How mariano-aguero/solidity-audit-mcp works
Solidity Audit MCP exposes contract auditing through MCP, HTTP, and CLI entry points. Users submit source or a project for analysis; the service coordinates analyzers, consolidates findings, and returns reports or CI review results. The README documents static, AST/pattern, gas, test, fuzzing, and GitHub PR capabilities. Sampled source confirms orchestration, HTTP analysis and CI-review calls, but does not show every tool’s internal wiring; uncertain connections are omitted.
Main entry points: toolHandlers.ts Tool dispatch · AnalyzerOrchestrator.ts Analyzer orchestrator · httpHandlers.ts REST handlers · auditProject.ts Project audit
Components 24
Access surfaces
- MCP stdio entry
src/index.ts - HTTP/SSE entry
src/server.ts - Audit CLI
src/cli.ts - MCP server
src/server/McpServer.ts - Tool dispatch
src/server/handlers/toolHandlers.ts - REST handlers
src/server/handlers/httpHandlers.ts
Audit workflows
- Project audit
src/tools/auditProject.ts - Contract analysis
src/tools/analyzeContract.ts - Vulnerability check
src/tools/checkVulnerabilities.ts - Diff audit
src/tools/diffAudit.ts - Audit utilities
src/tools
Analysis engine
- Project scanner
src/analyzers/projectScanner.ts - Analyzer orchestrator
src/analyzers/AnalyzerOrchestrator.ts - Analyzer registry
src/analyzers/AnalyzerRegistry.ts - Analyzer adapters
src/analyzers/adapters - Custom detectors
src/detectors/customDetectorEngine.ts
Results and integrations
- Findings history
src/storage/findingsDb.ts - Reports and templates
src/tools/generateReport.ts - GitHub review
src/ci/githubComment.ts - SARIF output
src/utils/sarif.ts
Other components
- AI assistant
- CLI user
- GitHub
- Analyzer tools
Connections 26
- AI assistant → MCP stdio entry: sends MCP requests
- MCP stdio entry → MCP server: connects transport
- MCP server → Tool dispatch: dispatches tools
- HTTP/SSE entry → REST handlers: routes REST requests
- CLI user → Audit CLI: starts audit
- Audit CLI → Project audit: runs audit
- Tool dispatch → Project audit: executes tool
- Tool dispatch → Contract analysis: executes tool
- Tool dispatch → Vulnerability check: executes tool
- Tool dispatch → Diff audit: executes tool
- Tool dispatch → Audit utilities: executes tools
- REST handlers → Contract analysis: analyzes source
- REST handlers → Vulnerability check: checks source
- REST handlers → Analyzer orchestrator: analyzes CI files
- REST handlers → GitHub review: posts review
- Project audit → Project scanner: scans project
- Contract analysis → Analyzer orchestrator: runs analysis
- Vulnerability check → Analyzer orchestrator: runs detectors
- Analyzer orchestrator → Analyzer registry: resolves analyzers
- Analyzer orchestrator → Analyzer adapters: runs analyzers
- Analyzer adapters → Analyzer tools: invokes tools
- Analyzer orchestrator → Custom detectors: runs custom checks
- Project audit → Findings history: records audit history
- Audit utilities → Reports and templates: generates reports
- Reports and templates → SARIF output: formats findings
- GitHub review → GitHub: posts PR comments