bug-bounty-intelligence-mcp 1.0.5 → 1.1.0

package/package.json

@@ -1,40 +1,43 @@
-{
-  "name": "bug-bounty-intelligence-mcp",
-  "version": "1.0.5",
-  "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 27,681 Sherlock/Code4rena submissions, verified acceptance rates from 1,032 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json) — no server required.",
-  "type": "module",
-  "main": "index.mjs",
-  "bin": {
-    "bug-bounty-intelligence-mcp": "index.mjs"
-  },
-  "files": [
-    "index.mjs",
-    "README.md",
-    "BENCHMARK.md",
-    "METHODOLOGY.md",
-    "vulnerability-acceptance-rates.json"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git"
-  },
-  "homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
-  "keywords": [
-    "mcp",
-    "smart-contract",
-    "security",
-    "audit",
-    "solidity",
-    "defi",
-    "x402",
-    "bug-bounty"
-  ],
-  "author": "holistis",
-  "license": "MIT",
-  "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.29.0"
-  },
-  "engines": {
-    "node": ">=20.0.0"
-  }
-}
+{
+  "name": "bug-bounty-intelligence-mcp",
+  "version": "1.1.0",
+  "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 56,657 Sherlock submissions, verified acceptance rates from 7,388 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json), no server required.",
+  "type": "module",
+  "main": "index.mjs",
+  "bin": {
+    "bug-bounty-intelligence-mcp": "index.mjs"
+  },
+  "files": [
+    "index.mjs",
+    "README.md",
+    "BENCHMARK.md",
+    "METHODOLOGY.md",
+    "vulnerability-acceptance-rates.json"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git"
+  },
+  "homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
+  "keywords": [
+    "mcp",
+    "smart-contract",
+    "security",
+    "audit",
+    "solidity",
+    "defi",
+    "x402",
+    "bug-bounty"
+  ],
+  "author": "holistis",
+  "license": "MIT",
+  "scripts": {
+    "test": "node test/smoke.mjs"
+  },
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.32.2"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  }
+}

