V.A.P.E. — On-Chain Security Detective

PYPI · VAPE-MCP-SERVER · SCANNED AUG 20

Autonomous on-chain security detective for Base, exposed over the Model Context Protocol (MCP).

Available components

+6 this week 63 63 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security100

No malware found by supply-chain analysis.Pass
No known CVEs affecting this package version or its production dependencies.Pass
Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it. View diagnostics → Pass
3 of 56 dependencies flagged as unhealthy. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 11 days ago).Pass
Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified

Schema Quality & AI Usability49

0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Fail
AI-judged instruction clarity (excellent).Pass
Tool/resource definitions use about 1166 tokens (~58/item across 20 items; 18 tools + 2 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management40

Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage75

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
26% of tool parameters carry a description.Partial

Capabilities20

Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

pypi · vape-mcp-server

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add juxtaposition1-vape -- uvx vape-mcp-server

# add to Codex CLI

codex mcp add juxtaposition1-vape -- uvx vape-mcp-server

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "juxtaposition1-vape": {
      "type": "local",
      "command": [
        "uvx",
        "vape-mcp-server"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add juxtaposition1-vape --command uvx --arg vape-mcp-server

# ~/.hermes/config.yaml

mcp_servers:
  juxtaposition1-vape:
    command: "uvx"
    args: ["vape-mcp-server"]

// mcp.json

{
  "mcpServers": {
    "juxtaposition1-vape": {
      "command": "uvx",
      "args": [
        "vape-mcp-server"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

19 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
17 Aug 26 +1

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
16 Aug 26 +4
- Security disclosure: fail → unverified ▼ functional
- Stability: unverified → 0.27 ▲ functional
11 Aug 26 +1
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
8 Aug 26 56

First indexed and scored.

Show 4 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 20 Aug 2026 · Analysed pypi/vape-mcp-server@1.1.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result	No attestation
Ecosystem	pypi

Install scripts 1 script

Hook	Tier	Command
build_backend	allowlisted	`setuptools.build_meta`

Dependencies 56 packages

Packages resolved	56
Stale	3
Tree resolution	Complete

MCP tools · 18 exposed · ~1,141 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

bounty_radar ~73

Real, currently-tracked bug-bounty/incident-lead opportunities (Immunefi/Sherlock/DeFiLlama hacks), ranked by VAPE's own numeric fit score. Never LLM-scored.

Input Output Examples

Name	Type	Req	Description
limit	integer	–	default 15
min_fit	integer	–	default 50

No output schema declared.

No examples provided.

contract_source ~47

Contract verification status + source/ABI metadata via Etherscan V2 (free tier). Needs ETHERSCAN_API_KEY.

Input Output Examples

Name	Type	Req	Description
address	string	yes	–
chain	integer	–	–

No output schema declared.

No examples provided.

defillama_chain_overview ~40

A chain's headline TVL + rank among all tracked chains (DefiLlama). Keyless.

Input Output Examples

Name	Type	Req	Description
chain	string	–	–

No output schema declared.

No examples provided.

defillama_protocols_on_chain ~51

Top protocols on a chain by TVL, with category and 24h/7d change. Keyless.

Input Output Examples

Name	Type	Req	Description
chain	string	–	–
top_n	integer	–	–

No output schema declared.

No examples provided.

defillama_token_intel ~72

DefiLlama's full picture of a token: current + first-seen price, and (with a protocol slug) fees/revenue, unlocks, and treasury. Keyless.

Input Output Examples

Name	Type	Req	Description
address	string	yes	–
chain	string	yes	–
protocol_slug	string	–	–

No output schema declared.

No examples provided.

defillama_yield_pools ~83

Yield pools filtered by chain/project/symbol, ranked by TVL, with APY/IL-risk/exposure — enough to spot a yield trap. Keyless.

Input Output Examples

Name	Type	Req	Description
chain	string	–	–
limit	integer	–	–
min_tvl	number	–	–
project	string	–	–
symbol	string	–	–

No output schema declared.

