{
"_meta": {
"io.modelcontextprotocol.registry/official": {
"status": "active",
"isLatest": true,
"updatedAt": "2026-09-05T11:51:20.712038Z",
"publishedAt": "2026-09-05T11:51:20.712038Z",
"statusChangedAt": "2026-09-05T11:51:20.712038Z"
}
},
"server": {
"name": "dev.weakspot/weakspot",
"$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
"version": "0.1.1",
"packages": [
{
"version": "0.1.1",
"transport": {
"type": "stdio"
},
"identifier": "weakspot-mcp",
"registryType": "npm",
"environmentVariables": [
{
"name": "WEAKSPOT_PRIVATE_KEY",
"format": "string",
"isSecret": true,
"description": "Private key of a funded Base wallet. This server SPENDS REAL USDC from it with no human in the loop — use a fresh wallet funded with only what you are willing to lose, never a personal or deployer key. Only weakspot_audit needs it; the pricing, status and wallet-status tools work without one."
},
{
"name": "WEAKSPOT_MAX_USD",
"format": "number",
"default": "4",
"description": "Hard cap in USD on any single audit (default 4, the highest tier). Checked twice: against the tier price, and again against the amount the server actually quotes. An LLM decides when to call the paying tool, so this is the main spend control."
},
{
"name": "WEAKSPOT_URL",
"format": "string",
"default": "https://weakspot.dev",
"description": "Base URL of the Weakspot deployment to use. Defaults to https://weakspot.dev; override to point at staging or a self-hosted instance."
},
{
"name": "WEAKSPOT_RPC_URL",
"format": "string",
"description": "Base RPC endpoint, used only to read the wallet's USDC balance in weakspot_wallet_status. Nothing else needs it."
}
]
}
],
"websiteUrl": "https://weakspot.dev",
"description": "Audit Solidity and Rust smart contracts from your editor. Pays per audit in USDC over x402."
}
}