package/vulnerability-acceptance-rates.json

@@ -1,97 +1,91 @@
-{
-  "$schema_note": "Free, standalone dataset — no server, no API key, no payment. Embed directly in your own tool.",
-  "source": "Sherlock audit-competition judging repos (public GitHub)",
-  "license": "CC0 — public domain, use freely with or without attribution",
-  "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
-  "last_updated": "2026-07-21T19:51:20.564Z",
-  "contests_included": 10,
-  "total_findings": 1032,
-  "total_accepted": 461,
-  "note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock own published results are included. See methodology_url for full scope, limitations, and reproduction steps.",
-  "patterns": {
-    "fee-miscalculation": {
-      "acceptance_rate": 0.5,
-      "accepted": 55,
-      "rejected": 51,
-      "duplicated": 3,
-      "total": 109
-    },
-    "dos-griefing": {
-      "acceptance_rate": 0.41,
-      "accepted": 64,
-      "rejected": 90,
-      "duplicated": 2,
-      "total": 156
-    },
-    "reentrancy": {
-      "acceptance_rate": 0.78,
-      "accepted": 40,
-      "rejected": 11,
-      "duplicated": 0,
-      "total": 51
-    },
-    "trusted-actor": {
-      "acceptance_rate": 0.51,
-      "accepted": 159,
-      "rejected": 148,
-      "duplicated": 4,
-      "total": 311
-    },
-    "overflow": {
-      "acceptance_rate": 0.58,
-      "accepted": 26,
-      "rejected": 19,
-      "duplicated": 0,
-      "total": 45
-    },
-    "staleness": {
-      "acceptance_rate": 0.49,
-      "accepted": 86,
-      "rejected": 84,
-      "duplicated": 4,
-      "total": 174
-    },
-    "rounding": {
-      "acceptance_rate": 0.4,
-      "accepted": 25,
-      "rejected": 38,
-      "duplicated": 0,
-      "total": 63
-    },
-    "access-control": {
-      "acceptance_rate": 0.47,
-      "accepted": 35,
-      "rejected": 39,
-      "duplicated": 0,
-      "total": 74
-    },
-    "oracle-manipulation": {
-      "acceptance_rate": 0.36,
-      "accepted": 47,
-      "rejected": 78,
-      "duplicated": 6,
-      "total": 131
-    },
-    "mev-slippage": {
-      "acceptance_rate": 0.49,
-      "accepted": 44,
-      "rejected": 44,
-      "duplicated": 1,
-      "total": 89
-    },
-    "liquidation": {
-      "acceptance_rate": 0.29,
-      "accepted": 4,
-      "rejected": 9,
-      "duplicated": 1,
-      "total": 14
-    },
-    "flash-loan": {
-      "acceptance_rate": 0.46,
-      "accepted": 6,
-      "rejected": 6,
-      "duplicated": 1,
-      "total": 13
-    }
-  }
-}
+{
+  "$schema_note": "Free, standalone dataset, no server, no API key, no payment. Embed directly in your own tool.",
+  "source": "Sherlock audit-competition judging repos (public GitHub)",
+  "license": "CC0, public domain, use freely with or without attribution",
+  "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
+  "last_updated": "2026-11-12T00:00:00.000Z",
+  "contests_included": 35,
+  "total_findings": 7388,
+  "total_accepted": 3694,
+  "note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock's own published results are included. 2026-11-12: re-derived from scratch after the 2026-07-21 run was found to rest on an unreliable local issue-count cache (some contests undercounted by an order of magnitude); every count here comes fresh from GitHub's search API and git-tree data, not from a local cache. 'duplicated' is not tracked in this version, see methodology_url. See methodology_url for full scope, limitations, and reproduction steps.",
+  "patterns": {
+    "flash-loan": {
+      "acceptance_rate": 0.69,
+      "accepted": 127,
+      "rejected": 58,
+      "total": 185
+    },
+    "liquidation": {
+      "acceptance_rate": 0.66,
+      "accepted": 576,
+      "rejected": 293,
+      "total": 869
+    },
+    "fee-miscalculation": {
+      "acceptance_rate": 0.55,
+      "accepted": 297,
+      "rejected": 243,
+      "total": 540
+    },
+    "dos-griefing": {
+      "acceptance_rate": 0.54,
+      "accepted": 365,
+      "rejected": 315,
+      "total": 680
+    },
+    "staleness": {
+      "acceptance_rate": 0.54,
+      "accepted": 586,
+      "rejected": 504,
+      "total": 1090
+    },
+    "oracle-manipulation": {
+      "acceptance_rate": 0.54,
+      "accepted": 488,
+      "rejected": 423,
+      "total": 911
+    },
+    "trusted-actor": {
+      "acceptance_rate": 0.52,
+      "accepted": 935,
+      "rejected": 879,
+      "total": 1814
+    },
+    "idor": {
+      "acceptance_rate": 0.5,
+      "accepted": 9,
+      "rejected": 9,
+      "total": 18
+    },
+    "overflow": {
+      "acceptance_rate": 0.48,
+      "accepted": 165,
+      "rejected": 181,
+      "total": 346
+    },
+    "mev-slippage": {
+      "acceptance_rate": 0.48,
+      "accepted": 178,
+      "rejected": 190,
+      "total": 368
+    },
+    "access-control": {
+      "acceptance_rate": 0.46,
+      "accepted": 249,
+      "rejected": 289,
+      "total": 538
+    },
+    "reentrancy": {
+      "acceptance_rate": 0.4,
+      "accepted": 111,
+      "rejected": 168,
+      "total": 279
+    },
+    "rounding": {
+      "acceptance_rate": 0.4,
+      "accepted": 192,
+      "rejected": 293,
+      "total": 485
+    }
+  }
+}