bug-bounty-intelligence-mcp 1.0.3 → 1.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/BENCHMARK.md +15 -1
- package/LICENSE +21 -0
- package/METHODOLOGY.md +33 -18
- package/README.md +266 -158
- package/index.mjs +286 -266
- package/package.json +43 -18
- package/vulnerability-acceptance-rates.json +72 -78
package/package.json
CHANGED
|
@@ -1,18 +1,43 @@
|
|
|
1
|
-
{
|
|
2
|
-
"name": "bug-bounty-intelligence-mcp",
|
|
3
|
-
"version": "1.0
|
|
4
|
-
"description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from
|
|
5
|
-
"type": "module",
|
|
6
|
-
"main": "index.mjs",
|
|
7
|
-
"bin": {
|
|
8
|
-
|
|
9
|
-
|
|
10
|
-
"
|
|
11
|
-
|
|
12
|
-
|
|
13
|
-
|
|
14
|
-
|
|
15
|
-
"
|
|
16
|
-
|
|
17
|
-
"
|
|
18
|
-
|
|
1
|
+
{
|
|
2
|
+
"name": "bug-bounty-intelligence-mcp",
|
|
3
|
+
"version": "1.1.0",
|
|
4
|
+
"description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 56,657 Sherlock submissions, verified acceptance rates from 7,388 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json), no server required.",
|
|
5
|
+
"type": "module",
|
|
6
|
+
"main": "index.mjs",
|
|
7
|
+
"bin": {
|
|
8
|
+
"bug-bounty-intelligence-mcp": "index.mjs"
|
|
9
|
+
},
|
|
10
|
+
"files": [
|
|
11
|
+
"index.mjs",
|
|
12
|
+
"README.md",
|
|
13
|
+
"BENCHMARK.md",
|
|
14
|
+
"METHODOLOGY.md",
|
|
15
|
+
"vulnerability-acceptance-rates.json"
|
|
16
|
+
],
|
|
17
|
+
"repository": {
|
|
18
|
+
"type": "git",
|
|
19
|
+
"url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git"
|
|
20
|
+
},
|
|
21
|
+
"homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
|
|
22
|
+
"keywords": [
|
|
23
|
+
"mcp",
|
|
24
|
+
"smart-contract",
|
|
25
|
+
"security",
|
|
26
|
+
"audit",
|
|
27
|
+
"solidity",
|
|
28
|
+
"defi",
|
|
29
|
+
"x402",
|
|
30
|
+
"bug-bounty"
|
|
31
|
+
],
|
|
32
|
+
"author": "holistis",
|
|
33
|
+
"license": "MIT",
|
|
34
|
+
"scripts": {
|
|
35
|
+
"test": "node test/smoke.mjs"
|
|
36
|
+
},
|
|
37
|
+
"dependencies": {
|
|
38
|
+
"@modelcontextprotocol/sdk": "^1.32.2"
|
|
39
|
+
},
|
|
40
|
+
"engines": {
|
|
41
|
+
"node": ">=20.0.0"
|
|
42
|
+
}
|
|
43
|
+
}
|
|
@@ -1,97 +1,91 @@
|
|
|
1
1
|
{
|
|
2
|
-
"$schema_note": "Free, standalone dataset
|
|
2
|
+
"$schema_note": "Free, standalone dataset, no server, no API key, no payment. Embed directly in your own tool.",
|
|
3
3
|
"source": "Sherlock audit-competition judging repos (public GitHub)",
|
|
4
|
-
"license": "CC0
|
|
4
|
+
"license": "CC0, public domain, use freely with or without attribution",
|
|
5
5
|
"methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
|
|
6
|
-
"last_updated": "2026-
|
|
7
|
-
"contests_included":
|
|
8
|
-
"total_findings":
|
|
9
|
-
"total_accepted":
|
|
10
|
-
"note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock own published results are included. See methodology_url for full scope, limitations, and reproduction steps.",
|
|
6
|
+
"last_updated": "2026-11-12T00:00:00.000Z",
|
|
7
|
+
"contests_included": 35,
|
|
8
|
+
"total_findings": 7388,
|
|
9
|
+
"total_accepted": 3694,
|
|
10
|
+
"note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock's own published results are included. 2026-11-12: re-derived from scratch after the 2026-07-21 run was found to rest on an unreliable local issue-count cache (some contests undercounted by an order of magnitude); every count here comes fresh from GitHub's search API and git-tree data, not from a local cache. 'duplicated' is not tracked in this version, see methodology_url. See methodology_url for full scope, limitations, and reproduction steps.",
|
|
11
11
|
"patterns": {
|
|
12
|
+
"flash-loan": {
|
|
13
|
+
"acceptance_rate": 0.69,
|
|
14
|
+
"accepted": 127,
|
|
15
|
+
"rejected": 58,
|
|
16
|
+
"total": 185
|
|
17
|
+
},
|
|
18
|
+
"liquidation": {
|
|
19
|
+
"acceptance_rate": 0.66,
|
|
20
|
+
"accepted": 576,
|
|
21
|
+
"rejected": 293,
|
|
22
|
+
"total": 869
|
|
23
|
+
},
|
|
12
24
|
"fee-miscalculation": {
|
|
13
|
-
"acceptance_rate": 0.
|
|
14
|
-
"accepted":
|
|
15
|
-
"rejected":
|
|
16
|
-
"
|
|
17
|
-
"total": 109
|
|
25
|
+
"acceptance_rate": 0.55,
|
|
26
|
+
"accepted": 297,
|
|
27
|
+
"rejected": 243,
|
|
28
|
+
"total": 540
|
|
18
29
|
},
|
|
19
30
|
"dos-griefing": {
|
|
20
|
-
"acceptance_rate": 0.
