Skip to main content
Glama
Recon-Fuzz

recon-fuzz-chimera-mcp

by Recon-Fuzz

@recon-fuzz-mcp/chimera

npm License: MIT Node 18+

MCP server that scaffolds Chimera fuzzing test suites for Solidity smart contracts. Generates ready-to-compile projects with properties, handlers, and fuzzer configs.

Tools

Tool

Input

Returns

scaffold_project

contract_name, functions[]

Full Chimera project (Setup, Properties, TargetFunctions, BeforeAfter, CryticTester + configs)

generate_properties

contract_source, protocol_type

8-15 curated invariant properties with Solidity skeletons

get_template

template_name

Complete ready-to-compile Chimera project for a standard protocol type

explain_pattern

pattern_name

Detailed explanation with code examples

Protocol types

erc20, vault, lending, amm, governance, staking

Patterns

actors, ghosts, cross-contract, setup-layering

Related MCP server: smart-contract-scanner-api

Installation

Claude Code

claude mcp add chimera-scaffold -- npx @recon-fuzz-mcp/chimera

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "chimera-scaffold": {
      "command": "npx",
      "args": ["@recon-fuzz-mcp/chimera"]
    }
  }
}

Cursor

Add to .cursor/mcp.json in your project:

{
  "mcpServers": {
    "chimera-scaffold": {
      "command": "npx",
      "args": ["@recon-fuzz-mcp/chimera"]
    }
  }
}

No API key needed. The server runs entirely locally with no network calls.

Local development

git clone https://github.com/Recon-Fuzz/recon-mcp-chimera.git
cd recon-mcp-chimera
npm install
npm run build

Test it works

# List tools
echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | node dist/index.js

# Scaffold a vault project
echo '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"scaffold_project","arguments":{"contract_name":"SimpleVault","functions":["deposit(uint256)","withdraw(uint256)"]}},"id":2}' | node dist/index.js

# Get a lending template
echo '{"jsonrpc":"2.0","method":"tools/call","params":{"name":"get_template","arguments":{"template_name":"lending"}},"id":3}' | node dist/index.js

Architecture

  • No network calls — everything is in-memory templates and string generation

  • src/templates/base.ts — Solidity file generators (Setup, BeforeAfter, Properties, TargetFunctions, CryticTester)

  • src/templates/configs.ts — Fuzzer config generators (foundry.toml, echidna.yaml, medusa.json)

  • src/properties/ — Curated property catalogs per protocol type (8-15 properties each)

  • src/patterns/ — Pattern explanations with full Solidity code examples

  • src/tools/ — MCP tool implementations

Privacy

This server runs entirely offline. No network calls, no environment variables read, no data written to disk, no telemetry. All template generation happens in-process.

Available Tools

4 tools
explain_patternB

Get a detailed explanation of a Chimera fuzzing pattern with code examples.

ParametersJSON Schema
NameRequiredDescriptionDefault
pattern_nameYesPattern name

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. While it indicates this is a read operation ('Get'), it doesn't specify whether this requires authentication, has rate limits, returns structured or unstructured data, or handles errors. For a tool with no annotation coverage, this leaves significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that efficiently communicates the core purpose. It's front-loaded with the main action and includes key details (detailed explanation, code examples) without unnecessary words. Every element earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (explaining patterns with code examples), no annotations, and no output schema, the description is minimally adequate. It states what the tool does but lacks details on behavioral traits, output format, or usage context. It meets basic requirements but leaves gaps that could hinder effective tool selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds no parameter-specific information beyond what the schema provides. With 100% schema description coverage (the parameter has a clear description and enum values), the baseline is 3. The description doesn't explain what 'pattern_name' represents in the context of Chimera fuzzing or provide additional context about the enum values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Get') and resource ('detailed explanation of a Chimera fuzzing pattern with code examples'). It distinguishes itself from siblings by focusing on explanation rather than generation, scaffolding, or templates. However, it doesn't explicitly contrast with sibling tools in the description text itself.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. There's no mention of prerequisites, appropriate contexts, or comparisons with sibling tools like generate_properties, get_template, or scaffold_project. The agent must infer usage from the purpose alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_propertiesC

Generate 8-15 curated invariant properties with Solidity skeletons based on the protocol type and contract source.

ParametersJSON Schema
NameRequiredDescriptionDefault
contract_sourceYesSolidity source code of the contract
protocol_typeYesProtocol type

