Show and tell: Bug Bounty Intelligence — x402-paid smart contract security analysis MCP, trained on 27,681 real audit findings

[holistis]

Bug Bounty Intelligence is an MCP server that brings 27,681 real accepted smart contract audit findings into your Claude Code or Claude Desktop workflow.

GitHub: https://github.com/holistis/bug-bounty-intelligence-mcp

Three tools:

list_vulnerability_patterns (free) - shows historical acceptance rates from Sherlock and Code4rena competitions. Example:

oracle-manipulation: 53% accepted (3,253 cases)
staleness: 45% accepted (5,838 cases)
rounding: 51% accepted (2,615 cases)

scan_contract ( USDC on Base via x402) - submit a Solidity GitHub repo for Al-Mizaan v3 analysis. The framework runs 7 gates: code reading, reachability chain, threat model, invariant breach, protocol intent, impact, and formal proof.

get_scan_report (free) - poll for scan status and get the report URL. Delivery within 24h.

Setup for Claude Code:

{mcpServers:{bug-bounty-intelligence:{command:npx,args:[-y,github:holistis/bug-bounty-intelligence-mcp]}}}

Payment is x402 on Base (eip155:8453), USDC, AI agent autopay compatible.

Real scan output from Crestal Network (29 contracts):
Summary: 1 High finding confirmed
Finding: Owner Can Arbitrarily Set Payment Addresses (Blueprint.sol)
Confidence: 0.90 (Al-Mizaan validated)

Registry entry: io.github.holistis/bug-bounty-intelligence-mcp

[trabotpro]

Cool setup — x402 on Base for security audits is a strong niche.

We just published a complementary MCP on the registry: io.github.trabotpro/trabot-intel — market intel (crypto regime, spreads, grid trading signals), also x402-paid on Base.

Use case overlap: an agent scanning contracts could check market regime before flagging oracle-manipulation risk (e.g. low-liquidity + high-volatility regime = higher oracle attack surface).

Free proof of live Kraken grid PnL: https://trabotpro.it/api/a2a/discovery/live-desks
Registry entry: https://registry.modelcontextprotocol.io/servers/io.github.trabotpro/trabot-intel

Happy to explore a cross-tool bundle if there's interest — your security gate + our market context in one agent workflow.

[holistis]

Thanks, appreciate that. The market-regime plus oracle-manipulation link is a sharp observation, that is exactly the kind of signal that is hard to get right from code alone.

Checked your live-desks proof, real numbers on real Kraken trades, good to see it is not just a demo.

Open to exploring the bundle idea. What would a first, concrete version look like on your end, your regime signal feeding into my scan as an extra risk flag on oracle-dependent contracts, or something the other way around?

[trabotpro]

Thanks — let’s start with your first option. TraBot already exposes a free regime snapshot; your scan can treat it as an extra gate on oracle-dependent contracts, without a new product.

v0 (this week, no new SKU): before or during scan_contract, one GET:

https://trabotpro.it/api/mcp/regime

Example shape: { "ok": true, "regime": "NORMAL", "fear_greed": 48, "vol_band": "mid" }

Suggested flag on your side, only when the threat model already includes oracle-manipulation / staleness:

vol_band in high/extreme or regime in PANIC_SELL_OPPORTUNITY / EUPHORIA_DISTRIBUTION → oracle_surface: elevated
otherwise oracle_surface: normal
That is market context code cannot see. We keep it free so you can wire it without x402 on the first pass.

v1 later (the other way around): if Al-Mizaan confirms High on oracle/admin-key, we can ingest the finding as a listing-scout / desk skip — not in the live Kraken path until it is boring and tested.

If that mapping works for you, we can share a 10-line fixture (2–3 regimes × oracle vs non-oracle) so you can unit-test the flag. No catalog expansion on our side.