English Français العربية

dev.weakspot/weakspot

Official registry Security

Audit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402.

Website

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

NPM package weakspot-mcp
Claude Code 
claude mcp add weakspot -e 'WEAKSPOT_PRIVATE_KEY=<your weakspot_private_key>' -e 'WEAKSPOT_MAX_USD=4' -e 'WEAKSPOT_URL=https://weakspot.dev' -e 'WEAKSPOT_RPC_URL=<WEAKSPOT_RPC_URL>' -- npx -y weakspot-mcp@0.1.1
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "weakspot": {
            "command": "npx",
            "args": [
                "-y",
                "weakspot-mcp@0.1.1"
            ],
            "env": {
                "WEAKSPOT_PRIVATE_KEY": "<your weakspot_private_key>",
                "WEAKSPOT_MAX_USD": "4",
                "WEAKSPOT_URL": "https://weakspot.dev",
                "WEAKSPOT_RPC_URL": "<WEAKSPOT_RPC_URL>"
            }
        }
    }
}

Environment variables

  • WEAKSPOT_PRIVATE_KEY secret Private key of a funded Base wallet. This server SPENDS REAL USDC from it with no human in the loop — use a fresh wallet funded with only what you are willing to lose, never a personal or deployer key. Only weakspot_audit needs it; the pricing, status and wallet-status tools work without one.
  • WEAKSPOT_MAX_USD Hard cap in USD on any single audit (default 4, the highest tier). Checked twice: against the tier price, and again against the amount the server actually quotes. An LLM decides when to call the paying tool, so this is the main spend control.
  • WEAKSPOT_URL Base URL of the Weakspot deployment to use. Defaults to https://weakspot.dev; override to point at staging or a self-hosted instance.
  • WEAKSPOT_RPC_URL Base RPC endpoint, used only to read the wallet's USDC balance in weakspot_wallet_status. Nothing else needs it.

Frequently asked questions

What is dev.weakspot/weakspot?

Audit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402.

How do I install dev.weakspot/weakspot?

It runs on your machine. In Claude Code: claude mcp add weakspot -e 'WEAKSPOT_PRIVATE_KEY=<your weakspot_private_key>' -e 'WEAKSPOT_MAX_USD=4' -e 'WEAKSPOT_URL=https://weakspot.dev' -e 'WEAKSPOT_RPC_URL=<WEAKSPOT_RPC_URL>' -- npx -y weakspot-mcp@0.1.1. For other clients, paste the JSON configuration from this page into their MCP settings.

Does dev.weakspot/weakspot need an API key?

Yes. It expects WEAKSPOT_PRIVATE_KEY, which you set in its configuration.

Who maintains dev.weakspot/weakspot?

It is published by dev.weakspot. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.