solidit-mcp-server
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@solidit-mcp-server Search for reentrancy vulnerabilities"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
solidit-mcp-server
Give AI assistants instant access to Solodit's 49,000+ blockchain vulnerability database.
An MCP server that connects Claude (and other MCP clients) to the Solodit audit findings API -- search vulnerabilities, browse recent discoveries, and look up specific findings directly from your AI workflow.
Runs via npx solidit-mcp-server with zero global installation required.
Quick Start
Get an API key at solodit.cyfrin.io (Profile > API Keys)
Add the MCP config (see Claude Code or Claude Desktop below)
Start using it -- ask Claude something like:
"Search for reentrancy vulnerabilities in DeFi protocols"
Related MCP server: Exploit Intel Platform MCP Server
Claude Code
Add to your .mcp.json (project-level) or ~/.claude/mcp.json (global):
{
"mcpServers": {
"solodit": {
"command": "npx",
"args": ["-y", "solidit-mcp-server"],
"env": { "SOLODIT_API_KEY": "your-api-key-here" }
}
}
}Claude Desktop
Add to your Claude Desktop config file:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%\Claude\claude_desktop_config.json
{
"mcpServers": {
"solodit": {
"command": "npx",
"args": ["-y", "solidit-mcp-server"],
"env": { "SOLODIT_API_KEY": "your-api-key-here" }
}
}
}Docker
Build and run locally:
docker build -t solidit-mcp-server .
docker run -i -e SOLODIT_API_KEY=your-api-key-here solidit-mcp-serverOr use docker-compose with a .env file:
# .env
SOLODIT_API_KEY=your-api-key-heredocker compose upTools
search_findings
Full-featured search across Solodit's database with 14+ filters. All parameters are optional -- a bare call returns recent findings.
Parameter | Type | Description |
| string | Free-text search across titles and content |
| string[] | Severity filter: |
| string[] | Vulnerability type: |
| string[] | Audit firm: |
| string[] | Protocol type: |
| string[] | Language: |
| string | Protocol name (partial match) |
| string | Auditor handle (partial match) |
| number | Minimum quality score (0-5) |
| number | Minimum rarity score (0-5) |
| string | Preset: |
| string | Custom date cutoff (ISO format, e.g. |
| string |
|
| string |
|
| number | Page number (default: 1) |
| number | Results per page (default: 20, max: 100) |
| number | Content preview length (default: 500, max: 5000) |
Example: "Find high-impact reentrancy findings in DeFi protocols audited by Cyfrin"
get_finding_detail
Retrieve the full content and metadata of a single finding by ID or slug. Use after seeing a result in search_findings to get the complete writeup.
Parameter | Type | Description |
| string | The finding ID (UUID) or slug from search results or Solodit URLs |
Example: "Get the full details of finding abc-123-def"
search_by_tag
Search by vulnerability tags, sorted by quality score (best examples first). Ideal for finding high-quality writeups about a specific vulnerability class.
Parameter | Type | Description |
| string[] | Required. One or more vulnerability tags |
| string[] | Severity filter: |
| string[] | Language filter |
| string[] | Protocol category filter |
| number | Page number (default: 1) |
| number | Results per page (default: 10, max: 100) |
Example: "Find the best oracle manipulation examples in Solidity"
recent_findings
Browse the latest findings from the last N days, sorted by recency (newest first).
Parameter | Type | Description |
| number | Days to look back (default: 30) |
| string[] | Severity filter: |
| string[] | Language filter |
| string[] | Protocol category filter |
| number | Page number (default: 1) |
| number | Results per page (default: 10, max: 100) |
Example: "Show me high-impact findings from the last 7 days"
API Key
This server requires a Solodit API key. Get yours at solodit.cyfrin.io under Profile > API Keys.
The key is passed via the SOLODIT_API_KEY environment variable in your MCP configuration (see setup sections above).
