recon-fuzz-chimera-mcp
Generates Medusa fuzzer configuration files (medusa.json) as part of Chimera test suite scaffolding for smart contract security testing.
Generates fuzzing test suites for Solidity smart contracts, including invariant properties, setup configurations, and target function definitions for security testing.
Generates Foundry configuration files (foundry.toml) as part of Chimera test suite scaffolding for smart contract fuzzing and security testing.
Generates Echidna configuration files (echidna.yaml) as part of Chimera test suite scaffolding for smart contract fuzzing and security testing.
@recon-fuzz-mcp/chimera
MCP server that scaffolds Chimera fuzzing test suites for Solidity smart contracts. Generates ready-to-compile projects with properties, handlers, and fuzzer configs.
Tools
Tool | Input | Returns |
|
| Full Chimera project (Setup, Properties, TargetFunctions, BeforeAfter, CryticTester + configs) |
|
| 8-15 curated invariant properties with Solidity skeletons |
|
| Complete ready-to-compile Chimera project for a standard protocol type |
|
| Detailed explanation with code examples |
Protocol types
erc20, vault, lending, amm, governance, staking
Patterns
actors, ghosts, cross-contract, setup-layering
Related MCP server: smart-contract-scanner-api
Installation
Claude Code
claude mcp add chimera-scaffold -- npx @recon-fuzz-mcp/chimeraClaude Desktop
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"chimera-scaffold": {
"command": "npx",
"args": ["@recon-fuzz-mcp/chimera"]
}
}
}Cursor
Add to .cursor/mcp.json in your project:
{
"mcpServers": {
"chimera-scaffold": {
"command": "npx",
"args": ["@recon-fuzz-mcp/chimera"]
}
}
}No API key needed. The server runs entirely locally with no network calls.
Local development
git clone https://github.com/Recon-Fuzz/recon-mcp-chimera.git
cd recon-mcp-chimera
npm install
npm run buildTest it works
# List tools
echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | node dist/index.js
# Scaffold a vault project
echo '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"scaffold_project","arguments":{"contract_name":"SimpleVault","functions":["deposit(uint256)","withdraw(uint256)"]}},"id":2}' | node dist/index.js
# Get a lending template
echo '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_template","arguments":{"template_name":"lending"}},"id":3}' | node dist/index.jsArchitecture
No network calls — everything is in-memory templates and string generation
src/templates/base.ts— Solidity file generators (Setup, BeforeAfter, Properties, TargetFunctions, CryticTester)src/templates/configs.ts— Fuzzer config generators (foundry.toml, echidna.yaml, medusa.json)src/properties/— Curated property catalogs per protocol type (8-15 properties each)src/patterns/— Pattern explanations with full Solidity code examplessrc/tools/— MCP tool implementations
Privacy
This server runs entirely offline. No network calls, no environment variables read, no data written to disk, no telemetry. All template generation happens in-process.
Available Tools
4 toolsexplain_patternB
Get a detailed explanation of a Chimera fuzzing pattern with code examples.
| Name | Required | Description | Default |
|---|---|---|---|
| pattern_name | Yes | Pattern name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. While it indicates this is a read operation ('Get'), it doesn't specify whether this requires authentication, has rate limits, returns structured or unstructured data, or handles errors. For a tool with no annotation coverage, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently communicates the core purpose. It's front-loaded with the main action and includes key details (detailed explanation, code examples) without unnecessary words. Every element earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (explaining patterns with code examples), no annotations, and no output schema, the description is minimally adequate. It states what the tool does but lacks details on behavioral traits, output format, or usage context. It meets basic requirements but leaves gaps that could hinder effective tool selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no parameter-specific information beyond what the schema provides. With 100% schema description coverage (the parameter has a clear description and enum values), the baseline is 3. The description doesn't explain what 'pattern_name' represents in the context of Chimera fuzzing or provide additional context about the enum values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('detailed explanation of a Chimera fuzzing pattern with code examples'). It distinguishes itself from siblings by focusing on explanation rather than generation, scaffolding, or templates. However, it doesn't explicitly contrast with sibling tools in the description text itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There's no mention of prerequisites, appropriate contexts, or comparisons with sibling tools like generate_properties, get_template, or scaffold_project. The agent must infer usage from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
generate_propertiesC
Generate 8-15 curated invariant properties with Solidity skeletons based on the protocol type and contract source.
| Name | Required | Description | Default |
|---|---|---|---|
| contract_source | Yes | Solidity source code of the contract | |
| protocol_type | Yes | Protocol type |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden. It states the tool generates properties but doesn't disclose behavioral traits such as whether this is a read-only analysis, if it modifies anything, what 'invariant properties' means in practice, performance characteristics, or error handling. The description is minimal and lacks necessary context for safe and effective use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently conveys the core functionality without unnecessary words. It front-loads the key action ('Generate') and specifies the output range and inputs directly, making it easy to parse and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of generating invariant properties from Solidity code, the description is insufficient. With no annotations and no output schema, it fails to explain what 'invariant properties' are, what the Solidity skeletons include, or the format and scope of the output. This leaves significant gaps for an AI agent to understand the tool's behavior and results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with clear descriptions for both parameters ('contract_source' and 'protocol_type'). The description adds minimal value beyond the schema, only implying that these inputs are used to generate properties. It doesn't provide additional semantics like format details for 'contract_source' or examples of protocol types, so it meets the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Generate') and the output ('8-15 curated invariant properties with Solidity skeletons'), and specifies the inputs ('based on the protocol type and contract source'). It distinguishes from siblings by focusing on property generation rather than explanation, templating, or scaffolding. However, it doesn't explicitly differentiate from siblings like 'explain_pattern' or 'get_template'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'explain_pattern', 'get_template', or 'scaffold_project'. It mentions the inputs but gives no context about prerequisites, when this generation is appropriate, or what scenarios warrant its use over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_templateB
Get a complete ready-to-compile Chimera project template for a standard protocol type.