No examples provided.

fear_greed ~23

Current crypto Fear & Greed index (market mood). Keyless.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

global_market ~28

Global crypto market snapshot: BTC/ETH dominance, 24h market-cap change. Keyless.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

investigate_token ~94

Run a V.A.P.E. deep on-chain investigation on a Base token/contract (GoPlus + DexScreener + Base RPC + hack-feed) -> 0-100 safety score and PROCEED/CAUTION/REJECT verdict with evidence. Read-only.

Input Output Examples

Name	Type	Req	Description
address	string	yes	0x token/contract address
chain	string	–	chain id, default 8453 (Base)

No output schema declared.

No examples provided.

mcp_servers ~41

List the MCP servers VAPE can host (reference + community search/scrape) and whether each is live, key-gated, or needs a runtime.

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

memory_search ~71

Query V.A.P.E. Central Memory (SQLite-indexed findings/lessons/skills). Supports free text, category, and days-back filters.

Input Output Examples

Name	Type	Req	Description
category	string	–	finding\|lesson\|skill
days	integer	–	–
limit	integer	–	–
query	string	–	–

No output schema declared.

No examples provided.

memory_stats ~26

Counts across V.A.P.E. Central Memory (by category, severity, high-confidence).

Input Output Examples

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

recent_hacks ~49

Recent DeFi exploits/hacks from the DeFiLlama feed (dated, $ lost, chain, technique). Keyless.

Input Output Examples

Name	Type	Req	Description
chain	string	–	–
limit	integer	–	–

No output schema declared.

No examples provided.

research_scrape ~48

Scrape a page to clean text/markdown via the best available provider (Firecrawl/BrightData/Apify when keyed, keyless MCP fetch otherwise).

Input Output Examples

Name	Type	Req	Description
url	string	yes	–

No output schema declared.

No examples provided.

research_search ~57

Web search via the best available provider (Tavily/Brave when keyed, keyless fallback otherwise) for bounties, protocols, CVEs, incidents.

Input Output Examples

Name	Type	Req	Description
max_results	integer	–	–
query	string	yes	–

No output schema declared.

No examples provided.

scan_token_safety ~56

Fast token safety scan (GoPlus honeypot/tax/owner powers + DexScreener liquidity) returning a verdict. Read-only, keyless.

Input Output Examples

Name	Type	Req	Description
address	string	yes	–
chain	string	–	–

No output schema declared.

No examples provided.

wallet_trace ~108

Wallet/address forensics via Alchemy's Transfers API: recent transfers (any asset or ERC-20 only) or first-seen transfer (funding source). Base/Ethereum/Arbitrum/Optimism. Needs VAPE_TRACE_ALCHEMY_API.

Input Output Examples

Name	Type	Req	Description
address	string	yes	–
chain	string	–	chain id, default 8453 (Base)
limit	integer	–	–
mode	string	–	txs\|erc20\|first, default txs

No output schema declared.

No examples provided.

web_research ~174

Intelligent research crawler: search + robots.txt-respecting scrape into tagged, deduplicated leads (on-chain addresses/tx hashes/CVEs/$TICKERs auto-extracted). max_depth>1 turns on LLM-scored link-following (finds e.g. a news article's linked exploit report or GitHub issue). Persistent cross-run cache/dedup under data/cache/web_sourcer/. Same free-to-call in-process capability other VAPE agents use internally; the external, x402-payable equivalent for third-party agents is the /scan/web_research Worker route ($0.01/call).

Input Output Examples

Name	Type	Req	Description
max_depth	integer	–	default 1 (no link-following); 2+ enables it
max_pages	integer	–	default 8
query	string	yes	–

No output schema declared.

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

8 Aug 20 Aug

Day	Score
8 Aug	56
9 Aug	56
10 Aug	56
11 Aug	57
12 Aug	57
13 Aug	57
14 Aug	57
15 Aug	57
16 Aug	61
17 Aug	62
18 Aug	62
19 Aug	63
20 Aug	63