License
Available Tools
4 toolsget_finding_detailGet Finding DetailA
Retrieve the full content and all metadata of a single Solodit finding by its ID or slug. Use this tool when you already know which finding you want to examine in detail -- for example, after seeing a relevant title in search_findings results. Returns the complete untruncated content, all tags, finders, contest info, and links.
When to use:
You have a finding ID or slug and want the full content
Following up on a search result to read the complete vulnerability description
Need all metadata (finders, contest details, all links) for a specific finding
Use search_findings instead if you need to search by keyword or apply filters. Use search_by_tag for quick vulnerability pattern lookups. Use recent_findings to browse the latest discoveries.
Inputs: finding_id (required).
recent_findingsRecent FindingsA
Browse the most recent Solodit findings from the last N days. Results are sorted by recency (newest first). Default: last 30 days.
When to use:
Checking what new vulnerabilities have been discovered recently
Staying up to date on the latest audit findings
Browsing recent findings filtered by impact level, language, or protocol category
Use search_findings for complex multi-filter queries. Use search_by_tag to find specific vulnerability patterns regardless of date. Use get_finding_detail to read the full content of a specific finding.
Inputs: days, page, impact, language, +2 more.
search_by_tagSearch by Vulnerability TagA
Search Solodit findings by one or more vulnerability tags. Optimized for finding examples of specific vulnerability patterns -- results are sorted by quality score (best examples first).
When to use:
Looking for examples of a specific vulnerability type (e.g., Reentrancy, Oracle, Access Control)
Checking if a vulnerability pattern applies to code under review
Finding high-quality writeups about a vulnerability class
Top tags (use exact casing): Business Logic, Validation, Wrong Math, Front-Running, DOS, Fee On Transfer, Oracle, Reentrancy, Access Control, Don't update state, Decimals, Liquidation, Overflow/Underflow, Admin, Denial-Of-Service, Slippage, Missing-Logic, Rounding, Stale Price, ERC4626, First Depositor Issue, Chainlink, Flash Loan, Weird ERC20, Configuration, ERC20, Missing Check, Fund Lock, Uniswap, Vote, ERC721, Coding-Bug, NFT, Sandwich Attack, Approve, Chain Reorganization Attack, Swap, ERC1155, Gas Limit, Lending Pool, Blacklisted, Allowance, Bypass limit, Initialization, Auction, Precision Loss, Replay Attack, Grief Attack, Share Inflation, ERC777, Pause, Upgradable, TWAP, Vault, Cross Chain, Bridge, Read-only Reentrancy, and 150+ more.
Use search_findings for complex multi-filter queries (keyword + firm + date + more). Use get_finding_detail to read the full content of a specific finding. Use recent_findings to browse the latest discoveries.
Inputs: tags (required), page, impact, language, +2 more.
search_findingsSearch Solodit FindingsA
Search Solodit's database of 49,000+ blockchain security audit findings with full filter power. Returns structured results with title, impact, summary, tags, firm, scores, and content preview. All parameters are optional -- a bare call returns recent findings.
This is the most powerful search tool with 14+ filters. For simpler queries, consider:
get_finding_detail: Get full content of a specific finding by ID or slug
search_by_tag: Quick vulnerability pattern lookup by tag (sorted by quality)
recent_findings: Browse latest discoveries from the last N days
When to use: You need complex multi-filter queries combining keywords, firms, date ranges, and other advanced filters that the convenience tools don't support.
