Skip to main content
Glama

Kestrova: Solidity Vulnerability Scan

scan_solidity_full

Read-onlyIdempotent

OPTIONAL, PAID ($1.00 USDC on Solana via x402). Structured Slither findings for Solidity: detector, impact, confidence, description and file/line locations, for fixing each issue. Without a valid x402 payment in _meta['x402/payment'] it returns the payment terms and does NOT scan or charge. Charged only after a successful scan. Pay only with your user's explicit authorisation and within their spending limits.

Input Schema

NameRequiredDescriptionDefault
sourcesYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A3.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnly/idempotent/closed-world; the description adds the whole payment contract: $1.00 USDC on Solana via x402, the _meta['x402/payment'] key, that an unpaid call returns payment terms and performs no scan or charge, and that charging happens only after a successful scan. That is exactly the kind of behavior an agent cannot infer from structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the most decision-relevant fact (OPTIONAL, PAID $1.00), then payment mechanics, then the safety instruction. Dense but every sentence carries information; the parenthetical pricing detail is appropriately placed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers cost, payment precondition, failure mode, output shape, and authorization policy for a paid tool with no output schema. The gap is input format for 'sources', plus no mention of rate limits or how findings are ordered when there are many.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single required parameter 'sources' is a nested object mapping strings to strings. The description never says what sources should contain (file path to Solidity source text?) or how multi-file projects are keyed, so the one parameter remains opaque despite being the only input.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb/resource pair ('Structured Slither findings for Solidity') and enumerates the output fields (detector, impact, confidence, description, file/line). It signals the paid/full variant against the sibling scan_solidity_preview only implicitly via 'OPTIONAL, PAID' and the tool name, without ever naming the sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It does state key usage constraints: only pay with the user's explicit authorisation and within their spending limits, and that it is optional. But it never says when to prefer the free preview or payment_terms instead, so the routing decision between the three siblings is left to inference from the names.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.