English Français العربية

io.github.RealSpap/authority-risk-mcp

Registre officiel IA et agents

Read-only tools for AI agents: who can change a smart contract, how fast. Signed data, testnet.

Code source Documentation

Installation

Ajoutez ceci à la configuration MCP de votre client (Claude Desktop : claude_desktop_config.json ; Cursor : .cursor/mcp.json ; VS Code et les autres utilisent la même forme « mcpServers »).

PYPI package authority-risk-mcp
Claude Code 
claude mcp add authority-risk-mcp -- uvx authority-risk-mcp==0.1.0
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "authority-risk-mcp": {
            "command": "uvx",
            "args": [
                "authority-risk-mcp==0.1.0"
            ]
        }
    }
}
NPM package authority-risk-mcp
Claude Code 
claude mcp add authority-risk-mcp -- npx -y authority-risk-mcp@0.1.0
Configuration JSON (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "authority-risk-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "authority-risk-mcp@0.1.0"
            ]
        }
    }
}

Documentation

Tirée du README du projet sur GitHub, actualisée chaque semaine. Les liens ouvrent GitHub.

Sommaire
  1. Authority Risk Oracle
  2. Three commands
  3. Two ways in
  4. Everything else
  5. Licences

Authority Risk Oracle

Who can really move a DeFi protocol's funds? Read the answer on-chain, and check it yourself.

A DeFi contract that can be upgraded or reconfigured has someone who can do it: a key, a multisig, a vote. This project reads from public chain state who that is, how fast they can act and what stands in the way (keys, a multisig, a timelock), and publishes the answer as a score that any contract can read on-chain, so a lending market, a DAO or a wallet does not have to trust anyone's website. It measures exposure, not the chance of an attack: we read 55 incident write-ups, 7 were about who controls a contract, and our published requirements flagged 2 of them (what the score says and does not say). Live on testnets today. Not an audit, not investment advice.

Don't trust us. Redo it. Command 1 below re-reads the chain and compares it with what we publish: no key, public RPCs, about ten seconds. The output shown is the run of 22 October 2026; the readings of the day may have moved. A difference is useful, see CONTRIBUTING.md.

Three commands

1. Check our numbers against the chain (no key, public RPCs, about ten seconds). The script reads the chain with its own code, separate from the Watch's, so a difference is worth checking. Output of the run of 22 October 2026:

git clone https://github.com/RealSpap/authority-risk-oracle-showcase && cd authority-risk-oracle-showcase
python3 scripts/prove.py
OK         8 oracles: targets per oracle on the chain = Watch (63 + 39 + 13 + 13 + 14 + 9 + 9 + 16)
OK         176 targets: six sub-scores, push date and methodology hash identical on the chain and in the Watch
OK         Solana (devnet): 26 accounts read, scores and hash identical to the Watch's
OK         8 EVM oracles: methodology hash, target count and push date = CHANGELOG (1 target(s) keep an older hash, which the CHANGELOG says)
OK         README example: getScore(0x1f7d…2efa) = 80, 100, 75, 100, 80, 85
OK         api/scores.json = the chain (63 Robinhood targets)
OK         back-test: 55 incidents read, 7 are about who controls a contract: 2 flagged, 2 missed, 3 not measurable; rate 2/7 flagged (2/4 of the measurable cases)
OK         Authority Facts v0.1: 202 JSON twins of the site conform (conformance.py)
8 OK, 0 DIFFERENCE, 0 UNREAD in 3 s. Does not prove: that the scores are right, that they predict an incident, that the oracles' administrator keys are safe.

2. Read a score from the chain (needs Foundry; Robinhood Chain testnet, a tracked Uniswap v3 factory):

cast call 0x9BF45734D09bC7CA39238e767B2af9AAc62a7f52 \
  "getScore(address)(uint8,uint8,uint8,uint8,uint8,uint8,uint64,bytes32)" \
  0x1f7d7550B1b028f7571E69A784071F0205FD2EfA \
  --rpc-url https://rpc.testnet.chain.robinhood.com/rpc
# adminKey, multisig, timelock, oracleAuthority, crossExposure, composite, lastUpdated, methodologyHash
# 80, 100, 75, 100, 80, 85, 1792448928, 0x7a8280d6...   (read live on 2026-10-22; the last two values change at every push)

3. Gate a decision on a label in 14 lines:

python3 integrations/authority_facts_gate.py https://realspap.github.io/oracle/p/robinhood-0x1f7d7550b1b028f7571e69a784071f0205fd2efa.json

Two ways in

If you decide: delegates, risk managers, DAO committeesIf you build: developers, integrators
1. Open the dashboard: 202 contracts on 9 chains, the money behind them where one was read, the delay before a change applies.1. Read a score from a contract: getScore(address) and isStale(address), as in command 2 (ExampleConsumer.sol).
2. Read one contract's label: who can move it, how many keys, how long everyone else has to react, what was not read. The format is open: Authority Facts v0.1.2. Gate on a label in 14 lines (command 3): integrations/authority_facts_gate.py.
3. Follow a protocol on every chain: one Atom feed per protocol, or, after bash scripts/watch_branch.sh prepare (it fetches the Watch's data), python3 scripts/brief.py morpho-blue for a one-page brief.3. Put it in CI: uses: RealSpap/authority-risk-oracle-showcase@main with chain, address, min-score (action.yml), or an agent through the local MCP server.

Everything else

Reference (what it scores, deployed oracles, how it works, limits) · All the tools · Methodology · How it compares · Operate it · What a score says and does not say

The score reads exposure, how much one compromise can do. It does not predict who gets hit. Submitted to Colosseum's Crypto World's Fair on 12 October 2026. Code MIT, data and text CC BY 4.0: see Licences below.

Licences

WhatLicenceFile
Code: scripts/, chains/, src/, tests and workflowsMITLICENSE-CODE
The MCP package (packages/authority-risk-mcp)MIT, with its own license filepackages/authority-risk-mcp/LICENSE
The Watch files (watch/, the watch-data branch)CC BY 4.0LICENSE
The share pages and their JSON twins (/oracle/p/)CC BY 4.0LICENSE
Notes, METHODOLOGY and the other textsCC BY 4.0LICENSE
Datasets (data/, the score history)CC BY 4.0LICENSE
The specification text in docs/CC0, as the document itself saysthe document

Attribution for data and text: "Authority Risk Oracle, realspap.github.io/oracle" with a link. Earlier copies were released under the MIT licence.

Questions fréquentes

Qu'est-ce que io.github.RealSpap/authority-risk-mcp ?

Read-only tools for AI agents: who can change a smart contract, how fast. Signed data, testnet.

Comment installer io.github.RealSpap/authority-risk-mcp ?

Il s'exécute sur votre machine. Dans Claude Code : claude mcp add authority-risk-mcp -- uvx authority-risk-mcp==0.1.0. Pour les autres clients, collez la configuration JSON de cette page dans leurs réglages MCP.

Faut-il une clé API pour io.github.RealSpap/authority-risk-mcp ?

Son entrée au registre n'indique aucune clé ni secret obligatoire. Certaines fonctions peuvent tout de même demander un compte auprès du service auquel il se connecte.

io.github.RealSpap/authority-risk-mcp est-il open source ?

Oui. Son code est sur GitHub sous licence CC-BY-4.0.

Qui maintient io.github.RealSpap/authority-risk-mcp ?

Il est publié par RealSpap. AI.tn le référence sans le maintenir ni le recommander.

Issu du registre MCP officiel. Être listé n'est pas une recommandation : vérifiez le code et les permissions d'un serveur avant de lui donner accès à vos données.