Diogenes Web3, DeFi & 402 Security MCP Server

by stand-out-of-my-sun Your server? Claim it

answering

Diogenes Web3, DeFi & 402 Security MCP is answering right now. Last checked 4 min ago. It exposes 15 tools. Last commit 4 Nov 2026.

Smart contract audit oracles, Solana risk analysis, MEV defense & HTTP 402 verifiers.

Uptime history 19 days of history · worst day 38%

19 days agonow

100.0%

Uptime 24h

91 of 91 checks

Tools

read from the server

199 ms

Response time

average over 24h

Stars

last commit 4 Nov 2026

What changed 35

Every tool that appeared, vanished or quietly changed what it asks for. Recorded since 21 October 2026. No other catalogue keeps this.

8 Nov a tool description was rewritten simulate_evm_transaction_calldata

8 Nov a tool changed the parameters it asks for simulate_evm_transaction_calldata

2 Nov a tool description was rewritten evaluate_solana_token_risk

25 Oct 2 tool descriptions were rewritten compare_crosschain_bridge_routes, verify_http402_payment_challenge

23 Oct 2 tool descriptions were rewritten compare_crosschain_bridge_routes, verify_http402_payment_challenge

21 Oct 15 tools appeared audit_smart_contract_code, calculate_spot_swap_rate, compare_crosschain_bridge_routes and 12 more

21 Oct 13 tools disappeared contract_audit, crypto_address_poisoning_check, crypto_bridge_quote and 10 more

What the code does

We read the source, 3 d ago · tools taken from the live server · rules 995398eba69f

Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Runs an external command index.js:136

        const stdout = childProcess.execSync(cmd, { encoding: "utf-8", timeout: 15000 });

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

This code can reach further than it looks

We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 4 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add diogenes-web3-security-mcp --transport http https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security

Settings → Connectors → Add custom connector, then paste this address

https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security

~/.codex/config.toml

[mcp_servers.diogenes-web3-security-mcp]
url = "https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security"

.cursor/mcp.json

{
  "mcpServers": {
    "diogenes-web3-security-mcp": {
      "url": "https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "diogenes-web3-security-mcp": {
      "type": "http",
      "url": "https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security"
    }
  }
}

Available tools 15

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

estimate

estimate_bitcoin_mempool_fees

Fetches real-time Bitcoin mainnet mempool feerate recommendations in satoshis per virtual byte (sat/vB) across fastest, half-hour, hour, and economy confirmation tiers. Use when checking current Bitcoin L1 network congestion before broadcasting an on-chain BTC transaction; for calculating exact SegWit/Taproot UTXO batch consolidation vByte weights and dust thresholds, use plan_bitcoin_utxo_consolidation instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'confirmation_target', supports '?demo=true' or L402 (10 sats), and returns HTTP 400 if invalid.

estimate_solana_priority_fees

Calculates optimal Solana compute-unit (CU) microlamport priority fees and Jito bundle tip lamports to achieve target block-inclusion probability. Use when setting SetComputeUnitPrice and Jito tips before broadcasting a Solana transaction; for querying Bitcoin L1 sat/vB mempool fee rates, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'priority_level' ('tx_type' defaults to 'simple_transfer'), supports '?demo=true' or x402 (10 sats), and returns HTTP 400 if invalid.

evaluate

evaluate_dex_mev_risk

Evaluates decentralized exchange (DEX) swap parameters against pool depth and mempool visibility to quantify MEV sandwich risk and compute optimal slippage tolerance in basis points. Use when configuring slippage tolerance and private-RPC routing before executing an on-chain DEX token swap; for comparing cross-chain bridge settlement routes across different L1 blockchains, use compare_crosschain_bridge_routes instead. Read-only edge call (32 KB, 60 RPM): accepts 'pair' ('execution_venue' defaults to 'uniswap_v3_public'), uses '?demo=true' or L402 (25 sats); HTTP 400 if invalid.

evaluate_solana_token_risk

Evaluates Solana SPL and Token-2022 rug-pull risk by checking mint/freeze authorities, permanent delegates, transfer hooks, and returning reason codes with slot height. Use when making a pre-trade security decision on whether an SPL or Token-2022 mint is safe to trade; for DEX liquidity and metadata lookup via x402, use inspect_solana_token_liquidity instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'token_address' ('risk_profile' defaults to 'strict_decentralized'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

audit

audit_smart_contract_code

Statically audits Solidity, Vyper, or Move smart contract source code for honeypot transfer taxes, hidden mint backdoors, proxy upgrade traps, and reentrancy. Use when auditing smart contract source code or bytecode before deploying or interacting with a protocol; for scanning Solana Anchor/Rust programs specifically for Cross-Program Invocation (CPI) signer/account vulnerabilities, use scan_solana_cpi_reentrancy instead. Read-only edge call (32 KB, 60 RPM): accepts 'code_or_address' ('chain' defaults to 'evm_solidity'), uses '?demo=true' or L402 (45 sats); HTTP 400 if invalid.

