npm package: @lazymac/smart-contract-scanner-api
Description: Premium Solidity smart contract vulnerability scanner REST API & MCP server
Author: lazymac2x
Latest version: 1.0.0

[![lazymac API Store](https://img.shields.io/badge/lazymac-API%20Store-blue?style=flat-square)](https://lazymac2x.github.io/lazymac-api-store/) [![Gumroad](https://img.shields.io/badge/Buy%20on-Gumroad-ff69b4?style=flat-square)](https://coindany.gumroad.com/) [![MCPize](https://img.shields.io/badge/MCP-MCPize-green?style=flat-square)](https://mcpize.com/mcp/smart-contract-scanner-api)

# Smart Contract Scanner API

Premium Solidity smart contract vulnerability scanner — REST API and MCP server. Detects 13 vulnerability classes using pattern-based analysis with zero external dependencies.

## Why This Exists

Professional smart contract audits cost $5K–$50K and take weeks. This API provides automated, instant security analysis for a fraction of the cost. No external API keys needed — all analysis is done locally via pattern matching and structural analysis.

## Vulnerability Detection

| ID | Name | Severity | SWC |
|---|---|---|---|
| SCS-001 | Reentrancy | Critical | SWC-107 |
| SCS-002 | Integer Overflow/Underflow | High | SWC-101 |
| SCS-003 | Unchecked External Calls | High | SWC-104 |
| SCS-004 | Access Control | Critical | SWC-105 |
| SCS-005 | Timestamp Dependence | Medium | SWC-116 |
| SCS-006 | tx.origin Authentication | Critical | SWC-115 |
| SCS-007 | Delegatecall Injection | Critical | SWC-112 |
| SCS-008 | Self-destruct | High | SWC-106 |
| SCS-009 | Floating Pragma | Low | SWC-103 |
| SCS-010 | Gas Limit Issues | Medium | SWC-128 |
| SCS-011 | Front-running | Medium | SWC-114 |
| SCS-012 | Missing Events | Low | N/A |
| SCS-013 | Unused Variables | Info | SWC-131 |

## Quick Start

```bash
npm install
npm start        # REST API on port 5200
npm run mcp      # MCP server (stdio)
npm test         # Run test suite
```

## API Endpoints

### POST /api/v1/scan — Full Audit

```bash
curl -X POST http://localhost:5200/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"code": "pragma solidity ^0.8.0; contract Foo { function withdraw() public { msg.sender.call{value: 1}(\"\"); } }"}'
```

Returns: Full audit report with risk score (0–100), findings grouped by severity, gas optimization suggestions, and actionable recommendations.

### POST /api/v1/quick-scan — Critical Checks Only

Same request format. Checks only the top 5 critical patterns (reentrancy, access control, tx.origin, delegatecall, unchecked calls). Faster response.

### POST /api/v1/gas-analysis — Gas Optimization

Returns gas optimization suggestions with estimated savings per suggestion.

### GET /api/v1/vulnerabilities — Detector Catalog

Lists all 13 detectable vulnerability types with descriptions and SWC references.

## MCP Server

Add to your MCP client configuration:

```json
{
  "mcpServers": {
    "smart-contract-scanner": {
      "command": "node",
      "args": ["src/mcp-server.js"],
      "cwd": "/path/to/smart-contract-scanner-api"
    }
  }
}
```

**Tools:**
- `scan_contract` — Full security audit
- `quick_scan_contract` — Critical checks only
- `analyze_gas` — Gas optimization analysis
- `list_vulnerabilities` — Detector catalog

## Report Format

```json
{
  "report": {
    "overview": {
      "riskScore": 78,
      "riskLevel": "High",
      "summary": { "total": 8, "critical": 2, "high": 3, "medium": 2, "low": 1, "info": 0 }
    },
    "findings": { "bySeverity": { ... }, "total": 8 },
    "gasOptimization": { "suggestions": [...] },
    "recommendations": [...]
  }
}
```

## Docker

```bash
docker build -t smart-contract-scanner .
docker run -p 5200:5200 smart-contract-scanner
```

## License

MIT