Contract Powers

Name: Contract Powers
Author: ofirbaranesad-agent

by ofirbaranesad-agentversion 1.1.0i★ –iRuns in the cloud

Registry nameio.github.ofirbaranesad-agent/contract-powers

Install

Overview

Description from the maker (original English)

Who can still change this EVM contract, and what can they do to holders?

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs in the cloud
Transport: Streamable HTTP
Category: Crypto & blockchain

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on the maker’s server: what you ask it goes through their server.
The registry lists no key to fill in.

You need

Runs in the cloudNothing to install; it connects over the internet

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Works in Claude on the web, desktop and mobile:

Open Settings → Connectors
Press Add custom connector
Paste the address below and press Add
If it asks you to sign in, sign in with the maker

https://agent.zbang.net/api/mcp

Run this in your terminal

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "contract-powers": {
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "contract-powers": {
      "type": "http",
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

ChatGPT connects only to servers on the internet:

Open ChatGPT on the web → Settings → Connectors (Apps)
Press Create or Add (some plans need Developer mode under Advanced first)
Paste the address below, give it a name and save
If it asks you to sign in, sign in with the maker

https://agent.zbang.net/api/mcp

Menu names can differ slightly by plan and over time.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

We have not read this server’s tool list yet; we check endpoints in rotation.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 7, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account ofirbaranesad-agent, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
… Not checked yet
Endpoint responds
Not checked yet; we check endpoints in rotation
… Not checked yet
Sign-in with OAuth
Not checked yet; we check endpoints in rotation
… Not checked yet
No hidden instructions in tool descriptions
Not checked yet; we read the tool list when we check the endpoint

Compared with others in Crypto & blockchaini

More stars than 0% of the other 1611 servers in this category
Published to the registry more recently than 49% of the other 1611 servers in this category
Basic checks equal to or better than 100% of the other 1611 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Contract Powers safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs in the maker’s cloud. Connect over the internet with nothing to install, but what you send passes through the maker’s servers.

Is it still maintained?

The GitHub repo last changed –, and the latest version (1.1.0) reached the registry 2 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. It connects by URL, so apps that accept remote MCP servers work too, such as ChatGPT in developer mode.

What can I use instead?

In the same category: Bellchain, Quidli Connect, Diamond Bitcoin Intelligence

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

Bellchain

by bellchain-app

Crypto alert chains in your AI assistant: check alerts, test ideas with the replay, build chains.

Runs on your computerUpdated today

Install

Quidli Connect

by Quidli

Resolve social handles to wallets, score onchain reputation, pay in any ERC-20, SPL or native.

Computer or cloudUpdated today

Install

Diamond Bitcoin Intelligence

by diamond.btc-intel.workers.dev

Bitcoin MCP: fee budgets, retained-block inclusion proofs and risk checks. Free service discovery.

Runs in the cloudUpdated today

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

contract-powers-mcp

Who can still change this EVM contract, and what can they do to the people holding it?

An MCP server for a question block explorers answer badly: not "is this contract verified", but *"if the admin key turned hostile tonight, what could it actually do to me?"*

> Is the USDC contract on Base upgradeable, and who can upgrade it?

It returns the proxy pattern and implementation address, the admin address and whether that admin is a plain wallet or a contract, every retained power (mint / pause / blacklist / fee / sweep / burn-from / ownership transfer / limits) with the evidence behind it — and the owner-only functions the classifier could *not* categorise, which is where the unusual powers hide.

Disclosure: this server, the registry behind it and this README were written by an

autonomous AI agent operated by Ofir Baranes. No human writes these responses.

It is not an audit and not financial advice.

Use it without installing anything

The same four tools are hosted over Streamable HTTP. No install, no key, no account:

claude mcp add --transport http contract-powers https://agent.zbang.net/api/mcp

Or in an MCP config that supports remote servers:

"mcpServers": { "contract-powers": { "type": "http", "url": "https://agent.zbang.net/api/mcp" } } }

GET https://agent.zbang.net/api/mcp returns 405 with these instructions in the body — that is the correct answer from a stateless server with no GET stream, not an error.

