MCP Server: Multi-Chain ERC-20 Allowance Revocation

Overview

The MCP (Model Context Protocol) Server is a developer tool for discovering, auditing, and revoking ERC-20 token allowances across multiple EVM-compatible chains. It scans wallet approvals, surfaces risky or outdated allowances, and can produce or broadcast transactions to reduce or remove those approvals. The goal is to make permission management predictable and safe for users, security teams, and wallet integrations.

Designed for wallets, security auditors, and backend services, the MCP Server centralizes token-allowance visibility across chains (Ethereum mainnet, Polygon, BSC, Optimism, Arbitrum, etc.), exposes programmable endpoints, and supports automated cleanup workflows. By integrating the server into tooling or CI, teams can routinely audit allowances and remove unnecessary or compromised approvals.

Features

• Multi-chain ERC-20 allowance discovery (EVM-compatible networks)
• Audit-ready reports of allowances by owner, spender, and token
• Revoke or reduce allowances with prepared transactions (estimate gas, simulate)
• REST API and simple CLI for programmatic use
• Docker-compatible deployment and environment-based configuration
• Support for custom JSON-RPC providers per chain
• Pagination, filtering, and export (CSV/JSON) for audit logs
• Optional signing via a local private key or external signer endpoint
• Rate limiting and caching to reduce RPC costs

Installation / Configuration

Prerequisites:

• Node.js 16+ (or run via Docker)
• Access to JSON-RPC endpoints (Infura, Alchemy, QuickNode, or self-hosted)
• Optional: a signer private key or integration with a signing service

Install from source:

git clone https://github.com/kukapay/token-revoke-mcp.git
cd token-revoke-mcp
npm install
npm run build

Run locally with environment variables:

# .env
PORT=8080
NODE_ENV=production
RPC_URLS_JSON='{"1":"https://mainnet.infura.io/v3/YOUR_KEY","137":"https://polygon-rpc.com"}'
SIGNER_PRIVATE_KEY="0xYOUR_PRIVATE_KEY" # optional; recommend external signer for production
DATABASE_URL="sqlite://./mcp.sqlite" # or postgres://user:pass@host/db

Start the server:

npm start
# or with Docker
docker build -t mcp-server .
docker run -p 8080:8080 --env-file .env mcp-server

Sample docker-compose snippet:

version: "3.8"
services:
  mcp:
    image: your-registry/mcp-server:latest
    env_file: .env
    ports:
      - "8080:8080"
    restart: unless-stopped

Configuration reference (common env vars):

Available Resources

• GitHub repository: https://github.com/kukapay/token-revoke-mcp
• API documentation: /docs (served by the running server)
• OpenAPI/Swagger spec: /openapi.json
• Example Postman collection: included in repo /examples/postman
• Token ABIs: standard ERC-20 ABI is used; custom token metadata can be supplied

API Surface (examples)

• GET /api/v1/allowances?owner=0x…&chainId=1 — list allowances for a wallet
• POST /api/v1/revoke — prepare or send a revoke transaction
  • Body example:

    {
      "owner": "0xOwnerAddress",
      "spender": "0xSpenderAddress",
      "token": "0xTokenAddress",
      "chainId": 1,
      "amount": "0",
      "broadcast": false
    }
    

• GET /api/v1/audit/{owner} — return historical audit entries

CLI examples:

# Scan allowances for an owner on Polygon (chainId 137)
mcp-cli scan --owner 0xOwnerAddress --chain 137

# Generate a revoke transaction (dry-run)
mcp-cli revoke --owner 0xOwnerAddress --spender 0xSpender --token 0xToken --chain 1 --broadcast=false

Use Cases

1. Wallet Security Cleanup

   • A wallet app integrates the MCP Server to show a “Manage Approvals” screen. Users can see allowances across chains and revoke high-risk spenders directly from the wallet UI by calling the server to craft and optionally sign transactions.

2. Automated Compliance and Auditing

   • A security team scans enterprise wallets nightly and records allowances. Any approval above a threshold (e.g., > 1,000 tokens) triggers an alert or a scheduled revoke workflow. Audit exports (CSV/JSON) are stored for compliance.

3. Incident Response

   • After detecting suspicious activity, an incident response script queries the MCP Server for approvals to a compromised protocol address. The team uses the server to quickly generate revoke transactions and pushes them through a multisig or guardian signing flow to mitigate further token draining.

4. Mass Allowance Remediation

   • A developer managing many user-controlled addresses runs a bulk job: identify stale approvals (> 1 year) and queue revokes in batches. The MCP Server provides pagination, gas estimates, and transaction templates so the operator can sign and broadcast at controlled gas prices.

Security Considerations

• Never store long-term private keys in plaintext on public hosts. Prefer external signers (hardware wallets, threshold signers, or signing services).
• Use rate limiting and RPC quotas to prevent accidental overuse of provider credits.
• Test revoke flows on testnets before running on mainnet; revokes are irreversible and will consume gas.

If you need to extend chain support or add custom token logic, the codebase is modular—add a provider for a new chainId and register it in RPC_URLS_JSON.