Bug Bounty Intelligence

Bug Bounty Intelligence: MCP Server

AI-powered smart contract security analysis for AI agents and developers.

Verify us in two minutes

You need Node 22 or newer (what our recount workflow uses) and nothing else.

git clone https://github.com/holistis/bug-bounty-intelligence-mcp

cd bug-bounty-intelligence-mcp node results/2026-11-02-shop-setup-five-audits/check.mjs node tools/checker-selftest.mjs node tools/ranges-check.mjs

The first command recounts one result folder from its verdict files and checks its hashes. It runs offline.

The second command tests the checkers. It copies every result folder to a temp directory, plants a made-up finding id and a flipped verdict, and runs the check.mjs of that folder. CAUGHT is good. BLIND means the checker accepted the planted fault. Today no folder is BLIND. The last one, results/2026-10-26-evmbench, was fixed on 3 November 2026 in pull request 89. To see where we started, test the state before our fixes:

The third command checks the central index (results/README.md): every folder it names with a voided-answer count above zero must also be named under its "Ranges if the voided answers are counted" section. Tom Smart found that this was missing for five older folders on 4 November 2026 (issue 41). It covers that one index, not yet a newer folder's own README.

git worktree add ../selftest-before 0fafa23

node tools/checker-selftest.mjs ../selftest-before/results

Three of the five checkers a made-up id can reach were BLIND then.

First issues, each scoped to one folder or one audit: good first issues. How a change is reviewed and how credit works: CONTRIBUTING.md. The scan engine itself is not in this repository.

Every public statement of ours that turned out wrong is listed, with the date and the fix, in ERRATA.md. The counting rule behind our results is MEASUREMENT-RULE-two-judge-strict.md.

Update, 2 November 2026: the scan you can buy, counted

The setup behind our deep scan found 14 of 20 known High findings on five public audits, one run each, graded by a copy of the benchmark's own judge. On the same five audits the leader's own report finds 15 of 20 under that copy. Every verdict, the exact reports the judge read and a script that recounts everything are in results/2026-11-02-shop-setup-five-audits, with the limits listed. All our result folders are listed in results/README.md, and the longer story is on our blog.

Update, 25 October 2026, night: two free tools next to the scan

We ran Slither 0.11.6 and Aderyn 0.6.8 with default settings on the same contests and had the same two judges compare their output with the known High and Medium findings. They found none: Slither 0 of 34 and Aderyn 0 of 70, on the contests where our setup could run them. On the same contests our scan found 6 of 34 and 10 of 70 in its first 15 hypotheses. Static tools are not built for the business-logic flaws that contests reward, the older contests may be in the training data of the model behind our scan, and the judges are language models, so read it as a description and not as a ranking: results/2026-10-25-free-tools/README.md.

Update, 25 October 2026, night: a quick scan for 1 dollar

There are now two prices. The quick scan, POST https://x402.tokenizen.nl/api/bug-intel-quick for 1 USDC on Base, returns the 15 hypotheses the model is most confident about. The full scan, POST https://x402.tokenizen.nl/api/bug-intel for 5 USDC, adds 15 more with lower confidence. It is the same engine and the same kind of report. The hit rates we measured (8 of 105 and 5 of 66) are for the first 15 hypotheses, so they are the numbers of the quick scan; the second list is the extra of the full scan. The quick scan costs exactly 1 dollar because the official x402 client refuses payments above 1 dollar per request unless its owner raises the limit, and we checked with a real purchase that an agent with default settings can buy it: results/2026-10-25-v31/quick-scan-purchase/README.md. Both routes sign their offers.

Update, 25 October 2026, night: a standard x402 client can now buy the scan

Until today the scan endpoint accepted only a transaction hash from a payment you had made by hand, and it answered 400 to the signed authorization that standard x402 clients send, although its 402 answer said that would work. That is fixed. A standard client (@x402/fetch 2.28.0) bought the scan from a throwaway address, got the receipt in the response, and the six checks on the receipt pass: results/2026-10-25-v31/standard-client-purchase/README.md. It was a self test with our own money, one purchase. One thing a buyer needs to know: the official client refuses payments above 1 dollar per request unless its owner raises the limit, and the scan costs 5 dollars.

Update, 25 October 2026, night: the scan on contests from the last year

We ran the scan once on 9 Code4rena contests from September 2025 to March 2026 (66 known High and Medium findings), with the rule for reading the result written beforehand. The first 15 hypotheses of a report held 5 of the 66 (7.6 percent) and the first 30 held 8 (12.1 percent). That is the same rate as on the 8 Sherlock contests, so by our own rule the result holds on newer contests. It is still a low rate: 58 of the 66 known findings were not in the first 15. Numbers, judgements, the whole lists and the limits: results/2026-10-25-c4-fresh/README.md.