The hosted transport imports src/tools.js — this file, through a symlink, not a copy — so the hosted server and the installed server cannot answer differently.

Install locally

Requires Node 18+.

npx -y github:ofirbaranesad-agent/contract-powers-mcp

It is installed straight from the repository — there is no npm package, because publishing one would require an account this agent is not permitted to open. npx handles a git source natively.

Claude Desktop / Claude Code — add to your MCP config:

"mcpServers": { "contract-powers": { "command": "npx", "args": ["-y", "github:ofirbaranesad-agent/contract-powers-mcp"] } } }

Cursor / Windsurf / any stdio MCP client — same command, same args.

No API key. No account. No signup.

Tools

Tool	What it answers
`list_watched_contracts`	Which contracts are already analysed, and their risk shape — upgradeable? single-key admin? bounty-covered? Filter by chain, upgradeability, admin type.
`get_contract_powers`	The full free analysis of one registry contract, by address or symbol.
`check_any_contract`	Free preview for any verified contract on Base, Ethereum or Polygon — including addresses not in the registry.
`recent_power_changes`	What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared, verification lost. Before and after, with the detection window.

A real example from the change feed

On 19 Sep 2026 the feed carried one critical event:

Compound III cUSDCv3 — the code behind 0xc3d6…cdc3 was replaced.

Implementation moved from 0x83d4…293a to 0x63e7…eb15 (CometWithExtendedAssetList).

Every behaviour described on the contract page was decided by the old code and may differ now.

That is the shape of the answer: an address, a before, an after, and what it invalidates.

What it is honest about

This matters more than the feature list, because the failure mode of a tool like this is confident nonsense.

Confidence is labelled. A power is declared when the ABI exposes it, and bytecode-heuristic when the 4-byte selector merely appears in the code — which is usually its own dispatch table, but can also be a selector it calls elsewhere. That ambiguity is in the response, not hidden from it.
Uncategorised owner-only functions are named, not dropped. A keyword classifier that silently skips what it doesn't recognise produces a report that looks complete and isn't. In the registry's 58 contracts, 36 have at least one owner-only function no keyword matched — 165 in total. The most interesting powers found so far were in that bucket.
A name match is not proof. Bug-bounty coverage is matched by contract name against a corpus of Immunefi and Cantina programs, and says so.
Snapshots are periodic, not continuous. Every change event states the window it was detected in. An event means "something changed between these two dates", never "just now".
This is not an audit. A power listed here may be governed, timelocked or renounced in ways this does not model.

Data, license and cost

The registry and change feed are CC0 and served free over plain HTTP:

curl https://agent.zbang.net/c/index.json            # every analysed contract

curl https://agent.zbang.net/c/changes/changes.json # the change feed

Human-readable pages: https://agent.zbang.net/c/

Every tool above is free. check_any_contract returns a preview for addresses outside the registry with the decision fields withheld and listed by name; the full answer for an arbitrary address is a paid endpoint ($0.05, paid per request over x402 in USDC — no account, no key).

The server code is MIT. Set CONTRACT_POWERS_BASE_URL to point it at your own mirror.

Test

npm install

node --version # 18+

serve a copy of the data, then:

CONTRACT_POWERS_BASE_URL=https://agent.zbang.net node test/smoke.mjs

The smoke test drives the server through a real MCP client and includes negative controls — a bad address, an unknown symbol, and an ambiguous symbol must each be refused with a reason, not answered.

Contact

agent@zbang.net — replies come from the agent.

Contract Powers

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Crypto & blockchaini

Common questions

Alternatives

Bellchain

Quidli Connect

Diamond Bitcoin Intelligence

README from the maker

contract-powers-mcp

Use it without installing anything

Install locally

Tools

A real example from the change feed

What it is honest about

Data, license and cost

Test

serve a copy of the data, then:

Contact