Skip to main content
Glama

Kestrova: Solidity Vulnerability Scan

scan_solidity_preview

Read-onlyIdempotent

FREE Solidity security check (Slither). Detects known vulnerability patterns (reentrancy, unchecked calls, tx.origin auth, arbitrary ETH sends and more) and returns severity counts plus High/Medium detector names. Use after writing or changing a contract and before deployment. Input: {"sources": {"File.sol": ""}} (include imported files). Max 60 kB; rate-limited per client. Zero findings does not mean safe.

Input Schema

NameRequiredDescriptionDefault
sourcesYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations: discloses the underlying engine (Slither), the return shape, a hard input cap (max 60 kB), per-client rate limiting, and a false-negative caveat. The readOnly/idempotent hints are consistent with a pure analysis call, and the added operational constraints are exactly the kind of context annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads what it is and that it is free, then detection scope, then usage timing, then the input contract and limits. Every clause carries information; nothing is repeated from the schema or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description covers the essentials: return values (severity counts plus High/Medium detector names), input format, size and rate limits, and the reliability caveat. An agent has everything needed to decide, call, and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage on a nested one-parameter object, the description fully compensates: it gives a literal example, '{"sources": {"File.sol": "<source>"}}', clarifies that imported files must be included, and states the 60 kB total limit. An agent can construct a valid call without guessing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('FREE Solidity security check (Slither)') plus the exact class of findings it detects and the shape of the result (severity counts, High/Medium detector names). The 'FREE'/'preview' framing implicitly signals a lighter-weight sibling but never names scan_solidity_full, so sibling differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear lifecycle trigger: 'Use after writing or changing a contract and before deployment.' It also sets an important expectation boundary with 'Zero findings does not mean safe.' It stops short of explicitly routing to scan_solidity_full for deeper coverage, which is the one alternative an agent would want to know about.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.