bug-bounty-intelligence-mcp 1.0.2 → 1.0.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +14 -0
  2. package/package.json +3 -3
  3. package/vulnerability-acceptance-rates.json +97 -0
package/README.md CHANGED
@@ -11,6 +11,20 @@ results could be exactly reconciled against Sherlock's own published outcomes
11
11
  across 10 contests. We'd rather show fewer, verified numbers than a bigger set we can't stand
12
12
  behind. See [METHODOLOGY.md](METHODOLOGY.md) for exactly why, and how to reproduce it.
13
13
 
14
+ ## Free dataset — no server, no MCP, no payment
15
+
16
+ [`vulnerability-acceptance-rates.json`](vulnerability-acceptance-rates.json) is the same data
17
+ `list_vulnerability_patterns` serves, as a static file. No API call, no account, no network
18
+ dependency at all — download it, or copy it into your own tool's rule set. CC0 licensed, use it
19
+ however you want, credit optional.
20
+
21
+ ```bash
22
+ curl -sO https://raw.githubusercontent.com/holistis/bug-bounty-intelligence-mcp/main/vulnerability-acceptance-rates.json
23
+ ```
24
+
25
+ If you're building a local-first / offline security scanner and the paid `scan_contract` tool
26
+ below isn't a fit for your project's architecture, this file might still be useful on its own.
27
+
14
28
  ## Benchmark: vs Slither
15
29
 
16
30
  **[See the full benchmark →](BENCHMARK.md)**
package/package.json CHANGED
@@ -1,11 +1,11 @@
1
1
  {
2
2
  "name": "bug-bounty-intelligence-mcp",
3
- "version": "1.0.2",
4
- "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 27,681 Sherlock/Code4rena submissions, verified acceptance rates from 1,032 exact-reconciled findings.",
3
+ "version": "1.0.3",
4
+ "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 27,681 Sherlock/Code4rena submissions, verified acceptance rates from 1,032 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json) — no server required.",
5
5
  "type": "module",
6
6
  "main": "index.mjs",
7
7
  "bin": { "bug-bounty-intelligence-mcp": "index.mjs" },
8
- "files": ["index.mjs", "README.md", "BENCHMARK.md", "METHODOLOGY.md"],
8
+ "files": ["index.mjs", "README.md", "BENCHMARK.md", "METHODOLOGY.md", "vulnerability-acceptance-rates.json"],
9
9
  "repository": { "type": "git", "url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git" },
10
10
  "homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
11
11
  "keywords": ["mcp", "smart-contract", "security", "audit", "solidity", "defi", "x402", "bug-bounty"],
package/vulnerability-acceptance-rates.json ADDED
@@ -0,0 +1,97 @@
1
+ {
2
+ "$schema_note": "Free, standalone dataset — no server, no API key, no payment. Embed directly in your own tool.",
3
+ "source": "Sherlock audit-competition judging repos (public GitHub)",
4
+ "license": "CC0 — public domain, use freely with or without attribution",
5
+ "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
6
+ "last_updated": "2026-07-21T19:51:20.564Z",
7
+ "contests_included": 10,
8
+ "total_findings": 1032,
9
+ "total_accepted": 461,
10
+ "note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock own published results are included. See methodology_url for full scope, limitations, and reproduction steps.",
11
+ "patterns": {
12
+ "fee-miscalculation": {
13
+ "acceptance_rate": 0.5,
14
+ "accepted": 55,
15
+ "rejected": 51,
16
+ "duplicated": 3,
17
+ "total": 109
18
+ },
19
+ "dos-griefing": {
20
+ "acceptance_rate": 0.41,
21
+ "accepted": 64,
22
+ "rejected": 90,
23
+ "duplicated": 2,
24
+ "total": 156
25
+ },
26
+ "reentrancy": {
27
+ "acceptance_rate": 0.78,
28
+ "accepted": 40,
29
+ "rejected": 11,
30
+ "duplicated": 0,
31
+ "total": 51
32
+ },
33
+ "trusted-actor": {
34
+ "acceptance_rate": 0.51,
35
+ "accepted": 159,
36
+ "rejected": 148,
37
+ "duplicated": 4,
38
+ "total": 311
39
+ },
40
+ "overflow": {
41
+ "acceptance_rate": 0.58,
42
+ "accepted": 26,
43
+ "rejected": 19,
44
+ "duplicated": 0,
45
+ "total": 45
46
+ },
47
+ "staleness": {
48
+ "acceptance_rate": 0.49,
49
+ "accepted": 86,
50
+ "rejected": 84,
51
+ "duplicated": 4,
52
+ "total": 174
53
+ },
54
+ "rounding": {
55
+ "acceptance_rate": 0.4,
56
+ "accepted": 25,
57
+ "rejected": 38,
58
+ "duplicated": 0,
59
+ "total": 63
60
+ },
61
+ "access-control": {
62
+ "acceptance_rate": 0.47,
63
+ "accepted": 35,
64
+ "rejected": 39,
65
+ "duplicated": 0,
66
+ "total": 74
67
+ },
68
+ "oracle-manipulation": {
69
+ "acceptance_rate": 0.36,
70
+ "accepted": 47,
71
+ "rejected": 78,
72
+ "duplicated": 6,
73
+ "total": 131
74
+ },
75
+ "mev-slippage": {
76
+ "acceptance_rate": 0.49,
77
+ "accepted": 44,
78
+ "rejected": 44,
79
+ "duplicated": 1,
80
+ "total": 89
81
+ },
82
+ "liquidation": {
83
+ "acceptance_rate": 0.29,
84
+ "accepted": 4,
85
+ "rejected": 9,
86
+ "duplicated": 1,
87
+ "total": 14
88
+ },
89
+ "flash-loan": {
90
+ "acceptance_rate": 0.46,
91
+ "accepted": 6,
92
+ "rejected": 6,
93
+ "duplicated": 1,
94
+ "total": 13
95
+ }
96
+ }
97
+ }