bug-bounty-intelligence-mcp 1.0.5 → 1.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (7) hide show
  1. package/BENCHMARK.md +174 -174
  2. package/LICENSE +21 -21
  3. package/METHODOLOGY.md +141 -94
  4. package/README.md +266 -201
  5. package/index.mjs +289 -284
  6. package/package.json +43 -40
  7. package/vulnerability-acceptance-rates.json +92 -97
package/package.json CHANGED
@@ -1,40 +1,43 @@
1
- {
2
- "name": "bug-bounty-intelligence-mcp",
3
- "version": "1.0.5",
4
- "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 27,681 Sherlock/Code4rena submissions, verified acceptance rates from 1,032 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json) — no server required.",
5
- "type": "module",
6
- "main": "index.mjs",
7
- "bin": {
8
- "bug-bounty-intelligence-mcp": "index.mjs"
9
- },
10
- "files": [
11
- "index.mjs",
12
- "README.md",
13
- "BENCHMARK.md",
14
- "METHODOLOGY.md",
15
- "vulnerability-acceptance-rates.json"
16
- ],
17
- "repository": {
18
- "type": "git",
19
- "url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git"
20
- },
21
- "homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
22
- "keywords": [
23
- "mcp",
24
- "smart-contract",
25
- "security",
26
- "audit",
27
- "solidity",
28
- "defi",
29
- "x402",
30
- "bug-bounty"
31
- ],
32
- "author": "holistis",
33
- "license": "MIT",
34
- "dependencies": {
35
- "@modelcontextprotocol/sdk": "^1.29.0"
36
- },
37
- "engines": {
38
- "node": ">=20.0.0"
39
- }
40
- }
1
+ {
2
+ "name": "bug-bounty-intelligence-mcp",
3
+ "version": "1.2.0",
4
+ "description": "MCP server for AI-powered smart contract security analysis. $5 USDC/scan via x402. Drawn from 56,657 Sherlock submissions plus Code4rena, verified acceptance rates from 9,200 exact-reconciled findings. Includes a free, standalone dataset (vulnerability-acceptance-rates.json), no server required.",
5
+ "type": "module",
6
+ "main": "index.mjs",
7
+ "bin": {
8
+ "bug-bounty-intelligence-mcp": "index.mjs"
9
+ },
10
+ "files": [
11
+ "index.mjs",
12
+ "README.md",
13
+ "BENCHMARK.md",
14
+ "METHODOLOGY.md",
15
+ "vulnerability-acceptance-rates.json"
16
+ ],
17
+ "repository": {
18
+ "type": "git",
19
+ "url": "git+https://github.com/holistis/bug-bounty-intelligence-mcp.git"
20
+ },
21
+ "homepage": "https://github.com/holistis/bug-bounty-intelligence-mcp#readme",
22
+ "keywords": [
23
+ "mcp",
24
+ "smart-contract",
25
+ "security",
26
+ "audit",
27
+ "solidity",
28
+ "defi",
29
+ "x402",
30
+ "bug-bounty"
31
+ ],
32
+ "author": "holistis",
33
+ "license": "MIT",
34
+ "scripts": {
35
+ "test": "node test/smoke.mjs"
36
+ },
37
+ "dependencies": {
38
+ "@modelcontextprotocol/sdk": "^1.32.2"
39
+ },
40
+ "engines": {
41
+ "node": ">=20.0.0"
42
+ }
43
+ }
package/vulnerability-acceptance-rates.json CHANGED
@@ -1,97 +1,92 @@
1
- {
2
- "$schema_note": "Free, standalone dataset — no server, no API key, no payment. Embed directly in your own tool.",
3
- "source": "Sherlock audit-competition judging repos (public GitHub)",
4
- "license": "CC0 — public domain, use freely with or without attribution",
5
- "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
6
- "last_updated": "2026-07-21T19:51:20.564Z",
7
- "contests_included": 10,
8
- "total_findings": 1032,
9
- "total_accepted": 461,
10
- "note": "Only contests where accepted+invalid counts reconcile exactly against Sherlock own published results are included. See methodology_url for full scope, limitations, and reproduction steps.",
11
- "patterns": {
12
- "fee-miscalculation": {
13
- "acceptance_rate": 0.5,
14
- "accepted": 55,
15
- "rejected": 51,
16
- "duplicated": 3,
17
- "total": 109
18
- },
19
- "dos-griefing": {
20
- "acceptance_rate": 0.41,
21
- "accepted": 64,
22
- "rejected": 90,
23
- "duplicated": 2,
24
- "total": 156
25
- },
26
- "reentrancy": {
27
- "acceptance_rate": 0.78,
28
- "accepted": 40,
29
- "rejected": 11,
30
- "duplicated": 0,
31
- "total": 51
32
- },
33
- "trusted-actor": {
34
- "acceptance_rate": 0.51,
