← Back to search

io.github.CSOAI-ORG/blockchain-ai-mcp

CSOAI-ORG Scanned 15d ago

MCP server for blockchain ai. Features wallet analyzer, transaction tracer, smart contract a...

C
72.4 / 100

Versions

1.0.1latest
first seen Jun 5, 2026
1.0.4
first seen May 19, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 5

wallet_analyzer
annotations: none low

Analyze an Ethereum wallet's transaction history, portfolio, and risk profile. Args: address: Ethereum wallet address (0x...) transactions: Transaction history as [{"from": "0x...", "to": "0x...", "value": 1.5, "type": "transfer", "date": "2026-01-01"}] token_balances: Token holdings as [{"token": "USDC", "balance": 1000, "value_usd": 1000}] Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards. When NOT to use: Not suitable for real-time production decision-making without human review of results.

address str api_key str transactions string token_balances string
transaction_tracer
annotations: none low

Trace a transaction's full execution path including internal calls and token transfers. Args: tx_hash: Transaction hash (0x...) from_addr: Sender address to_addr: Receiver/contract address value: ETH value transferred internal_txns: Internal transactions as [{"from": "0x", "to": "0x", "value": 0.1, "type": "call"}] token_transfers: Token transfers as [{"token": "USDC", "from": "0x", "to": "0x", "amount": 100}] Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards. When NOT to use: Not suitable for real-time production decision-making without human review of results.

value float api_key str to_addr str tx_hash str from_addr str internal_txns string token_transfers string
smart_contract_auditor
annotations: none low

Audit Solidity smart contract source code for common vulnerabilities including reentrancy, overflow, access control, and more. Args: source_code: Solidity source code to audit contract_name: Name of the contract Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards. When NOT to use: Not suitable for real-time production decision-making without human review of results. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

api_key str source_code str contract_name str
gas_estimator
annotations: none low

Estimate gas costs for common blockchain operations with priority-based pricing and USD conversion. Args: operation: Operation type (transfer_eth, erc20_transfer, erc20_approve, uniswap_swap, nft_mint, nft_transfer, contract_deploy, multisig_tx, defi_deposit, defi_withdraw) gas_price_gwei: Current gas price in Gwei eth_price_usd: Current ETH price in USD priority: Transaction priority (low, medium, high, urgent) Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards. When NOT to use: Not suitable for real-time production decision-making without human review of results. Behavioral Transparency: - Side Effects: This tool is read-only and produces no side effects. It does not modify any external state, databases, or files. All output is computed in-memory and returned directly to the caller. - Authentication: No authentication required for basic usage. Pro/Enterprise tiers require a valid MEOK API key passed via the MEOK_API_KEY environment variable. - Rate Limits: Free tier: 10 calls/day. Pro tier: unlimited. Rate limit headers are included in responses (X-RateLimit-Remaining, X-RateLimit-Reset). - Error Handling: Returns structured error objects with 'error' key on failure. Never raises unhandled exceptions. Invalid inputs return descriptive validation errors. - Idempotency: Fully idempotent — calling with the same inputs always produces the same output. Safe to retry on timeout or transient failure. - Data Privacy: No input data is stored, logged, or transmitted to external services. All processing happens locally within the MCP server process.

api_key str priority str operation str eth_price_usd float gas_price_gwei float
token_metadata
annotations: none low

Analyze token metadata including supply distribution, holder concentration, and risk assessment. Args: address: Token contract address (0x...) chain: Blockchain network (ethereum, polygon, arbitrum, etc.) supply_data: Supply info as {"total_supply": N, "circulating_supply": N, "max_supply": N, "name": "X", "type": "ERC-20"} holder_data: Holder info as {"total_holders": N, "top_holders": [{"address": "0x", "percentage": 10.5}]} Behavior: This tool is read-only and stateless — it produces analysis output without modifying any external systems, databases, or files. Safe to call repeatedly with identical inputs (idempotent). Free tier: 10/day rate limit. Pro tier: unlimited. No authentication required for basic usage. When to use: Use this tool when you need structured analysis or classification of inputs against established frameworks or standards. When NOT to use: Not suitable for real-time production decision-making without human review of results.

chain str address str api_key str holder_data dict supply_data dict

Permissions 3

network medium
Server uses network capabilities via: urllib
filesystem low
Server uses filesystem capabilities via: os
env_vars low
Server uses env_vars capabilities via: os.environ

Scan Findings 32

low
Tool 'wallet_analyzer' has no annotations annotation_checker · 100%
low
Tool 'transaction_tracer' has no annotations annotation_checker · 100%
low
Tool 'smart_contract_auditor' has no annotations annotation_checker · 100%
low
Tool 'gas_estimator' has no annotations annotation_checker · 100%
low
Tool 'token_metadata' has no annotations annotation_checker · 100%
high
Remote transport without authentication auth_checker · 70%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-3qhf-m339-9g5v) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-9h52-p55h-vw2f) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-j975-95f5-7wqh) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-jpw9-pfvf-9f58) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (GHSA-vj7q-gjh5-988w) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1616) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1617) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-1618) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3482) dependency_analyzer · 95%
medium
Vulnerable dependency: mcp@1.0.0 (PYSEC-2026-3483) dependency_analyzer · 95%
info
package.json metadata manifest_parser · 100%
info
pyproject.toml metadata manifest_parser · 100%
info
Tool: wallet_analyzer manifest_parser · 90%
info
Tool: transaction_tracer manifest_parser · 90%
info
Tool: smart_contract_auditor manifest_parser · 90%
info
Tool: gas_estimator manifest_parser · 90%
info
Tool: token_metadata manifest_parser · 90%
info
Transport: streamable-http manifest_parser · 80%
info
Required env vars (5) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 80%
low
Permission: filesystem access detected permission_analyzer · 70%
low
Permission: env_vars access detected permission_analyzer · 90%
info
No dependency files found for SBOM generation sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%