Security Tools in Your Editor
WalletGuard exposes six smart contract security tools over the Model Context Protocol. Wire it into Claude Code or Cursor and call them on any Solidity file without leaving your workflow.
What is MCP?
The Model Context Protocol is a simple HTTP/JSON interface that lets an AI coding assistant discover and call external tools. A tool is just a name, a JSON input schema, and a handler. When Claude Code or Cursor connects to our MCP server, our six security tools appear alongside the editor's built-in capabilities.
The server lives at https://walletguard.ai/mcp. GET returns the manifest of available tools; POST executes one. Your editor handles both calls automatically.
Authentication
Tool discovery (GET /mcp) is public. Tool execution (POST /mcp) accepts any of:
- -Bearer service token. Pass your WalletGuard API key in the
Authorizationheader. - -Session cookie. If you are already signed in at walletguard.ai in the same browser profile.
- -x402 USDC payment. Pay per tool call with USDC on Base. No account required. See x402 docs for details.
Claude Code Setup
Add WalletGuard to your Claude Code MCP configuration. On most platforms this lives at ~/.claude.json.
// ~/.claude.json (or your platform equivalent)
{
"mcpServers": {
"walletguard": {
"url": "https://walletguard.ai/mcp",
"type": "http",
"headers": {
"Authorization": "Bearer ${WALLETGUARD_API_KEY}"
}
}
}
}Restart Claude Code and the six WalletGuard tools will appear in the tool picker. Reference them in prompts by name, or just ask Claude to audit the current file.
Cursor Setup
Cursor uses the same MCP protocol. Open Settings, find the MCP Servers section, and add a new HTTP server:
// Cursor: Settings -> MCP -> Add server
{
"mcpServers": {
"walletguard": {
"url": "https://walletguard.ai/mcp",
"type": "http",
"headers": {
"Authorization": "Bearer ${WALLETGUARD_API_KEY}"
}
}
}
}Reload the window after saving. Cursor will fetch the tool manifest and expose the tools to the agent.
Tool Reference
Six tools, all pulled from the live server manifest. Pricing reflects the current published rates.
Check Function
walletguard_check_functionAnalyze a single Solidity function for security vulnerabilities. Returns findings with severity, category, confidence, and remediation.
Explain Vulnerability
walletguard_explain_vulnerabilityExplain a smart contract vulnerability pattern with examples. Returns description, exploit mechanism, code patterns, and fix guidance. Free when matched from the pattern database; $0.01 if LLM-generated.
Verify Fix
walletguard_verify_fixVerify if a code change resolves a specific security finding. Runs a blind re-audit on the fixed code and compares against the original. Returns verdict (resolved/partial/unresolved), regression check, and score delta.
Check Upgrade Safety
walletguard_check_upgrade_safetyCheck if a proxy upgrade from implementation A to B is safe. Analyzes storage layout collisions, initializer gaps, and access control. Accepts source code directly or fetches from on-chain if proxyAddress is provided.
Gas Optimize
walletguard_gas_optimizeFind gas optimization opportunities in Solidity code. Identifies redundant storage reads, calldata vs memory usage, immutable/constant opportunities, and loop optimizations.
Check Standard
walletguard_check_standardCheck ERC standard compliance (ERC-20, ERC-721, ERC-1155, etc.). Validates interface completeness, event emissions, return values, and conformance.
Example Call
POST the tool name and input to /mcp. Here is a direct HTTP call; your editor does this automatically when you invoke a tool.
{
"tool": "walletguard_check_function",
"input": {
"functionSource": "function withdraw(uint256 amount) external {\n require(balances[msg.sender] >= amount);\n (bool ok,) = msg.sender.call{value: amount}(\"\");\n require(ok);\n balances[msg.sender] -= amount;\n}",
"contractContext": "mapping(address => uint256) public balances;"
}
}{
"ok": true,
"result": {
"findings": [
{
"severity": "critical",
"category": "reentrancy",
"affectedFunction": "withdraw",
"confidence": 0.92,
"description": "State update after external call. Classic reentrancy. An attacker can recursively call withdraw before balances is decremented.",
"remediation": "Apply checks-effects-interactions. Update balances BEFORE the external call, or use a nonReentrant guard."
}
]
}
}