Security & Testing

automatoncolony.xyz

Provides smart contract security audits with a free check option and paid comprehensive audit reports via x402 payment on Base.

x402 supported2 endpoints6 known toolsFirst detected September 5, 2026Last detected September 13, 2026

ENDPOINT 1

https://automatoncolony.xyz/mcp

No auth detected

MCP server metadata

Name: automaton-colony
Version: 1.0.0

Capabilities

tools

Server instructions

Automaton Colony screens smart contracts and B20 native tokens on Base (eip155:8453). Start with check_contract_free (free, no wallet): observed on-chain facts, no verdict. flash_audit_terms returns the x402 PaymentRequired for a paid Flash Report (price, network, asset, payTo). buy_flash_audit buys it over x402: call it without payment to receive the PaymentRequired, sign an EIP-3009 authorization for exactly that amount, and call again with the PaymentPayload in _meta["x402/payment"]. It returns an orderKey. collect_flash_audit polls the order every 10-15 seconds; once DELIVERED it returns the report JSON, whose SHA-256 was anchored on chain when you paid, and the settlement in _meta["x402/payment-response"]. contract_data_catalog is free and lists single on-chain facts sold one call at a time, with prices from 0.0049 USDC and how long each answer stays valid. buy_contract_data buys one of those over x402 and returns it IN THE SAME CALL: there is no order to poll, which is what separates it from buy_flash_audit. Every answer carries the block it was read at and that block's hash. Every report states what it could not verify. Reports remain collectable for 180 days. Documentation: https://automatoncolony.xyz/llms.txt and https://automatoncolony.xyz/openapi.json.

Known tools 6

check_contract_free

Free, no wallet.

Inferred read-only

flash_audit_terms

Returns the x402 v2 PaymentRequired document for the paid Flash Report: amount in USDC base units, network, asset, payTo and the request schema.

Inferred read-only

buy_flash_audit

Paid over x402 in USDC on Base.

Inferred read-only

collect_flash_audit

Status of an x402 order while it settles and generates; once DELIVERED, the report JSON itself.

Inferred read-only

contract_data_catalog

Free, no wallet.

Inferred read-only

buy_contract_data

Paid over x402 in USDC on Base, from 0.0049 per call.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.automaton-colony]
url = "https://automatoncolony.xyz/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "automaton-colony": {
      "type": "http",
      "url": "https://automatoncolony.xyz/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: automaton-colony
Remote MCP URL: https://automatoncolony.xyz/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "automaton-colony": {
      "url": "https://automatoncolony.xyz/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "automaton-colony": {
      "type": "http",
      "url": "https://automatoncolony.xyz/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "automaton-colony",
  "transport": "streamable-http",
  "url": "https://automatoncolony.xyz/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

ENDPOINT 2

https://nebula.automatoncolony.xyz/mcp

Auth required

Known tools 0

No tool metadata was available in the registry cache.

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.automatoncolony-xyz]
url = "https://nebula.automatoncolony.xyz/mcp"
enabled = true
bearer_token_env_var = "MCP_BEARER_TOKEN"

Authentication is required. Replace the placeholder locally and never commit a secret.

Claude Code

.mcp.json

{
  "mcpServers": {
    "automatoncolony-xyz": {
      "type": "http",
      "url": "https://nebula.automatoncolony.xyz/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_BEARER_TOKEN"
      }
    }
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Claude Desktop

Settings → Connectors → Add custom connector

Name: automatoncolony-xyz
Remote MCP URL: https://nebula.automatoncolony.xyz/mcp

Add the URL as a custom connector, then complete its supported authorization flow. Claude Desktop remote connectors are configured in the UI.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "automatoncolony-xyz": {
      "url": "https://nebula.automatoncolony.xyz/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_BEARER_TOKEN"
      }
    }
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Visual Studio Code

.vscode/mcp.json

{
  "servers": {
    "automatoncolony-xyz": {
      "type": "http",
      "url": "https://nebula.automatoncolony.xyz/mcp",
      "headers": {
        "Authorization": "Bearer ${input:mcp-token}"
      }
    }
  },
  "inputs": [
    {
      "type": "promptString",
      "id": "mcp-token",
      "description": "automatoncolony-xyz bearer token",
      "password": true
    }
  ]
}

Authentication is required. Replace the placeholder locally and never commit a secret.

Generic MCP

Client-specific MCP configuration

{
  "name": "automatoncolony-xyz",
  "transport": "streamable-http",
  "url": "https://nebula.automatoncolony.xyz/mcp",
  "headers": {
    "Authorization": "Bearer YOUR_BEARER_TOKEN"
  }
}

Authentication is required. Replace the placeholder locally and never commit a secret.

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.