web3-solidity-audit-mcp
starsforks
How to install web3-solidity-audit-mcp?
shuvonsec/web3-bug-bounty-hunting-ai-skills/web3-solidity-audit-mcp
$npx -y skills add shuvonsec/web3-bug-bounty-hunting-ai-skills --skill web3-solidity-audit-mcpMCP server integrating Slither + Aderyn + SWC patterns into Claude Code for smart contract auditing. Use when analyzing Solidity files, running DeFi-specific detectors, or generating invariants. 10 MCP tools, 86 SWC detectors, DeFi preset pack, CI/CD workflow.
SKILL.md
| 1 | # SKILL 36 — SOLIDITY AUDIT MCP: CLAUDE-NATIVE SMART CONTRACT SCANNER |
| 2 | > From: github.com/mariano-aguero/solidity-audit-mcp — MCP server plugging Slither + Aderyn + SWC patterns into Claude Code |
| 3 | > 10 tools. 19 built-in finding explainers. 86 SWC detectors. DeFi + Web3 preset detector packs. CI/CD ready. |
| 4 | |
| 5 | --- |
| 6 | |
| 7 | ## WHAT IT IS |
| 8 | |
| 9 | An MCP server that gives Claude Code direct access to Slither, Aderyn, Slang AST, SWC pattern matching, and a gas optimizer — all in one unified pipeline with auto-deduplication. Instead of context-switching between tools, you ask Claude to audit a contract and get a merged, severity-sorted report. |
| 10 | |
| 11 | **Stack:** |
| 12 | ``` |
| 13 | External (install separately): |
| 14 | Slither → Trail of Bits, 90+ detectors, deep data flow |
| 15 | Aderyn → Cyfrin Rust-based, fast AST analysis |
| 16 | Echidna → Property fuzzer (optional) |
| 17 | Halmos → Symbolic execution (optional) |
| 18 | |
| 19 | Built-in (no install): |
| 20 | Slang → Nomic Foundation AST parser, precise pattern matching |
| 21 | SWC → 86 detectors against Smart Contract Weakness Classification registry |
| 22 | Gas → Storage packing, loop, calldata optimizations |
| 23 | ``` |
| 24 | |
| 25 | --- |
| 26 | |
| 27 | ## INSTALL & CONFIGURE |
| 28 | |
| 29 | ```bash |
| 30 | # Prerequisites |
| 31 | pip install slither-analyzer solc-select |
| 32 | solc-select install 0.8.20 && solc-select use 0.8.20 |
| 33 | curl -L https://foundry.paradigm.xyz | bash && foundryup |
| 34 | |
| 35 | # Aderyn (Rust) |
| 36 | cargo install aderyn |
| 37 | # or: curl -L https://raw.githubusercontent.com/Cyfrin/aderyn/dev/cyfrinup/install | bash |
| 38 | |
| 39 | # MCP server |
| 40 | npm install -g solidity-audit-mcp |
| 41 | # or: npx solidity-audit-mcp |
| 42 | |
| 43 | # Optional fuzzers |
| 44 | brew install echidna # macOS |
| 45 | pip install halmos # symbolic execution |
| 46 | ``` |
| 47 | |
| 48 | **Wire into Claude Code** — add to `~/.claude/mcp.json`: |
| 49 | ```json |
| 50 | { |
| 51 | "mcpServers": { |
| 52 | "audit": { |
| 53 | "command": "npx", |
| 54 | "args": ["solidity-audit-mcp"] |
| 55 | } |
| 56 | } |
| 57 | } |
| 58 | ``` |
| 59 | |
| 60 | **Or project-level** `.mcp.json` in repo root: |
| 61 | ```json |
| 62 | { |
| 63 | "mcpServers": { |
| 64 | "audit": { |
| 65 | "command": "node", |
| 66 | "args": ["/path/to/solidity-audit-mcp/dist/index.js"] |
| 67 | } |
| 68 | } |
| 69 | } |
| 70 | ``` |
| 71 | |
| 72 | **Docker** (all tools pre-installed): |
| 73 | ```bash |
| 74 | docker run -v $(pwd):/contracts solidity-audit-mcp audit /contracts/Token.sol |
| 75 | ``` |
| 76 | |
| 77 | --- |
| 78 | |
| 79 | ## THE 10 MCP TOOLS |
| 80 | |
