Skip to main content
Glama
solidit-mcp-server

solidit-mcp-server

by HBlackfoxx

solidit-mcp-server

npm version License: MIT

Give AI assistants instant access to Solodit's 49,000+ blockchain vulnerability database.

An MCP server that connects Claude (and other MCP clients) to the Solodit audit findings API -- search vulnerabilities, browse recent discoveries, and look up specific findings directly from your AI workflow.

Runs via npx solidit-mcp-server with zero global installation required.

Quick Start

  1. Get an API key at solodit.cyfrin.io (Profile > API Keys)

  2. Add the MCP config (see Claude Code or Claude Desktop below)

  3. Start using it -- ask Claude something like:

    "Search for reentrancy vulnerabilities in DeFi protocols"

Related MCP server: Exploit Intel Platform MCP Server

Claude Code

Add to your .mcp.json (project-level) or ~/.claude/mcp.json (global):

{
  "mcpServers": {
    "solodit": {
      "command": "npx",
      "args": ["-y", "solidit-mcp-server"],
      "env": { "SOLODIT_API_KEY": "your-api-key-here" }
    }
  }
}

Claude Desktop

Add to your Claude Desktop config file:

  • macOS: ~/Library/Application Support/Claude/claude_desktop_config.json

  • Windows: %APPDATA%\Claude\claude_desktop_config.json

{
  "mcpServers": {
    "solodit": {
      "command": "npx",
      "args": ["-y", "solidit-mcp-server"],
      "env": { "SOLODIT_API_KEY": "your-api-key-here" }
    }
  }
}

Docker

Build and run locally:

docker build -t solidit-mcp-server .
docker run -i -e SOLODIT_API_KEY=your-api-key-here solidit-mcp-server

Or use docker-compose with a .env file:

# .env
SOLODIT_API_KEY=your-api-key-here
docker compose up

Tools

search_findings

Full-featured search across Solodit's database with 14+ filters. All parameters are optional -- a bare call returns recent findings.

Parameter

Type

Description

keywords

string

Free-text search across titles and content

impact

string[]

Severity filter: HIGH, MEDIUM, LOW, GAS

tags

string[]

Vulnerability type: Reentrancy, Oracle, Access Control, Integer Overflow/Underflow, Front-running, Logic Error, DOS, Price Manipulation, Flash Loan, Griefing, etc.

firms

string[]

Audit firm: Cyfrin, Sherlock, Code4rena, Trail of Bits, OpenZeppelin, etc.

protocol_category

string[]

Protocol type: DeFi, NFT, Lending, DEX, Staking, Governance, Bridge, etc.

language

string[]

Language: Solidity, Rust, Cairo, Vyper, Move

protocol

string

Protocol name (partial match)

finder

string

Auditor handle (partial match)

quality_min

number

Minimum quality score (0-5)

rarity_min

number

Minimum rarity score (0-5)

date_range

string

Preset: 30, 60, 90 days, or alltime

date_after

string

Custom date cutoff (ISO format, e.g. 2024-01-01)

sort_by

string

Recency, Quality, or Rarity

sort_direction

string

Desc or Asc

page

number

Page number (default: 1)

page_size

number

Results per page (default: 20, max: 100)

max_content_length

number

Content preview length (default: 500, max: 5000)

Example: "Find high-impact reentrancy findings in DeFi protocols audited by Cyfrin"

get_finding_detail

Retrieve the full content and metadata of a single finding by ID or slug. Use after seeing a result in search_findings to get the complete writeup.

Parameter

Type

Description

finding_id

string

The finding ID (UUID) or slug from search results or Solodit URLs

Example: "Get the full details of finding abc-123-def"

search_by_tag

Search by vulnerability tags, sorted by quality score (best examples first). Ideal for finding high-quality writeups about a specific vulnerability class.

Parameter

Type

Description

tags

string[]

Required. One or more vulnerability tags

impact

string[]

Severity filter: HIGH, MEDIUM, LOW, GAS

language

string[]

Language filter

protocol_category

string[]

Protocol category filter

page

number

Page number (default: 1)

page_size

number

Results per page (default: 10, max: 100)

Example: "Find the best oracle manipulation examples in Solidity"

recent_findings

Browse the latest findings from the last N days, sorted by recency (newest first).

