Koskamo

Contract Powers MCP

An MCP server that provides a registry of 58 widely-used EVM contracts across Base, Ethereum, and Polygon. It allows agents to determine who holds the administrative keys to upgradeable contracts, what privileged actions they can perform on holders, and whether a live bug bounty exists for vulnerabilities in the contract code.

Visit Ofir Baranes

Endpoint and access

No sign-in to connect and list tools. Individual tools may still need a vendor account, credentials, or permissions; check the documented prerequisites.

Contract Powers MCP logo, by Ofir BaranesCommunity listingStreamable HTTPNo sign-inEndpoint checked 2026-11-07Published by Ofir Baranes
MCP endpoint (Streamable HTTP)
https://agent.zbang.net/api/mcp
Vendor documentation

What its tools do

4 tools, grouped by the hints the server advertises. Hints are self-declared, not verified behavior.

Not annotated (4)

4 of 4 have a description · 0 of 4 declare behavior hints · 4 of 4 with parameters document them all

Checks and signals

Each line is separate evidence, not a trust score.

  • Passed Endpoint answered the live check ·
  • Availability 1 of 1 checks passed in 30 days

What you can do with it

  • Determine who holds the upgrade key for a contract
  • Identify privileged actions an admin can perform on holders
  • Check if a live bug bounty exists for a contract
  • Access contract evidence and source verification status

Source and maintenance

Community listingRegistry 1.1.0
mcp-registry: io.github.ofirbaranesad-agent/contract-powers@1.1.0Source repositoryProject website
Maintenance checked

Protocol and capabilities

Server
contract-powers 1.1.0
MCP protocol negotiated in check
2025-11-25
Tools
4 advertised
Resources
Not advertised
Resource templates
Not advertised
Prompts
Not advertised
Server-advertised capabilities
{
  "tools": {
    "listChanged": false
  }
}

Server-provided instructions

Untrusted server output shown for inspection. It is not Koskamo guidance and is excluded from knowledge search.

Answers one question about an EVM contract on Base, Ethereum or Polygon: who can still change it, and what can they do to holders. list_watched_contracts and get_contract_powers are free and complete for contracts already in the registry; check_any_contract is a free preview for any other verified address, with the decision fields withheld and named. Every claim carries its evidence. None of it is an audit: a power listed here may be governed, timelocked or renounced in ways this does not model. Built and maintained by an autonomous AI agent operated by Ofir Baranes.

Tools

4 advertised

list_watched_contracts
Advertised by the server during the last successful anonymous check.

List the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how many powers are declared, and is it covered by a bug bounty. Use this to see what is already analysed before spending a lookup. Filters are optional and combine with AND.

list_watched_contracts input schema
{
  "type": "object",
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "type": "string",
      "description": "Restrict to one chain."
    },
    "limit": {
      "type": "integer",
      "maximum": 200,
      "minimum": 1,
      "description": "Default 200."
    },
    "upgradeable": {
      "type": "boolean",
      "description": "true = only contracts whose code can still be replaced."
    },
    "single_key_admin": {
      "type": "boolean",
      "description": "true = only contracts whose admin is a plain wallet (EOA), not a contract/multisig/timelock."
    }
  }
}
get_contract_powers
Advertised by the server during the last successful anonymous check.

Full free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained power (upgrade / mint / grant-minter / pause / blacklist / seize / fees / sweep / burn-from / ownership transfer / limits) with the evidence and confidence behind it, reachable DELEGATECALL / SELFDESTRUCT / CREATE2 opcodes, and the owner-only functions the classifier could NOT categorise — which is where the unusual powers hide. Accepts an address or a symbol such as USDC or AERO.

get_contract_powers input schema
{
  "type": "object",
  "required": [
    "contract"
  ],
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "type": "string",
      "description": "Required if a symbol is ambiguous."
    },
    "contract": {
      "type": "string",
      "description": "A 0x address, or a symbol such as USDC."
    }
  }
}
check_any_contract
Advertised by the server during the last successful anonymous check.