| 81 | ### `analyze_contract` — Full Pipeline (Start Here) |
| 82 | |
| 83 | ``` |
| 84 | analyze_contract( |
| 85 | contractPath: "contracts/Vault.sol", |
| 86 | analyzers: ["slither", "aderyn", "slang"], # or omit for all |
| 87 | runTests: true # run forge tests too |
| 88 | ) |
| 89 | ``` |
| 90 | |
| 91 | **Pipeline:** |
| 92 | 1. Parse metadata (functions, state vars, inheritance) |
| 93 | 2. Run Slither + Aderyn in parallel |
| 94 | 3. Detect risky patterns via Slang AST |
| 95 | 4. Deduplicate findings across all tools |
| 96 | 5. Sort by severity |
| 97 | 6. Return unified report + JSON |
| 98 | |
| 99 | ### `get_contract_info` — Attack Surface Map (No Analysis) |
| 100 | |
| 101 | ``` |
| 102 | get_contract_info("contracts/Protocol.sol") |
| 103 | ``` |
| 104 | |
| 105 | Returns instantly: |
| 106 | - Functions by visibility (external, public, internal, private) |
| 107 | - Payable functions — all ETH entry points |
| 108 | - delegatecall usage — proxy risk surface |
| 109 | - State variables and modifiers |
| 110 | - Inheritance chain |
| 111 | |
| 112 | **Use before full audit to understand the attack surface.** |
| 113 | |
| 114 | ### `check_vulnerabilities` — SWC Pattern Scan |
| 115 | |
| 116 | ``` |
| 117 | check_vulnerabilities( |
| 118 | contractPath: "contracts/Token.sol", |
| 119 | detectors: ["SWC-107", "SWC-115", "CUSTOM-017"] # or omit for all 86 |
| 120 | ) |
| 121 | ``` |
| 122 | |
| 123 | **19 built-in finding explainers (full Foundry PoC + remediation):** |
| 124 | |
| 125 | | ID | Finding | Severity | |
| 126 | |----|---------|---------| |
| 127 | | SWC-107 | Reentrancy | Critical | |
| 128 | | SWC-112 | Delegatecall to untrusted callee | Critical | |
| 129 | | CUSTOM-017 | Missing access control on critical function | Critical | |
| 130 | | CUSTOM-018 | ERC-7702 unprotected initializer | Critical | |
| 131 | | CUSTOM-004 | Price oracle manipulation / flash loan | Critical | |
| 132 | | CUSTOM-032 | ERC-4337 paymaster drain | Critical | |
| 133 | | SWC-101 | Integer overflow/underflow (unchecked) | High | |
| 134 | | SWC-104 | Unchecked call return value | High | |
| 135 | | SWC-115 | Authorization through tx.origin | High | |
| 136 | | CUSTOM-001 | Array length mismatch | High | |
| 137 | | CUSTOM-011 | Signature without replay protection | High | |
| 138 | | CUSTOM-029 | Merkle double-claim | High | |
| 139 | | SWC-116 | Block timestamp dependence | Medium | |
| 140 | | CUSTOM-005 | Missing zero address validation | Medium | |
| 141 | | CUSTOM-013 | Hash collision via abi.encodePacked | Medium | |
| 142 | | CUSTOM-015 | Division before multiplication | Medium | |
| 143 | | CUSTOM-016 | Permit without deadline | Medium | |
| 144 | | SWC-100 | Function default visibility | Medium | |
| 145 | | SWC-103 | Floating pragma | Low | |
| 146 | |
| 147 | ### `explain_finding` — Deep Dive on Any Finding |
| 148 | |
| 149 | ``` |
| 150 | explain_finding( |
| 151 | findingId: "CUSTOM-011", # or "SWC-107", or keyword "reentrancy" |
| 152 | contractContext: "ERC4626 vault with harvest callback" |
| 153 | ) |
| 154 | ``` |
| 155 | |
| 156 | Returns: root cause → impact → step-by-step exploit → vulnerable code → secure code → Foundry PoC temp |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