Parameter

Type

Description

days

number

Days to look back (default: 30)

impact

string[]

Severity filter: HIGH, MEDIUM, LOW, GAS

language

string[]

Language filter

protocol_category

string[]

Protocol category filter

page

number

Page number (default: 1)

page_size

number

Results per page (default: 10, max: 100)

Example: "Show me high-impact findings from the last 7 days"

API Key

This server requires a Solodit API key. Get yours at solodit.cyfrin.io under Profile > API Keys.

The key is passed via the SOLODIT_API_KEY environment variable in your MCP configuration (see setup sections above).

License

MIT

Available Tools

4 tools
get_finding_detailGet Finding DetailA

Retrieve the full content and all metadata of a single Solodit finding by its ID or slug. Use this tool when you already know which finding you want to examine in detail -- for example, after seeing a relevant title in search_findings results. Returns the complete untruncated content, all tags, finders, contest info, and links.

When to use:

  • You have a finding ID or slug and want the full content

  • Following up on a search result to read the complete vulnerability description

  • Need all metadata (finders, contest details, all links) for a specific finding

Use search_findings instead if you need to search by keyword or apply filters. Use search_by_tag for quick vulnerability pattern lookups. Use recent_findings to browse the latest discoveries.

Inputs: finding_id (required).

recent_findingsRecent FindingsA

Browse the most recent Solodit findings from the last N days. Results are sorted by recency (newest first). Default: last 30 days.

When to use:

  • Checking what new vulnerabilities have been discovered recently

  • Staying up to date on the latest audit findings

  • Browsing recent findings filtered by impact level, language, or protocol category

Use search_findings for complex multi-filter queries. Use search_by_tag to find specific vulnerability patterns regardless of date. Use get_finding_detail to read the full content of a specific finding.

Inputs: days, page, impact, language, +2 more.

search_by_tagSearch by Vulnerability TagA

Search Solodit findings by one or more vulnerability tags. Optimized for finding examples of specific vulnerability patterns -- results are sorted by quality score (best examples first).

When to use:

  • Looking for examples of a specific vulnerability type (e.g., Reentrancy, Oracle, Access Control)

  • Checking if a vulnerability pattern applies to code under review

  • Finding high-quality writeups about a vulnerability class

Top tags (use exact casing): Business Logic, Validation, Wrong Math, Front-Running, DOS, Fee On Transfer, Oracle, Reentrancy, Access Control, Don't update state, Decimals, Liquidation, Overflow/Underflow, Admin, Denial-Of-Service, Slippage, Missing-Logic, Rounding, Stale Price, ERC4626, First Depositor Issue, Chainlink, Flash Loan, Weird ERC20, Configuration, ERC20, Missing Check, Fund Lock, Uniswap, Vote, ERC721, Coding-Bug, NFT, Sandwich Attack, Approve, Chain Reorganization Attack, Swap, ERC1155, Gas Limit, Lending Pool, Blacklisted, Allowance, Bypass limit, Initialization, Auction, Precision Loss, Replay Attack, Grief Attack, Share Inflation, ERC777, Pause, Upgradable, TWAP, Vault, Cross Chain, Bridge, Read-only Reentrancy, and 150+ more.

Use search_findings for complex multi-filter queries (keyword + firm + date + more). Use get_finding_detail to read the full content of a specific finding. Use recent_findings to browse the latest discoveries.

Inputs: tags (required), page, impact, language, +2 more.

search_findingsSearch Solodit FindingsA

Search Solodit's database of 49,000+ blockchain security audit findings with full filter power. Returns structured results with title, impact, summary, tags, firm, scores, and content preview. All parameters are optional -- a bare call returns recent findings.

This is the most powerful search tool with 14+ filters. For simpler queries, consider:

  • get_finding_detail: Get full content of a specific finding by ID or slug

  • search_by_tag: Quick vulnerability pattern lookup by tag (sorted by quality)

  • recent_findings: Browse latest discoveries from the last N days

When to use: You need complex multi-filter queries combining keywords, firms, date ranges, and other advanced filters that the convenience tools don't support.

