contract-auditor
Smart Contract Auditor — Source-level security review of Solidity: pass/warn/fail verdict, 0-100 risk score, severity-ranked findings with exact file:line, exploit scenario and a fix, plus a SARIF 2.1.0 log. Accepts raw code, a list of files, or an on-chain address (verified source is read from Sourcify). A deterministic detector pass (reentrancy ordering, tx.origin, delegatecall, unchecked calls, weak randomness, pre-0.8
Tool call template
This tool declares no required parameters. Add optional parameters from the input schema as needed.
{
"id": 1,
"jsonrpc": "2.0",
"method": "tools/call",
"params": {
"arguments": {},
"name": "contract-auditor"
}
}Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| code | No | Raw Solidity source (one or more files concatenated). Provide exactly one of code, files or address. | |
| files | No | Alternative to code: Solidity files with repository-relative paths. Findings report the file and line, and the SARIF log points at them. | |
| address | No | Alternative to code: an on-chain contract address. Its verified source is read from Sourcify (no API key); unverified contracts return 404. | |
| chainId | No | EVM chain id for address; default 1 (Ethereum mainnet). | |
| contractName | No | Contract to focus on when several are present. |