# V.A.P.E. — On-Chain Security Detective (pypi · vape-mcp-server)

Autonomous on-chain security detective for Base, exposed over the Model Context Protocol (MCP).

- Trust score: 63/100 (medium)
- Change this week: +6
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-20

## Components

- pypi · `vape-mcp-server`: 63/100 (this document), [markdown](https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server.md), [page](https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server)

## Channel facts

- Registry: `pypi`
- Package: `vape-mcp-server`
- Version: `1.1.1`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-20.

- **Supply Chain Security**: 100/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - Runs setuptools.build_meta at install time, a recognised native-build step with no shell scripting around it.
  - 3 of 56 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 11 days ago).
  - Security-disclosure policy not yet verified: we couldn't inspect the source repository.
- **Schema Quality & AI Usability**: 49/100
  - 0% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1166 tokens (~58/item across 20 items; 18 tools + 2 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 40/100
  - Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 75/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 26% of tool parameters carry a description.
- **Capabilities**: 20/100
  - Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add juxtaposition1-vape -- uvx vape-mcp-server
```

### Codex

```bash
codex mcp add juxtaposition1-vape -- uvx vape-mcp-server
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "juxtaposition1-vape": {
      "type": "local",
      "command": [
        "uvx",
        "vape-mcp-server"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add juxtaposition1-vape --command uvx --arg vape-mcp-server
```

### Hermes

```yaml
mcp_servers:
  juxtaposition1-vape:
    command: "uvx"
    args: ["vape-mcp-server"]
```

### Other

```json
{
  "mcpServers": {
    "juxtaposition1-vape": {
      "command": "uvx",
      "args": [
        "vape-mcp-server"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-19 (score 63, +1)

No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-17 (score 62, +1)

No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-16 (score 61, +4)

- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Stability: unverified → 0.27

### 2026-08-11 (score 57, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-08 (score 56)

First indexed and scored.

## MCP tools (18)

### `investigate_token` (~94 tokens)

Run a V.A.P.E. deep on-chain investigation on a Base token/contract (GoPlus + DexScreener + Base RPC + hack-feed) -> 0-100 safety score and PROCEED/CAUTION/REJECT verdict with evidence. Read-only.

Input parameters:

- `address` (string, required): 0x token/contract address
- `chain` (string): chain id, default 8453 (Base)

### `scan_token_safety` (~56 tokens)

Fast token safety scan (GoPlus honeypot/tax/owner powers + DexScreener liquidity) returning a verdict. Read-only, keyless.

Input parameters:

- `address` (string, required)
- `chain` (string)

### `recent_hacks` (~49 tokens)

Recent DeFi exploits/hacks from the DeFiLlama feed (dated, $ lost, chain, technique). Keyless.

Input parameters:

- `chain` (string)
- `limit` (integer)

### `fear_greed` (~23 tokens)

Current crypto Fear & Greed index (market mood). Keyless.

### `memory_search` (~71 tokens)

Query V.A.P.E. Central Memory (SQLite-indexed findings/lessons/skills). Supports free text, category, and days-back filters.

Input parameters:

- `category` (string): finding|lesson|skill
- `days` (integer)
- `limit` (integer)
- `query` (string)

### `memory_stats` (~26 tokens)

Counts across V.A.P.E. Central Memory (by category, severity, high-confidence).

### `research_search` (~57 tokens)

Web search via the best available provider (Tavily/Brave when keyed, keyless fallback otherwise) for bounties, protocols, CVEs, incidents.

Input parameters:

- `max_results` (integer)
- `query` (string, required)

### `research_scrape` (~48 tokens)

Scrape a page to clean text/markdown via the best available provider (Firecrawl/BrightData/Apify when keyed, keyless MCP fetch otherwise).

Input parameters:

- `url` (string, required)

### `mcp_servers` (~41 tokens)

List the MCP servers VAPE can host (reference + community search/scrape) and whether each is live, key-gated, or needs a runtime.

### `web_research` (~174 tokens)

Intelligent research crawler: search + robots.txt-respecting scrape into tagged, deduplicated leads (on-chain addresses/tx hashes/CVEs/$TICKERs auto-extracted). max_depth>1 turns on LLM-scored link-following (finds e.g. a news article's linked exploit report or GitHub issue). Persistent cross-run cache/dedup under data/cache/web_sourcer/. Same free-to-call in-process capability other VAPE agents use internally; the external, x402-payable equivalent for third-party agents is the /scan/web_research Worker route ($0.01/call).

Input parameters:

- `max_depth` (integer): default 1 (no link-following); 2+ enables it
- `max_pages` (integer): default 8
- `query` (string, required)

### `wallet_trace` (~108 tokens)

Wallet/address forensics via Alchemy's Transfers API: recent transfers (any asset or ERC-20 only) or first-seen transfer (funding source). Base/Ethereum/Arbitrum/Optimism. Needs VAPE_TRACE_ALCHEMY_API.

Input parameters:

- `address` (string, required)
- `chain` (string): chain id, default 8453 (Base)
- `limit` (integer)
- `mode` (string): txs|erc20|first, default txs

### `contract_source` (~47 tokens)

Contract verification status + source/ABI metadata via Etherscan V2 (free tier). Needs ETHERSCAN_API_KEY.

Input parameters:

- `address` (string, required)
- `chain` (integer)

### `global_market` (~28 tokens)

Global crypto market snapshot: BTC/ETH dominance, 24h market-cap change. Keyless.

### `defillama_token_intel` (~72 tokens)

DefiLlama's full picture of a token: current + first-seen price, and (with a protocol slug) fees/revenue, unlocks, and treasury. Keyless.

Input parameters:

- `address` (string, required)
- `chain` (string, required)
- `protocol_slug` (string)

### `defillama_chain_overview` (~40 tokens)

A chain's headline TVL + rank among all tracked chains (DefiLlama). Keyless.

Input parameters:

- `chain` (string)

### `defillama_protocols_on_chain` (~51 tokens)

Top protocols on a chain by TVL, with category and 24h/7d change. Keyless.

Input parameters:

- `chain` (string)
- `top_n` (integer)

### `defillama_yield_pools` (~83 tokens)

Yield pools filtered by chain/project/symbol, ranked by TVL, with APY/IL-risk/exposure — enough to spot a yield trap. Keyless.

Input parameters:

- `chain` (string)
- `limit` (integer)
- `min_tvl` (number)
- `project` (string)
- `symbol` (string)

### `bounty_radar` (~73 tokens)

Real, currently-tracked bug-bounty/incident-lead opportunities (Immunefi/Sherlock/DeFiLlama hacks), ranked by VAPE's own numeric fit score. Never LLM-scored.

Input parameters:

- `limit` (integer): default 15
- `min_fit` (integer): default 50

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Dependencies. The full working is on the page: https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server#diagnostics

## Score history

- 2026-08-20: 63
- 2026-08-19: 63
- 2026-08-18: 62
- 2026-08-17: 62
- 2026-08-16: 61
- 2026-08-15: 57
- 2026-08-14: 57
- 2026-08-13: 57
- 2026-08-12: 57
- 2026-08-11: 57
- 2026-08-10: 56
- 2026-08-09: 56
- 2026-08-08: 56

## Links

- PyPI project: https://pypi.org/project/vape-mcp-server/
- Socket report: https://socket.dev/pypi/package/vape-mcp-server
- Repository: https://github.com/jUXTAPOSITION1/V.A.P.E
- Changelog RSS feed: https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server.xml
- Changelog JSON feed: https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server.json
- HTML version of this page: https://verifymcp.io/servers/juxtaposition1-vape/vape-mcp-server