DeFi safety checks on Base before you sign: honeypot, owner-power scan, approval risk, Aave health.
A DeFi safety MCP server that evaluates transactions and tokens on Base L2 before signing. It provides pre-execution checks such as honeypot detection, owner-power scanning, approval risk assessment, and Aave health insights, serving as a protective layer for DeFi interactions.
🛠️ Key Features
Honeypot detection to identify deceptive tokens
Owner-power scan to assess control risk
Approval risk analysis for token allowances
Aave health checks for liquidity and risk signals
Designed to pair with other MCPs as a safety layer
🚀 Use Cases
Pre-signature safety validation for DeFi transfers on Base L2
Integrating with agent workflows to filter risky tokens
Guarding DeFi transactions and token deployments from unsafe tokens
⚡ Developer Benefits
Clear MCP interface for safety checks prior to execution
Lightweight, companion MCP to enhance existing workflows
Open source licensing (MIT) and npm availability
⚠️ Limitations
Described features are based on readme excerpt; exact behavior may vary with implementation refinements
Focused on Base L2 DeFi safety checks; not a universal risk scanner
The safety layer that checks a DeFi transaction or token before your agent (or you) signs — on Base L2. Sits in front of execution MCPs (it pairs with them, it doesn't compete): honeypot detection, owner-power scans, approval-drain checks, position health, and executable prices — all from live on-chain state.
No API keys required — works out of the box against public Base RPCs (bring your own RPC for speed via BASE_RPC_URL). Read-only: it never holds keys, signs, or submits.
Guard-before-signing tools
Tool
What it answers
token_safety_screen
"Is this token safe to buy/approve before I sign?" — honeypot detection (can you actually sell it back?), real round-trip cost (fees + tax both ways), and whether ownership is renounced (a live owner can often change taxes / pause / mint). One risk verdict.
scan_dangerous_capabilities
"What can the owner do to me?" — scans the deployed bytecode for owner-only powers: mint, pause, blacklist, adjustable fees/taxes, max-tx limits, trading toggles, proxy upgradeTo. Flags the capability, no explorer key needed.
approval_risk
"Is this approval dangerous?" — reads the live allowance an owner granted a spender, flags unlimited approvals (the allowance-drain vector) and whether the spender is a contract or an EOA. Current exposure = what could be pulled right now.
Data tools
Tool
What it answers
aave_position_health
"Is this Aave V3 position safe?" — live health factor, collateral/debt in USD, LTV, liquidation threshold, and a plain risk level (healthy / elevated / critical / LIQUIDATABLE).
quote_swap
"What would this swap actually return right now?" — exact-input quote via Uniswap V3 QuoterV2, best of all 4 fee tiers, with gas estimate. Executable price, not an oracle.
token_risk_snapshot
"Can I get out of this token?" — ERC-20 metadata + real market depth measured by round-trip quotes (WETH → token → WETH) at two sizes. High round-trip loss = thin or trapped liquidity, whatever the chart says.
Why round-trip depth instead of "liquidity" numbers
TVL and pool-size numbers are easy to fake and easy to misread. A round-trip quote against live state measures the only thing that matters: what you lose entering and exiting right now (fees + price impact, both ways). If a token can be bought but not sold, this tool says so (UNTRADABLE).
Install
bash
npx @iniit/defi-guard-mcp # or from source: npm install && npm run build
Claude Code
bash
claude mcp add defi-guard -- npx -y @iniit/defi-guard-mcp
BASE_RPC_URL is optional; without it the server rotates across public Base endpoints with automatic fallback and retries.
Example
"Before I approve TOKEN X to this router, is any of it risky?"
The agent calls token_safety_screen (can I sell it back? is ownership renounced?), scan_dangerous_capabilities (can the owner mint/blacklist/pause?), and approval_risk (is this an unlimited allowance to an EOA?) — and answers with live on-chain facts instead of vibes, before you sign.
Honesty notes (read this)
Quotes are simulations against live state (eth_call). Real execution adds slippage between quote and inclusion.
Contract addresses (Aave V3 Pool, QuoterV2) are Base mainnet constants, validated against live chain state.
This is a read-only tool. It never holds keys, signs, or submits transactions.
Not financial advice; it reports on-chain state, decisions are yours.
Test
bash
npm run build # tsc — type-checks and emits dist/. Tools are verified against live Base state.
License
MIT
Install
Configuration
Environment variables
BASE_RPC_URL
Optional Base RPC endpoint; defaults to public fallback pool