| Name | Required | Description | Default |
|---|---|---|---|
| template_name | Yes | Template name |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves a template but does not disclose any behavioral traits such as whether it's read-only, if it requires authentication, rate limits, or what the output format looks like (e.g., file type, structure). This leaves significant gaps in understanding how the tool behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that is front-loaded with the core purpose. It avoids unnecessary words and clearly communicates the tool's function without redundancy, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (retrieving project templates) and the lack of annotations and output schema, the description is incomplete. It does not explain what 'ready-to-compile' entails, the format of the returned template, or any prerequisites. For a tool with no structured output information, more detail is needed to be fully helpful.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with the parameter 'template_name' fully documented in the schema including its enum values. The description adds no additional meaning beyond the schema, as it does not explain what the template names represent or provide context for choosing among them. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb ('Get') and resource ('complete ready-to-compile Chimera project template'), and distinguishes it from siblings by specifying 'for a standard protocol type' which suggests a different scope than tools like 'explain_pattern' or 'generate_properties'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'scaffold_project' or other siblings. It mentions 'standard protocol type' but does not specify what qualifies as standard or when to choose this over other tools, leaving usage context unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scaffold_projectB
Scaffold a complete Chimera fuzzing test suite for a given contract and its functions. Returns an array of {path, content} for all project files.
| Name | Required | Description | Default |
|---|---|---|---|
| contract_name | Yes | Name of the contract to scaffold tests for | |
| functions | Yes | Array of function signatures, e.g. ["deposit(uint256)", "withdraw(uint256)"] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool generates files but doesn't mention whether it overwrites existing files, requires specific permissions, has rate limits, or what happens if inputs are invalid. For a file-generation tool with zero annotation coverage, this leaves significant behavioral gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is efficiently structured in two sentences: one stating the purpose and one specifying the return format. It's appropriately sized and front-loaded with the core action, though it could be slightly more concise by combining ideas.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (generating multiple files for fuzzing tests), lack of annotations, and no output schema, the description is minimally adequate. It covers the basic purpose and output structure but misses behavioral details and usage context that would help an agent invoke it correctly in real scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already fully documents both parameters (contract_name and functions). The description adds no additional parameter semantics beyond what's in the schema, such as format examples for contract_name or validation rules for functions. Baseline 3 is appropriate when the schema does all the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('scaffold a complete Chimera fuzzing test suite'), identifies the target resource ('for a given contract and its functions'), and distinguishes from sibling tools by specifying the unique output format ('Returns an array of {path, content} for all project files'). This goes beyond a simple tautology of the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the sibling tools (explain_pattern, generate_properties, get_template). It mentions the output format but doesn't specify prerequisites, appropriate contexts, or alternatives for different testing needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose: explain_pattern provides documentation, generate_properties creates invariants, get_template offers project templates, and scaffold_project builds test suites. There is no overlap in functionality, making tool selection straightforward for an agent.
The naming follows a consistent verb_noun pattern (e.g., explain_pattern, generate_properties) with minor deviations: get_template uses 'get' instead of a more descriptive verb like 'fetch' or 'retrieve', but this is a small inconsistency that does not hinder readability or predictability.
With 4 tools, the server is well-scoped for its purpose of Chimera fuzzing support. Each tool earns its place by covering distinct aspects of the workflow: documentation, property generation, templating, and project scaffolding, without being overly sparse or bloated.
The tool set covers key stages of fuzzing setup: learning (explain_pattern), planning (generate_properties), templating (get_template), and implementation (scaffold_project). A minor gap exists in runtime or execution tools (e.g., run_fuzzer, analyze_results), but agents can work around this by using the generated projects externally.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
EVM audit (Slither + source + security.txt + MCP-probe + wallet-exposure). 6 tools + /trace.
EVM Slither audit (zero-arg demo + live) + Blockscout source + security.txt lookup + MCP probe.
MEOK MCP Hardening MCP — automated security red-team for any MCP server. Maps OWASP LLM Top 10
MCP server for static security analysis of Android source code
Related MCP Servers
AlicenseAqualityDmaintenanceEnables static analysis of Solidity smart contracts using Slither, including contract metadata, function details, inheritance, and security detectors through MCP tools.2396AGPL 3.0- FlicenseNot gradedqualityDmaintenanceEnables scanning Solidity smart contracts for 13 vulnerability classes using pattern-based analysis; provides full audit, quick scan, gas analysis, and detector catalog through MCP tools.
- FlicenseAqualityCmaintenanceEnables autonomous web-contract verification through MCP tools for planning, classifying, checking, and recording bug patterns, with access to a shared community corpus that strengthens collective detection.6151
- AlicenseNot gradedqualityAmaintenanceAI-orchestrated security testing via 6 Python tools (recon, port scan, subdomain hunting, frontend scanning, API fuzzing, and nemesis orchestrator) exposed as MCP tools for use by AI agents.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/Recon-Fuzz/recon-mcp-chimera'
If you have feedback or need assistance with the MCP directory API, please join our Discord server