Available filters:

  • keywords: Free-text search across titles and content

  • impact: Severity (HIGH, MEDIUM, LOW, GAS)

  • tags: Vulnerability type — top tags: Business Logic, Validation, Wrong Math, Front-Running, DOS, Fee On Transfer, Oracle, Reentrancy, Access Control, Decimals, Liquidation, Overflow/Underflow, Slippage, Missing-Logic, Rounding, Stale Price, ERC4626, First Depositor Issue, Chainlink, Flash Loan, Weird ERC20, ERC20, Missing Check, Fund Lock, Uniswap, Vote, ERC721, NFT, Sandwich Attack, Lending Pool, Precision Loss, Replay Attack, Share Inflation, Read-only Reentrancy, and 170+ more

  • firms: Audit firm — all 30: Code4rena, Zokyo, OpenZeppelin, Pashov Audit Group, Cantina, Sherlock, Halborn, Quantstamp, MixBytes, OtterSec, Spearbit, TrailOfBits, Cyfrin, ConsenSys, Codehawks, SigmaPrime, Shieldify, Immunefi, Trust Security, Hexens, ZachObront, Guardian Audits, AuditOne, Recon Audits, 0x52, Oxorio, Kann, ThreeSigma, Hans, Naman

  • protocol_category: All 32: Dexes, CDP, Services, Cross Chain, Yield, Liquid Staking, Synthetics, Staking Pool, Yield Aggregator, Payments, Bridge, Launchpad, RWA, Leveraged Farming, Indexes, Liquidity manager, Options Vault, Oracle, Derivatives, Lending, Privacy, Insurance, NFT Marketplace, NFT Lending, Algo-Stables, RWA Lending, Gaming, Prediction Market, Farm, Decentralized Stablecoin, Reserve Currency, Uncollateralized Lending

  • language: All 17: Solidity, Rust, Go, Move, TypeScript, Vyper, FunC, JavaScript, Cairo, Dart, Python, Circom, Cosmos, Sway, Yul, Noir, Tact

  • protocol: Protocol name (partial match)

  • finder: Auditor handle (partial match)

  • quality_min / rarity_min: Minimum score thresholds (0-5)

  • date_range: Preset ranges (30, 60, 90 days, or alltime)

  • date_after: Custom date cutoff (ISO format)

  • sort_by / sort_direction: Ordering (Recency/Quality/Rarity, Desc/Asc)

  • page / page_size: Pagination controls

Inputs: page, tags, firms, finder, +13 more.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A4.5/5.0

    Scored across 4 tools

    Disambiguation5/5

    Each tool has a clearly distinct purpose: search_findings for complex queries, get_finding_detail for full content retrieval, search_by_tag for pattern lookup, and recent_findings for browsing. No overlap or ambiguity exists.

    Naming Consistency4/5

    Tool names follow a consistent snake_case pattern with clear verb_noun structure (search_findings, get_finding_detail, search_by_tag, recent_findings). However, 'recent_findings' uses an adjective instead of a verb, slightly breaking the pattern.

    Tool Count5/5

    With 4 tools, the set is well-scoped for querying a blockchain audit finding database. Each tool serves a distinct access pattern—search, detail, tag-based lookup, and recency browsing—without unnecessary bloat.

    Completeness4/5

    The tool surface covers the main ways to discover and retrieve findings: search, detail, tag, and recent. A minor gap is the lack of bulk export or comparison tools, but the core functionality is complete for an audit database query service.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      A
      quality
      D
      maintenance
      Enables AI coding agents to scan smart contracts and code for vulnerabilities, check against 12 famous-hack patterns, and return public security receipts directly in the IDE.
      4
      24 npm
      MIT
    • A
      license
      A
      quality
      D
      maintenance
      Enables AI assistants to search and analyze vulnerabilities and exploits from multiple intelligence sources, including NVD, CISA KEV, ExploitDB, Metasploit, and more, with tools for CVE research, exploit analysis, and report generation.
      17
      MIT
    • A
      license
      A
      quality
      D
      maintenance
      Enables searching over 20,000+ smart contract audit findings from Solodit, with filters for severity, firm, tags, and more. Designed for use with AI coding agents like Claude Code and Codex CLI.
      4
      18 npm
      159
      MIT