Developers & AI agents

Use the platform without opening it

Six surfaces onto the same engine and the same tool registry: a CLI, a local MCP server, a hosted MCP endpoint, a REST API with an OpenAPI description, a browser playground, and machine-readable discovery files. Nothing here is a separate product with its own roadmap — they are doors onto what the site already does.

npx saferico scan ./contracts # 201 detectors, on your machine, no account

The six surfaces

Two of them run entirely on your machine and need no key at all. The hosted ones authenticate with an API key, which the Business plan and above can mint.

npm CLI

FREE · NO ACCOUNT

The full 201-detector Solidity audit as a terminal command. The engine is downloaded once, verified against a published SHA-256 and executed locally in a sandboxed VM context. Zero runtime dependencies.

npx saferico scan ./contracts \ --fail-on high \ --sarif results.sarif

Your source is never uploaded — one HTTPS request fetches the engine, nothing else leaves
SARIF 2.1.0 output for GitHub code scanning
--engine-version pins the engine so a scan is reproducible
Exit code is the gate: a finding at or above --fail-on stops the build

npm →Docs →CI Scan →

Local MCP server

FREE · NO ACCOUNT

The same package speaks the Model Context Protocol over stdio, so Claude Code, Cursor or any MCP client can run the real audit against files it can already see — without those files ever leaving the machine.

{ "mcpServers": { "saferico-local": { "command": "npx", "args": ["-y", "saferico", "mcp"] } } }

Three tools: scan_path, scan_source, engine_info
Runs the 201 detectors — this is the full engine, not a summary of it
No API key, because nothing is called over the network

mcp.json →Docs →

Hosted MCP endpoint

BUSINESS & ABOVE

A remote MCP server at /mcp carrying the six live read tools — prices, token facts, honeypot simulation, wallet balances, verification status and bytecode analysis — through the same key, plan gate and credit meter as the REST API.

https://saferico.com/mcp Authorization: Bearer sfi_live_… transport: streamable-http

Four protocol revisions served, newest 2026-07-28
Same tools as /api/v1 — one registry, two doors
It does not run the 201 detectors: a Worker has a 10 ms CPU budget, so the audit lives in the CLI and the browser instead

mcp.json →Docs →Plans →

REST API + OpenAPI

BUSINESS & ABOVE

Ten operations under /api/v1, described by an OpenAPI 3.1.0 document that is generated from the tool registry the server actually executes. If an argument is in the spec, the server accepts it.

curl -X POST https://saferico.com/api/v1/tools/check_honeypot \ -H "Authorization: Bearer sfi_live_…" \ -d '{"chain":"bsc","address":"0x…"}'

Generate a client from the spec — it is the same shape the site uses
Up to 5 keys per account, revocable, with a per-key call count
Every call is metered against the plan's monthly credits

openapi.json →Docs →Get a key →

API playground

KEY REQUIRED TO EXECUTE

Every operation, as a form built from openapi.json at page load. Read the request and the response shape without writing a client; paste a key when you want to actually call something.

The form cannot drift from the API — it is generated from the spec
Your key is held in memory in that tab only, never stored
Nothing is called until you press Execute

Open the playground →

Discovery files

PUBLIC · NO KEY

Three machine-readable files describing what an automated client can do here — and, just as deliberately, what it cannot. All three are generated from the same registry, so none of them can describe a tool that does not exist.

/llms.txt — what the platform does, in prose an LLM can read
/agent.json — the full tool catalogue with argument schemas
/mcp.json — how to connect, local and hosted

llms.txt →agent.json →mcp.json →

What each plan opens

The split is not arbitrary. Anything that runs on your own CPU costs us nothing to give away, so it is free. Anything that spends our subrequests, our RPC quota and our explorer keys is metered, and metering needs an account.

Surface	Free & Pro	Business & above	Metered
npx saferico scan	Yes	Yes	No — runs locally
Local MCP server	Yes	Yes	No — runs locally
llms.txt / agent.json / mcp.json	Yes	Yes	No — static files
API keys	—	Up to 5	—
REST API `/api/v1`	—	Yes	2 credits per call
Hosted MCP `/mcp`	—	Yes	2 credits per call
Playground (execute)	—	Yes	same as the call it makes
CI Scan session + report	—	Yes	2 credits per call

API access starts on Business ($29.90/month). A key minted on Business keeps working while the plan is active; if the plan lapses the key answers

402
      plan-required

rather than silently failing open. Keys are created on the API keys tab of your account.

The hosted endpoints do not run the 201-detector audit. That is a deliberate split, not a gap to fill later: the audit needs orders of magnitude more CPU than an edge request is allowed, and sending unreleased contracts to a third party to find out whether they are safe is a strange thing to ask. The full engine runs in your browser on /scan, in your CI runner, or under npx saferico.