MCP server providing Base L2 DeFi tools for AI agents
Server has 17 tools with schemas and descriptions present, but quality is inconsistent. Most descriptions are adequate (50-150 chars) but lack actionable context for LLM selection. Parameter descriptions are minimal or absent. No error handling guidance, no output schemas documented, no tool annotations. Many tools combine multiple concerns (e.g., send_transaction does gas estimation + dry-run). Naming is mostly verb-noun but some tools are vague (e.g., 'call_contract' could mean read or write). Critical security issue: PRIVATE_KEY exposed as environment variable with no mention of secret injection pattern. No pagination support despite tools returning lists. Schemas present but incomplete, many lack type constraints, enums, or ranges.
Add liquidity to a Uniswap V3 concentrated position (simulated)
Get current Base L2 gas prices in Gwei with safe/recommended/fast tiers.
Get current price of a token on Base L2.
Read contract state or execute a write with ABI validation (simulated)
Scan smart contract code for vulnerabilities on Base L2. Returns risk score + findings.
Get DEX swap quote on Base L2.
CRITICAL: PRIVATE_KEY exposed as environment variable with no secret injection pattern. Credentials must never appear in tool parameters or environment without vault integration. Agent traces log all parameters, secrets leak into logs and prompt history.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields. E.g., does yield_farm return pool_id, pool_name, or both? Does get_transaction_history return tx_hash, status, timestamp?
No error handling guidance. Tools lack recovery hints. E.g., if send_transaction fails, should LLM retry, ask user, or call a different tool? No categorization of retryable vs fatal errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
Execute Aave V3 flash loan arbitrage with profit threshold (simulated)
Generate a secure BIP39 mnemonic phrase.
Get real-time token price via Chainlink + DEX aggregation
Get recent transactions for an address with status
Check ETH, USDC, or any ERC20 token balance for a given address
Remove liquidity from a position and collect fees (simulated)
Send a simple transfer with gas estimation (dry-run without PRIVATE_KEY)
Swap tokens via DEX aggregation with slippage protection
Analyze a token contract for honeypot risks, mint functions, ownership patterns. Returns risk score.
Analyze wallet portfolio diversification, token concentration, and recent activity. Returns health score 0-100.
Scan DeFi protocols on Base for highest yield opportunities. Returns pool name, APY, TVL, risk level.
call_contract is ambiguous, name does not clarify read vs write intent. Parameter 'write' boolean is unclear. Should be split into read_contract and write_contract or renamed to execute_contract_method with clearer description.
No pagination support. Tools returning lists (yield_farm, get_transaction_history) lack limit, offset, or cursor parameters. Large result sets will blow context window and degrade LLM reasoning.