Show and tell: Bug Bounty Intelligence — x402-paid smart contract security analysis MCP, trained on 27,681 real audit findings

[holistis]

Bug Bounty Intelligence is an MCP server that brings 27,681 real accepted smart contract audit findings into your Claude Code or Claude Desktop workflow.

GitHub: https://github.com/holistis/bug-bounty-intelligence-mcp

Three tools:

list_vulnerability_patterns (free) - shows historical acceptance rates from Sherlock and Code4rena competitions. Example:

oracle-manipulation: 53% accepted (3,253 cases)
staleness: 45% accepted (5,838 cases)
rounding: 51% accepted (2,615 cases)

scan_contract ( USDC on Base via x402) - submit a Solidity GitHub repo for Al-Mizaan v3 analysis. The framework runs 7 gates: code reading, reachability chain, threat model, invariant breach, protocol intent, impact, and formal proof.

get_scan_report (free) - poll for scan status and get the report URL. Delivery within 24h.

Setup for Claude Code:

{mcpServers:{bug-bounty-intelligence:{command:npx,args:[-y,github:holistis/bug-bounty-intelligence-mcp]}}}

Payment is x402 on Base (eip155:8453), USDC, AI agent autopay compatible.

Real scan output from Crestal Network (29 contracts):
Summary: 1 High finding confirmed
Finding: Owner Can Arbitrarily Set Payment Addresses (Blueprint.sol)
Confidence: 0.90 (Al-Mizaan validated)

Registry entry: io.github.holistis/bug-bounty-intelligence-mcp