Available filters:
keywords: Free-text search across titles and content
impact: Severity (HIGH, MEDIUM, LOW, GAS)
tags: Vulnerability type — top tags: Business Logic, Validation, Wrong Math, Front-Running, DOS, Fee On Transfer, Oracle, Reentrancy, Access Control, Decimals, Liquidation, Overflow/Underflow, Slippage, Missing-Logic, Rounding, Stale Price, ERC4626, First Depositor Issue, Chainlink, Flash Loan, Weird ERC20, ERC20, Missing Check, Fund Lock, Uniswap, Vote, ERC721, NFT, Sandwich Attack, Lending Pool, Precision Loss, Replay Attack, Share Inflation, Read-only Reentrancy, and 170+ more
firms: Audit firm — all 30: Code4rena, Zokyo, OpenZeppelin, Pashov Audit Group, Cantina, Sherlock, Halborn, Quantstamp, MixBytes, OtterSec, Spearbit, TrailOfBits, Cyfrin, ConsenSys, Codehawks, SigmaPrime, Shieldify, Immunefi, Trust Security, Hexens, ZachObront, Guardian Audits, AuditOne, Recon Audits, 0x52, Oxorio, Kann, ThreeSigma, Hans, Naman
protocol_category: All 32: Dexes, CDP, Services, Cross Chain, Yield, Liquid Staking, Synthetics, Staking Pool, Yield Aggregator, Payments, Bridge, Launchpad, RWA, Leveraged Farming, Indexes, Liquidity manager, Options Vault, Oracle, Derivatives, Lending, Privacy, Insurance, NFT Marketplace, NFT Lending, Algo-Stables, RWA Lending, Gaming, Prediction Market, Farm, Decentralized Stablecoin, Reserve Currency, Uncollateralized Lending
language: All 17: Solidity, Rust, Go, Move, TypeScript, Vyper, FunC, JavaScript, Cairo, Dart, Python, Circom, Cosmos, Sway, Yul, Noir, Tact
protocol: Protocol name (partial match)
finder: Auditor handle (partial match)
quality_min / rarity_min: Minimum score thresholds (0-5)
date_range: Preset ranges (30, 60, 90 days, or alltime)
date_after: Custom date cutoff (ISO format)
sort_by / sort_direction: Ordering (Recency/Quality/Rarity, Desc/Asc)
page / page_size: Pagination controls
Inputs: page, tags, firms, finder, +13 more.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 4 tools
Each tool has a clearly distinct purpose: search_findings for complex queries, get_finding_detail for full content retrieval, search_by_tag for pattern lookup, and recent_findings for browsing. No overlap or ambiguity exists.
Tool names follow a consistent snake_case pattern with clear verb_noun structure (search_findings, get_finding_detail, search_by_tag, recent_findings). However, 'recent_findings' uses an adjective instead of a verb, slightly breaking the pattern.
With 4 tools, the set is well-scoped for querying a blockchain audit finding database. Each tool serves a distinct access pattern—search, detail, tag-based lookup, and recency browsing—without unnecessary bloat.
The tool surface covers the main ways to discover and retrieve findings: search, detail, tag, and recent. A minor gap is the lack of bulk export or comparison tools, but the core functionality is complete for an audit database query service.
Maintenance
Related MCP Connectors
Read-only smart-contract security intelligence for autonomous agents.
AI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.
Scan websites and code for security, performance and SEO issues from your AI assistant.
Connect AI assistants to your GitHub-hosted Obsidian vault to seamlessly access, search, and analy…
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables AI coding agents to scan smart contracts and code for vulnerabilities, check against 12 famous-hack patterns, and return public security receipts directly in the IDE.424 npmMIT
- AlicenseAqualityDmaintenanceEnables AI assistants to search and analyze vulnerabilities and exploits from multiple intelligence sources, including NVD, CISA KEV, ExploitDB, Metasploit, and more, with tools for CVE research, exploit analysis, and report generation.17MIT
- AlicenseAqualityDmaintenanceEnables searching over 20,000+ smart contract audit findings from Solodit, with filters for severity, firm, tags, and more. Designed for use with AI coding agents like Claude Code and Codex CLI.418 npm159MIT
- AlicenseAqualityBmaintenanceAI-powered smart contract security analysis for AI agents and developers, enabling scanning of Solidity repos for vulnerabilities.343 npm11MIT