calculate

calculate_spot_swap_rate

Calculates instantaneous spot exchange rates and equivalent USD, BTC, and satoshi values across BTC, ETH, SOL, SUI, and USDC. Use when converting a token amount into USD or satoshis for invoice pricing or accounting; for quoting executable non-KYC cross-chain bridge routes with bridge fees and settlement times, use compare_crosschain_bridge_routes instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'currency' ('amount' defaults to 'standard'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

compare

compare_crosschain_bridge_routes

Compares non-custodial, non-KYC cross-chain swap routes (THORChain native L1 swaps, Maya Protocol, Blockstream Liquid) by basis-point fee, net output sats, and settlement time. Use when routing cross-chain treasury settlements (e.g. Solana USDC or Base ETH into native Bitcoin); for calculating mid-market spot exchange rates without bridge routing fees, use calculate_spot_swap_rate instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'from_asset' ('to_asset' defaults to 'BTC_NATIVE'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

decode

decode_eip712_permit_signature

Decodes EIP-712 and Uniswap Permit2 off-chain typed-data payloads to verify spender identity, detect unlimited (uint256.max) token approvals, and flag expired deadlines. Use when inspecting an off-chain eth_signTypedData_v4 or Permit2 payload before signing; for decoding raw on-chain hex transaction calldata (0x...) for eth_sendTransaction, use simulate_evm_transaction_calldata instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'typed_data_json' ('chain_id' defaults to '1'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

detect

detect_address_poisoning_scam

Compares a target recipient wallet address against recent transaction history to detect vanity prefix/suffix lookalike spoofing and zero-value dusting attacks. Use when verifying a recipient EVM or Solana wallet address before sending funds; for decoding hex smart contract calldata payloads, use simulate_evm_transaction_calldata instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'target_address' ('address_standard' defaults to 'auto_detect'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

inspect

inspect_solana_token_liquidity

Retrieves canonical Solana SPL token metadata including name, ticker symbol, decimal precision, and current mint/freeze authority addresses. Use when resolving SPL token decimals, ticker symbols, and registry metadata for portfolio or swap formatting; for computing a composite security risk score and binary should_transact verdict, use evaluate_solana_token_risk instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'mint' ('network' defaults to 'mainnet-beta'), supports '?demo=true' or x402 (20 sats), and returns HTTP 400 if invalid.

plan

plan_bitcoin_utxo_consolidation

Analyzes a set of Bitcoin UTXO balances in satoshis to compute exact vByte transaction weight, identify uneconomical dust inputs, and recommend whether to consolidate now or hold. Use when optimizing on-chain Bitcoin treasury UTXO sets to minimize long-term miner fee drag; for fetching current live Bitcoin mempool sat/vB feerates alone, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'utxos_sats_json' ('script_type' defaults to 'p2wpkh_segwit'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

scan

scan_solana_cpi_reentrancy

Scans Solana Anchor and native Rust program instructions for unverified Cross-Program Invocation (CPI) program IDs, missing signer checks, and PDA bump seed canonicalization bugs. Use when auditing Solana Rust/Anchor source code or instruction account structs for CPI privilege escalation; for checking live SPL token mint/freeze authorities and rug-pull risk by mint address, use evaluate_solana_token_risk instead. Read-only edge call (32 KB, 60 RPM): accepts 'rust_source_or_idl' ('framework' defaults to 'anchor'), uses '?demo=true' or L402 (30 sats); HTTP 400 if invalid.

simulate

simulate_evm_transaction_calldata

Simulates raw EVM hex calldata (0x...), estimates gas/fees for pre-sign payload assembly, and tracks on-chain transaction execution state, confirmations, and receipts. Use when auditing calldata before signing or tracking execution state and confirmations after broadcast; for inspecting off-chain EIP-712 typed-data signatures, use decode_eip712_permit_signature instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'action' ('network' defaults to 'base_mainnet'), supports '?demo=true' or L402 (20 sats), and returns HTTP 400 if invalid.

track

track_solana_whale_flows

Tracks 24-hour net accumulation or distribution flows across top Solana whale wallets and flags coordinated insider wallet clusters for a given SPL token. Use when analyzing on-chain smart-money order flow and holder clustering on Solana; for checking static SPL contract mint/freeze authority permissions, use evaluate_solana_token_risk instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'token' ('window' defaults to '1h'), supports '?demo=true' or x402 (50 sats), and returns HTTP 400 if invalid.