Free preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry. Returns contract type, verification, name, whether it is a proxy, how many powers were found, how many owner-only functions went uncategorised, and whether an owner was found. The decision fields (which powers, the evidence, the admin address, the implementation) are withheld and listed by name. Use get_contract_powers first if the contract is already in the registry — that is free and complete.

check_any_contract input schema
{
  "type": "object",
  "required": [
    "address"
  ],
  "properties": {
    "chain": {
      "enum": [
        "base",
        "ethereum",
        "polygon"
      ],
      "type": "string",
      "description": "Default base."
    },
    "address": {
      "type": "string",
      "description": "0x-prefixed 20-byte address."
    }
  }
}
recent_power_changes
Advertised by the server during the last successful anonymous check.

What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost. Each event carries the before and after value and the window it was detected in. Severity is one of critical / material / low. Use this to answer "has anything changed behind this contract recently?".

recent_power_changes input schema
{
  "type": "object",
  "properties": {
    "limit": {
      "type": "integer",
      "maximum": 100,
      "minimum": 1,
      "description": "Default 25."
    },
    "contract": {
      "type": "string",
      "description": "Filter to one address or symbol."
    },
    "severity": {
      "enum": [
        "critical",
        "material",
        "low"
      ],
      "type": "string",
      "description": "Minimum severity to return."
    }
  }
}

Prompts

Not advertised

No prompt definitions available.

Resources

Not advertised

No resource definitions available.

30-day availability

Aggregated from read-only remote checks; this is not a tool-execution or security guarantee.

Successful checks
1 of 1 (100%)
Average latency
893 ms
95th percentile latency
893 ms

Maintenance history

Public check and source-refresh events. Editorial and ownership records remain private.

  • · probe · passed · 893 ms · metadata changed · 4 tool(s)

Connect from your client

Each snippet registers the same endpoint; pick the client you use.

This server is operated by the named third party. Listing and endpoint checks are not an endorsement or a security audit. Review the operator's permissions, terms, and data handling before connecting. How listings are checked and corrected.

Claude Code

Run this once in a terminal. It registers the remote server. Use --scope project to write .mcp.json for the repo.
Claude Code configuration
claude mcp add --transport http contract-powers-mcp https://agent.zbang.net/api/mcp

Codex

Run this once. Codex stores MCP servers in ~/.codex/config.toml (or .codex/config.toml in a trusted project).
Codex configuration
codex mcp add contract-powers-mcp --url https://agent.zbang.net/api/mcp

Cursor

Merge this server into .cursor/mcp.json in your project, then enable contract-powers-mcp in your MCP settings.
Cursor configuration
{
  "mcpServers": {
    "contract-powers-mcp": {
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Cline

Merge this into cline_mcp_settings.json (Cline → MCP Servers → Configure).
Cline configuration
{
  "mcpServers": {
    "contract-powers-mcp": {
      "type": "streamableHttp",
      "url": "https://agent.zbang.net/api/mcp",
      "disabled": false
    }
  }
}

VS Code

Merge this server into .vscode/mcp.json. Use MCP: List Servers to start contract-powers-mcp and inspect its tools.
VS Code configuration
{
  "servers": {
    "contract-powers-mcp": {
      "type": "http",
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Gemini CLI

Run this once. It writes .gemini/settings.json in the current project; pass --scope user for ~/.gemini/settings.json.
Gemini CLI configuration
gemini mcp add --transport http contract-powers-mcp https://agent.zbang.net/api/mcp

Claude Desktop

Open Claude Settings > Connectors > Add custom connector, enter this server URL and enable it for the conversation. This is a manual remote-connector handoff, not a desktop JSON configuration.
Claude Desktop configuration
https://agent.zbang.net/api/mcp

Windsurf

Merge this into ~/.codeium/windsurf/mcp_config.json, then refresh MCP in Cascade. Windsurf remote servers use serverUrl, not url.
Windsurf configuration
{
  "mcpServers": {
    "contract-powers-mcp": {
      "serverUrl": "https://agent.zbang.net/api/mcp"
    }
  }
}

Let your agent find its tools

Find servers like Contract Powers MCP from your agent. Add Koskamo once to search the index for endpoints, access requirements, and client setup. Public discovery needs no key.

Connect Koskamo Explore workflows
See all 8,313