35
- "accepted": 159,
36
- "rejected": 148,
37
- "duplicated": 4,
38
- "total": 311
39
- },
40
- "overflow": {
41
- "acceptance_rate": 0.58,
42
- "accepted": 26,
43
- "rejected": 19,
44
- "duplicated": 0,
45
- "total": 45
46
- },
47
- "staleness": {
48
- "acceptance_rate": 0.49,
49
- "accepted": 86,
50
- "rejected": 84,
51
- "duplicated": 4,
52
- "total": 174
53
- },
54
- "rounding": {
55
- "acceptance_rate": 0.4,
56
- "accepted": 25,
57
- "rejected": 38,
58
- "duplicated": 0,
59
- "total": 63
60
- },
61
- "access-control": {
62
- "acceptance_rate": 0.47,
63
- "accepted": 35,
64
- "rejected": 39,
65
- "duplicated": 0,
66
- "total": 74
67
- },
68
- "oracle-manipulation": {
69
- "acceptance_rate": 0.36,
70
- "accepted": 47,
71
- "rejected": 78,
72
- "duplicated": 6,
73
- "total": 131
74
- },
75
- "mev-slippage": {
76
- "acceptance_rate": 0.49,
77
- "accepted": 44,
78
- "rejected": 44,
79
- "duplicated": 1,
80
- "total": 89
81
- },
82
- "liquidation": {
83
- "acceptance_rate": 0.29,
84
- "accepted": 4,
85
- "rejected": 9,
86
- "duplicated": 1,
87
- "total": 14
88
- },
89
- "flash-loan": {
90
- "acceptance_rate": 0.46,
91
- "accepted": 6,
92
- "rejected": 6,
93
- "duplicated": 1,
94
- "total": 13
95
- }
96
- }
97
- }
1
+ {
2
+ "$schema_note": "Free, standalone dataset, no server, no API key, no payment. Embed directly in your own tool.",
3
+ "source": "Sherlock and Code4rena audit-competition judging repos (public GitHub)",
4
+ "license": "CC0, public domain, use freely with or without attribution",
5
+ "methodology_url": "https://github.com/holistis/bug-bounty-intelligence-mcp/blob/main/METHODOLOGY.md",
6
+ "last_updated": "2026-11-12T00:00:00.000Z",
7
+ "contests_included": 38,
8
+ "contests_included_by_platform": { "sherlock": 35, "code4rena": 3 },
9
+ "total_findings": 9200,
10
+ "total_accepted": 4011,
11
+ "note": "Only contests where accepted+invalid counts reconcile exactly against the platform's own published results are included (zero tolerance, same rule for both platforms). Code4rena contributes far less than Sherlock because most of its history does not consistently apply a satisfactory/unsatisfactory label the way its October 2023 contests do; those contests are excluded rather than estimated. 'duplicated' is not tracked in this version. See methodology_url for full scope, limitations, and reproduction steps.",
12
+ "patterns": {
13
+ "flash-loan": {
14
+ "acceptance_rate": 0.66,
15
+ "accepted": 127,
16
+ "rejected": 66,
17
+ "total": 193
18
+ },
19
+ "liquidation": {
20
+ "acceptance_rate": 0.66,
21
+ "accepted": 576,
22
+ "rejected": 301,
23
+ "total": 877
24
+ },
25
+ "fee-miscalculation": {
26
+ "acceptance_rate": 0.54,
27
+ "accepted": 313,
28
+ "rejected": 270,
29
+ "total": 583
30
+ },
31
+ "oracle-manipulation": {
32
+ "acceptance_rate": 0.53,
33
+ "accepted": 502,
34
+ "rejected": 447,
35
+ "total": 949
36
+ },
37
+ "staleness": {
38
+ "acceptance_rate": 0.51,
39
+ "accepted": 675,
40
+ "rejected": 640,
41
+ "total": 1315
42
+ },
43
+ "mev-slippage": {
44
+ "acceptance_rate": 0.47,
45
+ "accepted": 179,
46
+ "rejected": 200,
47
+ "total": 379
48
+ },
49
+ "trusted-actor": {
50
+ "acceptance_rate": 0.47,
51
+ "accepted": 1000,
52
+ "rejected": 1127,
53
+ "total": 2127
54
+ },
55
+ "dos-griefing": {
56
+ "acceptance_rate": 0.47,
57
+ "accepted": 383,
58
+ "rejected": 433,
59
+ "total": 816
60
+ },
61
+ "overflow": {
62
+ "acceptance_rate": 0.43,
63
+ "accepted": 167,
64
+ "rejected": 218,
65
+ "total": 385
66
+ },
67
+ "access-control": {
68
+ "acceptance_rate": 0.42,
69
+ "accepted": 356,
70
+ "rejected": 490,
71
+ "total": 846
72
+ },
73
+ "rounding": {
74
+ "acceptance_rate": 0.39,
75
+ "accepted": 205,
76
+ "rejected": 327,
77
+ "total": 532
78
+ },
79
+ "reentrancy": {
80
+ "acceptance_rate": 0.34,
81
+ "accepted": 114,
82
+ "rejected": 218,
83
+ "total": 332
84
+ },
85
+ "idor": {
86
+ "acceptance_rate": 0.26,
87
+ "accepted": 9,
88
+ "rejected": 26,
89
+ "total": 35
90
+ }
91
+ }
92
+ }