|
|
21
|
-
"accepted":
|
|
22
|
-
"rejected":
|
|
23
|
-
"
|
|
24
|
-
"total": 156
|
|
31
|
+
"acceptance_rate": 0.54,
|
|
32
|
+
"accepted": 365,
|
|
33
|
+
"rejected": 315,
|
|
34
|
+
"total": 680
|
|
25
35
|
},
|
|
26
|
-
"
|
|
27
|
-
"acceptance_rate": 0.
|
|
28
|
-
"accepted":
|
|
29
|
-
"rejected":
|
|
30
|
-
"
|
|
31
|
-
|
|
36
|
+
"staleness": {
|
|
37
|
+
"acceptance_rate": 0.54,
|
|
38
|
+
"accepted": 586,
|
|
39
|
+
"rejected": 504,
|
|
40
|
+
"total": 1090
|
|
41
|
+
},
|
|
42
|
+
"oracle-manipulation": {
|
|
43
|
+
"acceptance_rate": 0.54,
|
|
44
|
+
"accepted": 488,
|
|
45
|
+
"rejected": 423,
|
|
46
|
+
"total": 911
|
|
32
47
|
},
|
|
33
48
|
"trusted-actor": {
|
|
34
|
-
"acceptance_rate": 0.
|
|
35
|
-
"accepted":
|
|
36
|
-
"rejected":
|
|
37
|
-
"
|
|
38
|
-
"total": 311
|
|
49
|
+
"acceptance_rate": 0.52,
|
|
50
|
+
"accepted": 935,
|
|
51
|
+
"rejected": 879,
|
|
52
|
+
"total": 1814
|
|
39
53
|
},
|
|
40
|
-
"
|
|
41
|
-
"acceptance_rate": 0.
|
|
42
|
-
"accepted":
|
|
43
|
-
"rejected":
|
|
44
|
-
"
|
|
45
|
-
"total": 45
|
|
54
|
+
"idor": {
|
|
55
|
+
"acceptance_rate": 0.5,
|
|
56
|
+
"accepted": 9,
|
|
57
|
+
"rejected": 9,
|
|
58
|
+
"total": 18
|
|
46
59
|
},
|
|
47
|
-
"
|
|
48
|
-
"acceptance_rate": 0.
|
|
49
|
-
"accepted":
|
|
50
|
-
"rejected":
|
|
51
|
-
"
|
|
52
|
-
"total": 174
|
|
60
|
+
"overflow": {
|
|
61
|
+
"acceptance_rate": 0.48,
|
|
62
|
+
"accepted": 165,
|
|
63
|
+
"rejected": 181,
|
|
64
|
+
"total": 346
|
|
53
65
|
},
|
|
54
|
-
"
|
|
55
|
-
"acceptance_rate": 0.
|
|
56
|
-
"accepted":
|
|
57
|
-
"rejected":
|
|
58
|
-
"
|
|
59
|
-
"total": 63
|
|
66
|
+
"mev-slippage": {
|
|
67
|
+
"acceptance_rate": 0.48,
|
|
68
|
+
"accepted": 178,
|
|
69
|
+
"rejected": 190,
|
|
70
|
+
"total": 368
|
|
60
71
|
},
|
|
61
72
|
"access-control": {
|
|
62
|
-
"acceptance_rate": 0.
|
|
63
|
-
"accepted":
|
|
64
|
-
"rejected":
|
|
65
|
-
"
|
|
66
|
-
"total": 74
|
|
67
|
-
},
|
|
68
|
-
"oracle-manipulation": {
|
|
69
|
-
"acceptance_rate": 0.36,
|
|
70
|
-
"accepted": 47,
|
|
71
|
-
"rejected": 78,
|
|
72
|
-
"duplicated": 6,
|
|
73
|
-
"total": 131
|
|
74
|
-
},
|
|
75
|
-
"mev-slippage": {
|
|
76
|
-
"acceptance_rate": 0.49,
|
|
77
|
-
"accepted": 44,
|
|
78
|
-
"rejected": 44,
|
|
79
|
-
"duplicated": 1,
|
|
80
|
-
"total": 89
|
|
73
|
+
"acceptance_rate": 0.46,
|
|
74
|
+
"accepted": 249,
|
|
75
|
+
"rejected": 289,
|
|
76
|
+
"total": 538
|
|
81
77
|
},
|
|
82
|
-
"
|
|
83
|
-
"acceptance_rate": 0.
|
|
84
|
-
"accepted":
|
|
85
|
-
"rejected":
|
|
86
|
-
"
|
|
87
|
-
"total": 14
|
|
78
|
+
"reentrancy": {
|
|
79
|
+
"acceptance_rate": 0.4,
|
|
80
|
+
"accepted": 111,
|
|
81
|
+
"rejected": 168,
|
|
82
|
+
"total": 279
|
|
88
83
|
},
|
|
89
|
-
"
|
|
90
|
-
"acceptance_rate": 0.
|
|
91
|
-
"accepted":
|
|
92
|
-
"rejected":
|
|
93
|
-
"
|
|
94
|
-
"total": 13
|
|
84
|
+
"rounding": {
|
|
85
|
+
"acceptance_rate": 0.4,
|
|
86
|
+
"accepted": 192,
|
|
87
|
+
"rejected": 293,
|
|
88
|
+
"total": 485
|
|
95
89
|
}
|
|
96
90
|
}
|
|
97
|
-
}
|
|
91
|
+
}
|