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It states the tool generates properties but doesn't disclose behavioral traits such as whether this is a read-only analysis, if it modifies anything, what 'invariant properties' means in practice, performance characteristics, or error handling. The description is minimal and lacks necessary context for safe and effective use.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that efficiently conveys the core functionality without unnecessary words. It front-loads the key action ('Generate') and specifies the output range and inputs directly, making it easy to parse and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of generating invariant properties from Solidity code, the description is insufficient. With no annotations and no output schema, it fails to explain what 'invariant properties' are, what the Solidity skeletons include, or the format and scope of the output. This leaves significant gaps for an AI agent to understand the tool's behavior and results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with clear descriptions for both parameters ('contract_source' and 'protocol_type'). The description adds minimal value beyond the schema, only implying that these inputs are used to generate properties. It doesn't provide additional semantics like format details for 'contract_source' or examples of protocol types, so it meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Generate') and the output ('8-15 curated invariant properties with Solidity skeletons'), and specifies the inputs ('based on the protocol type and contract source'). It distinguishes from siblings by focusing on property generation rather than explanation, templating, or scaffolding. However, it doesn't explicitly differentiate from siblings like 'explain_pattern' or 'get_template'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'explain_pattern', 'get_template', or 'scaffold_project'. It mentions the inputs but gives no context about prerequisites, when this generation is appropriate, or what scenarios warrant its use over other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_templateB

Get a complete ready-to-compile Chimera project template for a standard protocol type.

ParametersJSON Schema
NameRequiredDescriptionDefault
template_nameYesTemplate name

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves a template but does not disclose any behavioral traits such as whether it's read-only, if it requires authentication, rate limits, or what the output format looks like (e.g., file type, structure). This leaves significant gaps in understanding how the tool behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that is front-loaded with the core purpose. It avoids unnecessary words and clearly communicates the tool's function without redundancy, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (retrieving project templates) and the lack of annotations and output schema, the description is incomplete. It does not explain what 'ready-to-compile' entails, the format of the returned template, or any prerequisites. For a tool with no structured output information, more detail is needed to be fully helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, with the parameter 'template_name' fully documented in the schema including its enum values. The description adds no additional meaning beyond the schema, as it does not explain what the template names represent or provide context for choosing among them. Baseline 3 is appropriate since the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Get') and resource ('complete ready-to-compile Chimera project template'), and distinguishes it from siblings by specifying 'for a standard protocol type' which suggests a different scope than tools like 'explain_pattern' or 'generate_properties'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'scaffold_project' or other siblings. It mentions 'standard protocol type' but does not specify what qualifies as standard or when to choose this over other tools, leaving usage context unclear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scaffold_projectB

Scaffold a complete Chimera fuzzing test suite for a given contract and its functions. Returns an array of {path, content} for all project files.

ParametersJSON Schema
NameRequiredDescriptionDefault
contract_nameYesName of the contract to scaffold tests for
functionsYesArray of function signatures, e.g. ["deposit(uint256)", "withdraw(uint256)"]

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool generates files but doesn't mention whether it overwrites existing files, requires specific permissions, has rate limits, or what happens if inputs are invalid. For a file-generation tool with zero annotation coverage, this leaves significant behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured in two sentences: one stating the purpose and one specifying the return format. It's appropriately sized and front-loaded with the core action, though it could be slightly more concise by combining ideas.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (generating multiple files for fuzzing tests), lack of annotations, and no output schema, the description is minimally adequate. It covers the basic purpose and output structure but misses behavioral details and usage context that would help an agent invoke it correctly in real scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the schema already fully documents both parameters (contract_name and functions). The description adds no additional parameter semantics beyond what's in the schema, such as format examples for contract_name or validation rules for functions. Baseline 3 is appropriate when the schema does all the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('scaffold a complete Chimera fuzzing test suite'), identifies the target resource ('for a given contract and its functions'), and distinguishes from sibling tools by specifying the unique output format ('Returns an array of {path, content} for all project files'). This goes beyond a simple tautology of the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus the sibling tools (explain_pattern, generate_properties, get_template). It mentions the output format but doesn't specify prerequisites, appropriate contexts, or alternatives for different testing needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.4/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose: explain_pattern provides documentation, generate_properties creates invariants, get_template offers project templates, and scaffold_project builds test suites. There is no overlap in functionality, making tool selection straightforward for an agent.

Naming Consistency4/5

The naming follows a consistent verb_noun pattern (e.g., explain_pattern, generate_properties) with minor deviations: get_template uses 'get' instead of a more descriptive verb like 'fetch' or 'retrieve', but this is a small inconsistency that does not hinder readability or predictability.

Tool Count5/5

With 4 tools, the server is well-scoped for its purpose of Chimera fuzzing support. Each tool earns its place by covering distinct aspects of the workflow: documentation, property generation, templating, and project scaffolding, without being overly sparse or bloated.

Completeness4/5

The tool set covers key stages of fuzzing setup: learning (explain_pattern), planning (generate_properties), templating (get_template), and implementation (scaffold_project). A minor gap exists in runtime or execution tools (e.g., run_fuzzer, analyze_results), but agents can work around this by using the generated projects externally.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Enables static analysis of Solidity smart contracts using Slither, including contract metadata, function details, inheritance, and security detectors through MCP tools.
    23
    96
    AGPL 3.0
  • F
    license
    Not graded
    quality
    D
    maintenance
    Enables scanning Solidity smart contracts for 13 vulnerability classes using pattern-based analysis; provides full audit, quick scan, gas analysis, and detector catalog through MCP tools.

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Recon-Fuzz/recon-mcp-chimera'

If you have feedback or need assistance with the MCP directory API, please join our Discord server