verify

verify_http402_payment_challenge

Decodes inbound HTTP 402 Payment Required challenges (L402 BOLT11 + Macaroon, x402 Solana USDC, MPP Base intents) to verify cryptographic payment-hash binding and block overcharge fraud. Use when auditing a 402 challenge header before an autonomous agent pays a Lightning invoice or USDC transfer; for checking on-chain Bitcoin L1 mempool feerates, use estimate_bitcoin_mempool_fees instead. Stateless read-only edge call (max 32 KB, 60 RPM): accepts 'www_authenticate' ('protocol_hint' defaults to 'L402'), supports '?demo=true' or L402 (15 sats), and returns HTTP 400 if invalid.

Tools removed

Tools this server used to expose. Anything built against them stopped working on the day they went.

contract_audit

removed 21 Oct 2026

crypto_address_poisoning_check

removed 21 Oct 2026

crypto_bridge_quote

removed 21 Oct 2026

crypto_eip712_permit_decoder

removed 21 Oct 2026

crypto_utxo_consolidation_planner

removed 21 Oct 2026

http402_challenge_verifier

removed 21 Oct 2026

mempool_fee

removed 21 Oct 2026

mev_risk

removed 21 Oct 2026

solana_risk

removed 21 Oct 2026

swap_rate

removed 21 Oct 2026

x402_solana_priority_fee_oracle

removed 21 Oct 2026

x402_token_meta

removed 21 Oct 2026

x402_whale_radar

removed 21 Oct 2026

Endpoints

URL	Transport	State	Latency	Checked
https://diogenes-micro-gateway.corinth.workers.dev/mcp/web3-security	streamable-http	answering	157 ms	4 min ago

Alternatives to Diogenes Web3, DeFi & 402 Security MCP

same job, measured the same way

Aikido MCP

by bajuzjefe

Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors.

46 installs/wk local only

ContractOracle-Sentinel

by evozim

DeFi smart contract forensic auditor and vulnerability scanner.

answering

Contract Scanner

by lordbasilaiassistant-sudo

Smart contract security scanner — vulnerabilities, risk scores, and calldata decoding

51 installs/wk local only

Smartguard MCP

by kota1026

SmartGuard MCP Server - AI-powered smart contract security audit tools for Claude Code, Cursor,...

42 installs/wk local only

AgentShield

by atmflow55

Smart contract security for AI agents — verify, monitor, freeze, x402 payments

39 installs/wk local only

AgentDiet Base EVM & Solana Smart Contract Security Scanner

by agentdiet

Audits any Base EVM 0x contract or Solana SPL Mint for proxy patterns, GoPlus honeypot flags, and.

2 tools answering

Contract Security Scanner

by mastrophot

MCP smart contract scanner with NEAR-focused security context.

43 installs/wk local only

Vaultguard MCP

by kota1026

VaultGuard MCP Server - Yearn V3 / DeFi vault security and analysis tools for AI coding agents....

46 installs/wk local only

Diogenes Web3, DeFi & 402 Security MCP — questions

Answers built from our own checks of this server.

What can Diogenes Web3, DeFi & 402 Security MCP do?

It exposes 15 tools, read directly from the server on our last check. Among them: audit_smart_contract_code, calculate_spot_swap_rate, compare_crosschain_bridge_routes, decode_eip712_permit_signature, detect_address_poisoning_scam, estimate_bitcoin_mempool_fees and 9 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

What is Diogenes Web3, DeFi & 402 Security MCP mostly used for?

Its tools cluster around evaluate and estimate. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.

Is Diogenes Web3, DeFi & 402 Security MCP working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 91 of 91 checks got a reply (100.0%), average response time 199 ms. The bar chart above shows every period we have measured.

Did Diogenes Web3, DeFi & 402 Security MCP ever remove tools?

Yes. contract_audit, crypto_address_poisoning_check, crypto_bridge_quote, crypto_eip712_permit_decoder and 9 more are no longer exposed — we recorded the date each one disappeared. A tool vanishing usually means a breaking change for anything that depended on it.

How do I connect Diogenes Web3, DeFi & 402 Security MCP?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does Diogenes Web3, DeFi & 402 Security MCP need an API key?

No. Diogenes Web3, DeFi & 402 Security MCP completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 15 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is Diogenes Web3, DeFi & 402 Security MCP?

It answers our handshake in 199 ms on average, which is faster than 67% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.

Is Diogenes Web3, DeFi & 402 Security MCP open source?

The code is open source: it is published under the MIT licence, written in JavaScript and 1 stars on GitHub. The licence covers the code in the repository, not the hosted service at diogenes-micro-gateway.corinth.workers.dev, which runs on its operator's own terms.