English Français العربية

io.github.holistis/3ilm-mcp

Registre officiel Recherche et web

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

NPM package 3ilm-mcp
Claude Code 
claude mcp add 3ilm-mcp -- npx -y 3ilm-mcp@1.0.1
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "3ilm-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "3ilm-mcp@1.0.1"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. 3ilm MCP Server
  2. What it is
  3. Tools
  4. Install
  5. Add to Claude / Cursor
  6. Example queries
  7. Data source
  8. How this relates to bug-bounty-intelligence-mcp
  9. Related
  10. License

3ilm MCP Server

MCP server exposing 3ilm, a curated knowledge base of 1,032 smart contract vulnerability findings from 10 fully-reconciled Sherlock audit contests.

Built for AI agents, security researchers, and audit tools that need structured data on which bug classes get paid, at what rates, and why.

What it is

3ilm (Arabic: علم, "knowledge") contains:

  • 1,032 verified findings from 10 Sherlock contests (fully reconciled against contest outcomes)
  • 12 vulnerability pattern categories with real acceptance rates, not estimates
  • Accepted and rejected examples per category, to learn what passes triage

Tools

ToolDescription
search_vulnerabilitiesKeyword search across all 12 categories. Returns matching patterns with acceptance rates and examples.
get_pattern_detailsFull stats table for one specific pattern: totals, acceptance rate, Sherlock-specific note, examples.
list_patternsAll 12 patterns ranked by volume with 🟢🟡🔴 acceptance indicators.

Install

npx 3ilm-mcp

Add to Claude / Cursor

Claude Desktop (add to claude_desktop_config.json):

{
  "mcpServers": {
    "3ilm": {
      "command": "npx",
      "args": ["-y", "3ilm-mcp"]
    }
  }
}

Cursor (add to .cursor/mcp.json):

{
  "mcpServers": {
    "3ilm": {
      "command": "npx",
      "args": ["-y", "3ilm-mcp"]
    }
  }
}

Example queries

Ask your AI assistant:

  • "What is the acceptance rate for oracle manipulation findings on Sherlock?"
  • "Show me all vulnerability patterns and their payout rates"
  • "Search for reentrancy vulnerabilities: what percentage get accepted?"
  • "What does a accepted flash loan finding look like vs a rejected one?"

Data source

Same underlying dataset as vulnerability-acceptance-rates.json, CC0, downloadable directly, no server required. That file is the canonical, publicly reproducible source; the numbers here are copied from it, not independently computed. Findings are reconciled against actual contest outcomes, no scraping, no estimates. See METHODOLOGY.md for the exact reconciliation method.

The 12 patterns: fee-miscalculation, dos-griefing, reentrancy, trusted-actor, overflow, staleness, rounding, access-control, oracle-manipulation, mev-slippage, liquidation, flash-loan.

How this relates to bug-bounty-intelligence-mcp

Both MCP servers read the same verified data. They differ in scope:

3ilm-mcp (this repo)bug-bounty-intelligence-mcp
Pattern search / acceptance ratesFreeFree (list_vulnerability_patterns)
Full-repo contract scanNot offered$5 USDC via x402 (scan_contract)
CostAlways free, no paid tierFree tools + one paid tool
Best forJust want the pattern data via MCP, nothing elseAlso want an actual scan of your own contracts

If you only need to query acceptance rates, either server works identically for that. Use 3ilm-mcp if you want the smaller, free-only package; use bug-bounty-intelligence-mcp if you also want the paid full-repo scan tool.

  • HTTP API (pay-per-query, USDC on Base): https://wazir-x402.duckdns.org/api/vuln-search?q=oracle
  • x402 Tollbooth: all endpoints listed at /api/status

License

MIT

Questions fréquentes

Qu'est-ce que io.github.holistis/3ilm-mcp ?

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Comment installer io.github.holistis/3ilm-mcp ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add 3ilm-mcp -- npx -y 3ilm-mcp@1.0.1. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour io.github.holistis/3ilm-mcp ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

io.github.holistis/3ilm-mcp est-il open source ?

Oui. Son code est sur GitHub sous licence MIT.

Qui maintient io.github.holistis/3ilm-mcp ?

Il est publié par holistis. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.