A report can now show up to 30 hypotheses, in two lists: the 15 the model is most confident about and 15 more with lower confidence. On the stored lists the second list held 8 known findings that the first list did not (5 on Sherlock, 3 on Code4rena), at a slightly lower precision. We chose this after seeing the numbers, so it is a product choice and not a pre-registered test.

Update, 25 October 2026, evening: the offer is signed

The paid endpoint now declares the x402 offer-receipt extension and signs its offer. You can check it yourself without paying: npx -y agent-receipt-verify https://x402.tokenizen.nl/api/bug-intel reaches level 2 (asks for payment the way x402 says, declares the extension, and the signature of the offer verifies). The signer is 0xf30b0706E78b3166745E6a2f351992321088058f. That key only signs offers and receipts and holds no funds. The key is bound to the service domain in DNS, the way section 4.5.1 of the offer-receipt specification describes: dig TXT _controllers.x402.tokenizen.nl lists it as a controller (set on 25 October 2026). The address that receives payments is the one in the payment section below.

After a payment the answer to the paid request carries a signed receipt for that payment transaction, in the body as receipt and in the PAYMENT-RESPONSE header (level 3). We have seen this on one real payment, a self test on Base mainnet with 5.1 USDC from the project's own address to the payment address of the service. The receipt, the transaction, the delivered report and a script that checks all of it are in results/2026-10-25-v31/first-real-payment/. Nobody else has used the receipt yet, and the conformance checker still shows level 3 as not measured because it checks without paying. A receipt says that our service saw payment transaction X for this resource. It says nothing about how good the report is.

Update, 25 October 2026: version 3.1 is live

Paid scans now run on a newer version, V3.1. On the same 8 contests as the sealed run it found 8 of 105 known High and Medium findings (7.6 percent), against 4 for the version before it and 1 for the scan that was in production until the evening of 25 October: results/2026-10-25-v31/README.md. Two things changed at once and those contests are no longer secret, so this is a doubling from a low level and not a proof. 97 of the 105 were still not found. A scan takes about 20 to 45 seconds and costs us 0.02 to 0.15 dollar. The earlier version stays in place as the fallback.

Update, 24 October 2026, evening: the sealed run

The one run on the sealed set is done, with the rule written before it: results/2026-10-24-sealed/README.md. On 8 contests that nobody here had run anything on, the scan as it runs today found 1 of 105 known High and Medium findings. A newer version, not in production, found 4 of 105. The rule needed at least 5 findings that production does not find, and it found 3, so production stays as it is. The scan still produces hypotheses to review by hand, and it has not been shown to find what a human audit finds.

Update, 24 October 2026, later the same day: version 2 of the scan

The defects described below were fixed and the new version is live. What changed: git submodules are fetched when they point to github.com, tests, mocks, scripts, interfaces and vendored libraries are left out, files are ranked by how likely they move funds and sent in at most six parts, every report states how much of the in-scope code was read, a scan without hypotheses is delivered as such and not as a normal report, hypotheses that name files or functions that are not in the code are dropped, and file links inside a repository are never followed. A free precheck at https://x402.tokenizen.nl/api/bug-intel/precheck?repo=owner/name says before you pay whether the scan counts any Solidity in your repository and roughly how much of it will be read.

The measurement of this version was pre-registered before it ran: PREREGISTRATION-v2-2026-10-24.md. The frozen files are in pipeline/v2.

Result, in RESULTS-v2-2026-10-24.md: none of the 40 known High and Medium findings was found, 0 of 31 on the four contests of the first run and 0 of 9 on three new contests, while 29 percent of the in-scope code was read (8 to 100 percent per contest). 15 of the 40 known findings sit in a file that was read, and none of those was found. The scan produces hypotheses to review by hand. It has not been shown to find the issues that audit contests reward.

Correction and limits (24 October 2026, before version 2)

Reading the production scan code on 24 October 2026 showed that earlier text on this page overstated what the paid scan does. What it does today:

• It sends the model at most about 22,000 characters of Solidity source per job, taken from up to 60 files in directory order, and it does not skip test or mock folders. On three recent audit-contest repositories (code-423n4/2025-11-merkl, 2025-11-sukukfi and 2026-04-monetrix) that is 3 to 7 percent of the Solidity source.
• The 7-gate filter is not part of the paid scan. It was taken out because the small model also eliminated real bugs. The report lists raw hypotheses with a self-reported confidence of 0.4 or higher, at most eight, and its disclaimer says so.
• The sample below ran on a repository that belongs to the corpus the framework was built from. It does not show how the scan does on projects it has not seen, and its label "CONFIRMED by Al-Mizaan validation" does not apply to the scan as it runs today.
• We have not measured how many real bugs the scan finds on contests it has not seen. A test on closed audit contests is pre-registered in PREREGISTRATION-2026-10-24.md. The baseline ran on 24 October 2026: 0 of 31 findings found, 2 hypotheses reported and neither matches, one job failed and two reports were empty