/web3-solidity-audit-mcp

name: web3-solidity-audit-mcp
description: MCP server integrating Slither + Aderyn + SWC patterns into Claude Code for smart contract auditing. Use when analyzing Solidity files, running DeFi-specific detectors, or generating invariants. 10 MCP tools, 86 SWC detectors, DeFi preset pack, CI/CD workflow.

SOLIDITY AUDIT MCP

Claude-native smart contract scanner with Slither + Aderyn + SWC patterns.

See also: [[Web3 Audit]], [[Smart Contract Audit]], [[Web3 Bug Classes]], [[Methodology]]

---

WHAT IT IS

An MCP server that gives Claude Code direct access to Slither, Aderyn, Slang AST, SWC pattern matching, and a gas optimizer — all in one unified pipeline with auto-deduplication. Instead of context-switching between tools, you ask Claude to audit a contract and get a merged, severity-sorted report.

**Stack:**

External (install separately):
  Slither   → Trail of Bits, 90+ detectors, deep data flow
  Aderyn    → Cyfrin Rust-based, fast AST analysis
  Echidna   → Property fuzzer (optional)
  Halmos    → Symbolic execution (optional)

Built-in (no install):
  Slang     → Nomic Foundation AST parser, precise pattern matching
  SWC       → 86 detectors against Smart Contract Weakness Classification registry
  Gas       → Storage packing, loop, calldata optimizations

---

INSTALL & CONFIGURE

# Prerequisites
pip install slither-analyzer solc-select
solc-select install 0.8.20 && solc-select use 0.8.20
curl -L https://foundry.paradigm.xyz | bash && foundryup

# Aderyn (Rust)
cargo install aderyn
# or: curl -L https://raw.githubusercontent.com/Cyfrin/aderyn/dev/cyfrinup/install | bash

# MCP server
npm install -g solidity-audit-mcp
# or: npx solidity-audit-mcp

# Optional fuzzers
brew install echidna    # macOS
pip install halmos      # symbolic execution

**Wire into Claude Code** — add to `~/.claude/mcp.json`:

{
  "mcpServers": {
    "audit": {
      "command": "npx",
      "args": ["solidity-audit-mcp"]
    }
  }
}

**Or project-level** `.mcp.json` in repo root:

{
  "mcpServers": {
    "audit": {
      "command": "node",
      "args": ["/path/to/solidity-audit-mcp/dist/index.js"]
    }
  }
}

**Docker** (all tools pre-installed):

docker run -v $(pwd):/contracts solidity-audit-mcp audit /contracts/Token.sol

---

THE 10 MCP TOOLS

`analyze_contract` — Full Pipeline (Start Here)

analyze_contract(
  contractPath: "contracts/Vault.sol",
  analyzers: ["slither", "aderyn", "slang"],   # or omit for all
  runTests: true                                 # run forge tests too
)

**Pipeline:** 1. Parse metadata (functions, state vars, inheritance) 2. Run Slither + Aderyn in parallel 3. Detect risky patterns via Slang AST 4. Deduplicate findings across all tools 5. Sort by severity 6. Return unified report + JSON

`get_contract_info` — Attack Surface Map (No Analysis)

get_contract_info("contracts/Protocol.sol")

Returns instantly:

• Functions by visibility (external, public, internal, private)
• Payable functions — all ETH entry points
• delegatecall usage — proxy risk surface
• State variables and modifiers
• Inheritance chain

**Use before full audit to understand the attack surface.**

`check_vulnerabilities` — SWC Pattern Scan

check_vulnerabilities(
  contractPath: "contracts/Token.sol",
  detectors: ["SWC-107", "SWC-115", "CUSTOM-017"]  # or omit for all 86
)

**19 built-in finding explainers (full Foundry PoC + remediation):**

| ID | Finding | Severity | |----|---------|---------| | SWC-107 | Reentrancy | Critical | | SWC-112 | Delegatecall to untrusted callee | Critical | | CUSTOM-017 | Missing access control on critical function | Critical | | CUSTOM-018 | ERC-7702 unprotected initializer | Critical | | CUSTOM-004 | Price oracle manipulation / flash loan | Critical | | CUSTOM-032 | ERC-4337 paymaster drain | Critical | | SWC-101 | Integer overflow/underflow (unchecked) | High | | SWC-104 | Unchecked call return value | High | | SWC-115 | Authorization through tx.origin | High | | CUSTOM-001 | Array length mismatch | High | | CUSTOM-011 | Signature without replay protection | High | | CUSTOM-029 | Merkle double-claim | High | | SWC-116 | Block timestamp dependence | Medium | | CUSTOM-005 | Missing zero address validation | Medium | | CUSTOM-013 | Hash collision via abi.encodePacked | Medium | | CUSTOM-015 | Division before multiplication | Medium | | CUSTOM-016 | Permit without deadline | Medium | | SWC-100 | Function default visibility | Medium | | SWC-103 | Floating pragma | Low |

`explain_finding` — Deep Dive on Any Finding

explain_finding(
  findingId: "CUSTOM-011",         # or "SWC-107", or keyword "reentrancy"
  contractContext: "ERC4626 vault with harvest callback"
)

Returns: root cause → impact → step-by-step exploit → vulnerable code → secure code → Foundry PoC template → remediation → references.

**Use this mid-hunt** when you find a suspicious pattern and want the full exploit scenario before writing a PoC.

**Supported keywords:** `reentrancy`, `overflow`, `flash loan`, `oracle`, `replay`, `nonce`, `encodepacked`, `precision loss`, `permit`, `access control`, `merkle`, `airdrop`, `erc-7702`, `paymaster`, `erc-4337`, `delegatecall`, `tx.origin`, `zero address`, `timestamp`

`generate_invariants` — Auto-Generate Foundry Invariant Tests

generate_invariants(
  contractPath: "contracts/Vault.sol",
  protocolType: "vault"    # auto, erc20, erc721, vault, lending, amm, governance, staking
)

Returns ready-to-paste `invariant_*()` functions + handler contract + `forge test --invariant` run commands.

**Protocol-specific invariants generated:**

ERC-4626 vault:    totalAssets >= total share value
                   share price non-decreasing
                   deposit/withdraw round-trip solvency
Lending:           protocol solvency, liquidatable positions
AMM:               constant product k, no free lunch on swap
Staking:           reward monoton