-mcp) is a smaller, free-only MCP server built from\nthe same verified dataset. It has no paid tier at all — just pattern search\n(`search_vulnerabilities`, `get_pattern_details`, `list_patterns`). Use this repo\n(bug-bounty-intelligence-mcp) if you also want the paid `scan_contract` full-repo scan; use\n3ilm-mcp if you only ever wanted the free lookup tools and prefer the lighter package.\n\n## Benchmark: vs Slither\n\n**[See the full benchmark →](BENCHMARK.md)**\n\nOn 3FLabs/grunt (ERC-4626 + Morpho vaults, 218 contracts): Slither reports 27 \"High\" findings. After analysis: 24 are in `lib/solady` (out-of-scope dependency with known Slither false positive patterns), and 3 are EIP-712 design patterns. False positive rate: **100%**.\n\nBug Bounty Intelligence scopes to `src/` only and filters through the Al-Mizaan 7-gate framework before reporting anything.\n\nWe also reported a related `divide-before-multiply` pattern on the same `lib/solady` code directly to the Slither project — [crytic/slither#3039](https://github.com/crytic/slither/issues/3039). A maintainer merged a fix for part of it ([crytic/slither#3040](https://github.com/crytic/slither/pull/3040)); see [BENCHMARK.md](BENCHMARK.md) for the honest scope of what that fix does and doesn't cover, we overclaimed in the original report.\n\n## What it does\n\nSubmit a public GitHub repo containing Solidity smart contracts. Receive a full vulnerability report within 24 hours, powered by the Al-Mizaan v3 analysis framework.\n\n## Tools\n\n| Tool | Description | Cost |\n|------|-------------|------|\n| `scan_contract` | Submit repo for security analysis | $5 USDC |\n| `get_scan_report` | Poll status and get report URL | Free |\n| `list_vulnerability_patterns` | Show acceptance rates from exact-reconciled Sherlock contests | Free |\n\n## Quick start (Claude Desktop / Claude Code)\n\nAdd to your `claude_desktop_config.json`:\n\n```json\n{\n  \"mcpServers\": {\n    \"bug-bounty-intelligence\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"bug-bounty-intelligence-mcp@latest\"]\n    }\n  }\n}\n```\n\nOr run directly:\n\n```bash\nnpx -y bug-bounty-intelligence-mcp@latest\n```\n\n## Payment\n\nIf `scan_contract` returns `PAYMENT REQUIRED`, send exactly $5 USDC on Base to the address shown, then retry. Payment = acceptance of [service terms](https://wazir-x402.duckdns.org/terms).\n\n**x402 info:**\n- Network: Base mainnet (eip155:8453)\n- Amount: 5,000,000 (= 5 USDC, 6 decimals)\n- Asset: 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913 (USDC)\n- Wallet: 0xdffcC75a674257be6FE1b5549FE52e8f8a6A3A5A\n\n## Example session\n\n```\n> list_vulnerability_patterns({ protocol_type: \"LENDING\" })\n\nVulnerability patterns for LENDING protocols (from Sherlock audit findings, exact-reconciled contests only):\n\noracle-manipulation      36% accepted (131 cases)\nliquidation              29% accepted (14 cases)\nstaleness                49% accepted (174 cases)\nrounding                 40% accepted (63 cases)\nflash-loan               46% accepted (13 cases)\naccess-control           47% accepted (74 cases)\n\n> scan_contract({ repo_url: \"https://github.com/myprotocol/contracts\", protocol_type: \"LENDING\" })\n\nPAYMENT REQUIRED to start the scan.\n\nAmount:  5.00 USDC\nNetwork: Base mainnet (eip155:8453)\nPay to:  0xdffcC75a674257be6FE1b5549FE52e8f8a6A3A5A\nAsset:   USDC — 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913\n\nAfter paying, retry scan_contract with the same repo_url.\n```\n\n## Sample scan output\n\nReal scan of `sherlock-audit/2025-03-crestal-network` (Derivatives protocol, 29 contracts):\n\n```\nSummary: 0 Critical  |  1 High  |  0 Medium  |  0 Low\nAnalyzed: 29 contracts  |  Model: qwen2.5:7b  |  Duration: 25min\n\nFINDING #1 — HIGH\nTitle:    Owner Can Arbitrarily Set Payment Addresses\nFile:     Blueprint.sol\nFunctions: setCreateAgentTokenCost, setUpdateCreateAgentTokenCost,\n           addPaymentAddress, removePaymentAddress\nCategory: ACCESS\n\nDescription:\n  The owner can arbitrarily set payment addresses and costs without\n  any external validation or timelock.\n\nAttack path:\n  An attacker with ownership calls setCreateAgentTokenCost or\n  addPaymentAddress to modify fees or redirect user payments to\n  an attacker-controlled wallet.\n\nImpact:\n  Extremely high costs (griefing) or redirection of user funds.\n\nRecommendation:\n  Implement a governance mechanism or timelock to restrict fee\n  and address changes.\n\nConfidence: 0.90 (CONFIRMED by Al-Mizaan validation)\n```\n\n## About the analysis\n\nThe Al-Mizaan v3 framework checks 7 gates:\n\n1. Code reading (literal, not docs)\n2. Reachability chain (entry to exploit)\n3. Threat model (who can trigger it)\n4. Invariant breach (what rule is violated)\n5. Protocol intent (was this intended?)\n6. Impact (real financial damage)\n7. Formal proof (reproducible PoC)\n\nOnly findings that survive all 7 gates are reported.\n\n## Service info\n\n- **API endpoint**: https://wazir-x402.duckdns.org/api/bug-intel\n- **Terms**: https://wazir-x402.duckdns.org/terms\n- **Delivery**: within 24h\n- **Source code**: deleted after analysis\n\n## Support this project\n\nThis is a free, open-source MCP server maintained in my spare time. If it caught something useful before you shipped, tips are welcome and appreciated (never expected):\n\n`0xdffcC75a674257be6FE1b5549FE52e8f8a6A3A5A` (USDC, Base)\n",
  "bytes": 6724,
  "sha": "159f649ba4cc5a6e995cd953d6f8cfbce42a991f8b6b1bcfeb7ca007c2b5d10f",
  "repo_slug": "holistis/bug-bounty-intelligence-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_holistis_bug_bounty_intelligen_4edbb6cb/readme"
}