@baibysitter/mcp

MCP server for bAIbysitter — intent-based transaction security for vibecoding.

Catches security bugs in AI-generated smart contract code before you deploy. Works with Claude Code, Cursor, Windsurf, and any MCP-compatible IDE.

What it does

When you're vibecoding a smart contract and ask your AI to "check if everything is OK", bAIbysitter:

1. Reads your code and infers what each function is supposed to do
2. Generates test transactions as raw calldata (no RPC, no devnet needed)
3. Sends them to bAIbysitter which simulates and compares intent vs actual behavior
4. Returns findings — mismatches, risks, and fix suggestions

What it catches

• Fallbacks to burn/system addresses (e.g., 1111...1 on Solana)
• Unlimited token approvals (type(uint256).max)
• Missing owner/signer checks
• Decimal confusion (1 USDC vs 0.000001 USDC)
• Zero slippage protection in swaps
• Reentrancy vulnerabilities
• PDA seed errors (Solana)
• Unchecked return values
• Hardcoded addresses for wrong network
• Unverified token account mints

Install

Claude Code

claude mcp add baibysitter -- npx @baibysitter/mcp

Cursor / Windsurf

Add to your MCP settings:

{
  "mcpServers": {
    "baibysitter": {
      "command": "npx",
      "args": ["@baibysitter/mcp"],
      "env": {
        "BAIBYSITTER_API_URL": "https://api.baibysitter.xyz"
      }
    }
  }
}

Usage

Just ask your AI assistant to check your smart contract code. The AI will automatically:

1. Read the code in context
2. Build test transaction scenarios
3. Call baibysitter_check with the scenarios
4. Show you the results inline

Example prompt: "Check if this contract has any security issues"

The AI handles everything — you don't need to manually specify what the code should do. bAIbysitter infers intent from function names, comments, and code structure.

Environment Variables

| Variable | Default | Description | |----------|---------|-------------| | BAIBYSITTER_API_URL | https://api.baibysitter.xyz | bAIbysitter API endpoint |

How it works under the hood

You: "check if this is safe"
  │
  ▼
AI reads your code, infers intent, builds test calldata
  │
  ▼
MCP tool: baibysitter_check({ scenarios: [...] })
  │
  ▼
bAIbysitter API:
  ├── Sentinels simulate each tx (Bitfinding/Unblind)
  ├── LLM compares intent (reason) vs simulation results
  └── Returns: approved/rejected + explanation per scenario
  │
  ▼
AI shows findings inline in your IDE

Pricing

Each check costs $0.001 USDC via x402 micropayments on Base. Payment is handled automatically by the bAIbysitter API.

License

MIT