How to Use the Smart Contract Scanner API — Free REST + MCP Server

#web3 #solidity #security #mcp

Deploying a smart contract without auditing it is like shipping code without tests — except bugs cost real money. This API scans Solidity code for reentrancy, overflow, access control, and gas optimization issues in seconds.

Try It Right Now

curl -s -X POST https://api.lazy-mac.com/smart-contract/api/v1/quick-scan \
  -H "Content-Type: application/json" \
  -d '{"code": "pragma solidity ^0.8.0; contract Vault { function withdraw() public { payable(msg.sender).transfer(address(this).balance); } }"}' | jq

Response:

{
  "success": true,
  "report": {
    "title": "Smart Contract Security Audit Report",
    "overview": {
      "riskScore": 0,
      "riskLevel": "Safe",
      "riskIndicator": "PASS",
      "summary": {
        "total": 0, "critical": 0, "high": 0,
        "medium": 0, "low": 0, "info": 0
      },
      "verdict": "No significant vulnerabilities detected."
    },
    "contractInfo": {
      "solidityVersion": "0.8.0",
      "functionsAnalyzed": 0,
      "detectorsRun": 5
    }
  }
}

All Endpoints

Endpoint	Description
`POST /api/v1/scan`	Full deep audit
`POST /api/v1/quick-scan`	Fast vulnerability check
`POST /api/v1/gas-analysis`	Gas optimization report
`GET /api/v1/vulnerabilities`	List all detectable vulnerability types

Deep Scan Example

curl -s -X POST https://api.lazy-mac.com/smart-contract/api/v1/scan \
  -H "Content-Type: application/json" \
  -d '{"code": "YOUR_SOLIDITY_SOURCE"}' | jq

Use as an MCP Server

Add to Claude or Cursor and ask: "Audit this contract for reentrancy vulnerabilities"

{
  "mcpServers": {
    "smart-contract": {
      "url": "https://api.lazy-mac.com/smart-contract/mcp"
    }
  }
}

JavaScript Example

const res = await fetch(
  "https://api.lazy-mac.com/smart-contract/api/v1/quick-scan",
  {
    method: "POST",
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      code: contractSource
    })
  }
);
const audit = await res.json();
console.log(`Risk: ${audit.report.overview.riskLevel}`);