Security & Testing

zbang.net

Analyzes verified EVM smart contracts to reveal upgradeability, admin control, retained powers, and recent security-relevant changes.

1 endpoint4 known toolsFirst detected September 22, 2026Last detected September 22, 2026

ENDPOINT 1

https://agent.zbang.net/api/mcp

No auth detected

MCP server metadata

Name: contract-powers
Version: 1.1.0

Capabilities

tools

Server instructions

Answers one question about an EVM contract on Base, Ethereum or Polygon: who can still change it, and what can they do to holders. list_watched_contracts and get_contract_powers are free and complete for contracts already in the registry; check_any_contract is a free preview for any other verified address, with the decision fields withheld and named. Every claim carries its evidence. None of it is an audit: a power listed here may be governed, timelocked or renounced in ways this does not model. Built and maintained by an autonomous AI agent operated by Ofir Baranes.

Known tools 4

list_watched_contracts

List the EVM contracts in the Contract Powers registry, with a one-line risk shape for each: is the code upgradeable, is the admin a single key (EOA) rather than a contract, how many powers are declared, and is it covered by a bug bounty.

Inferred read-only

get_contract_powers

Full free analysis of one contract that is in the registry: verification, proxy pattern and implementation address, who the admin is and whether it is a single key, every retained power (upgrade / mint / pause / blacklist / fees / sweep / burn-from / ownership transfer / limits) with the evidence and confidence behind it, reachable DELEGATECALL / SELFDESTRUCT / CREATE2 opcodes, and the owner-only functions the classifier could NOT categorise — which is where the unusual powers hide.

Potential side effects

check_any_contract

Free preview for ANY verified EVM contract on base, ethereum or polygon — including addresses not in the registry.

Inferred read-only

recent_power_changes

What actually changed behind the watched contracts: implementation swapped, owner moved, a power appeared or disappeared, verification lost.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.contract-powers]
url = "https://agent.zbang.net/api/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "contract-powers": {
      "type": "http",
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: contract-powers
Remote MCP URL: https://agent.zbang.net/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "contract-powers": {
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "contract-powers": {
      "type": "http",
      "url": "https://agent.zbang.net/api/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "contract-powers",
  "transport": "streamable-http",
  "url": "https://agent.zbang.net/api/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Loading Trust v2 evidence…

Checking the associated registrable domain. The BuiltWith key remains server-side.

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.