Web3 EVM Debugger & Auditor MCP
Provides tools for analyzing Solidity smart contracts: symbolic-execution reentrancy auditing of Solidity ASTs (cross-function reentrancy, check-effects-interaction violations, read-only reentrancy), scanning inline Yul assembly for uninitialized memory pointers, dirty 64-bit memory and gas-bomb memory expansion, and computing exact 32-byte storage slots for complex Solidity state variables such as nested mappings, dynamic arrays and packed structs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Web3 EVM Debugger & Auditor MCPTrace why tx 0xabc123... reverted and decode its calldata."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Web3 EVM Debugger & Auditor MCP
EVM calldata decoding, debug trace revert pinpointing, storage slot layout mapping, and smart contract reentrancy auditing.
Built specifically for Solidity developers, smart contract auditors, DeFi protocol engineers, and Web3 security researchers.
⚡ Quickstart
Smithery Install
smithery skill add whambammy/web3-evm-debugger-mcpClaude Desktop / Cursor (claude_desktop_config.json)
{
"mcpServers": {
"web3-evm-debugger-mcp": {
"command": "npx",
"args": ["-y", "@whambammy/web3-evm-debugger-mcp"],
"env": {
"PAYMENT_WALLET": "0x9793E7269b3301893318dEa8338576Ba612F39B3",
"BASE_RPC_URL": "https://mainnet.base.org"
}
}
}
}Related MCP server: solidity-sentinel
🛠️ Included Tools
Tool Name | Price (USDC) | Capability |
| $0.045 | Parses Geth/Nethermind debug_traceTransaction call trees, pinpointing the exact depth, instruction opcode, sub-contract, and revert message of failed calls. |
| $0.050 | Symbolic execution analyzer scanning Solidity ASTs for cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions. |
| $0.01 | Decodes raw 4-byte function selectors and hex calldata into human-readable method signatures, types, and named arguments. |
| $0.035 | Calculates exact 32-byte EVM storage slots for complex Solidity state variables (nested mappings, dynamic arrays, packed structs) according to ABI specification. |
| $0.040 | Scans inline Yul assembly in Solidity smart contracts for uninitialized memory pointer bugs, 64-bit clean memory corruption, and memory expansion gas bombs. |
| $0.035 | Verifies EIP-1271 signatures on smart contract wallets (Safe, Argent, Kernel, Biconomy) using eth_staticcall validation with gas safeguards. |
🔄 End-to-End Workflow
An auditor agent investigates an on-chain transaction revert -> decodes the calldata -> traces the revert step-by-step through internal calls -> maps impacted storage slots -> audits the target contract for reentrancy bugs.
💰 The x402 Base L2 Micropayment Protocol
When an agent invokes a tool without payment, the server responds with a deterministic HTTP 402 Payment Required challenge containing:
Target tool price in USDC
Base Native USDC Contract:
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913Recipient payout wallet address
Single-use cryptographic nonce
Once broadcasted on Base L2, resubmitting with paymentSignature unlocks deterministic execution.
📄 License
MIT License. Created by Whambammy.
Available Tools
6 toolsdecode_evm_calldataB
Decodes raw 4-byte function selectors and hex calldata into human-readable method signatures, types, and named arguments. (0.01 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions a payment requirement ('0.01 USDC on Base L2') but doesn't explain the payment flow, whether the tool makes an external call, or what happens if payment fails. It also doesn't disclose any side effects or prerequisites beyond the payment hint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core function and includes a brief payment note. It's concise and doesn't waste words, though the payment note is oddly placed and could be clearer.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description is thin. It doesn't explain the payment mechanism, what the output looks like, or any edge cases (e.g., invalid calldata, unsupported selectors). An agent would need more context to invoke it correctly, especially given the payment requirement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters. The description adds context about what the payload contains (raw 4-byte selectors and hex calldata) but doesn't explain the paymentSignature parameter beyond what the schema says. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool decodes raw 4-byte function selectors and hex calldata into human-readable method signatures, types, and named arguments. It uses a specific verb and resource, and the mention of 'raw 4-byte function selectors' distinguishes it from sibling tools like verify_evm_signature or decode_revert_reason_hex, though it doesn't explicitly name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for decoding calldata but doesn't explicitly state when to use this tool versus alternatives like decode_revert_reason_hex or verify_evm_signature. The context of '0.01 USDC on Base L2' hints at a payment requirement but doesn't clarify when this tool is the right choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eip1271_smart_contract_signature_verifierA
Verifies EIP-1271 signatures on smart contract wallets (Safe, Argent, Kernel, Biconomy) using eth_staticcall validation with gas safeguards. (0.035 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses the use of eth_staticcall validation (read-only), gas safeguards, and a cost of 0.035 USDC on Base L2. However, it does not explain return behavior, error cases, or whether the payment signature is mandatory, so behavioral coverage remains incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single tight sentence that front-loads the core purpose and then adds the validation method, gas safeguards, and cost. There is no filler or repetition of information already present in the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with an opaque payload parameter and no output schema. The description leaves critical invocation details unspecified, such as what the payload must contain (presumably signature, message hash, and contract address), whether payment is required, and what a successful verification returns. An agent would struggle to call it correctly with only this description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds wallet-specific context but does not clarify the actual structure or required fields of the opaque 'payload' parameter, nor does it explain how to construct the paymentSignature value beyond the schema's generic description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('verifies'), a precise resource ('EIP-1271 signatures on smart contract wallets'), and enumerates target wallet types (Safe, Argent, Kernel, Biconomy). This clearly differentiates it from sibling tools like verify_evm_signature or verify_signature_eip191, which target different signature schemes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: verifying smart contract wallet signatures via EIP-1271. However, it does not explicitly state when not to use it (e.g., for EOA signatures) or name alternative sibling tools, leaving some routing decisions to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evm_storage_slot_layout_calculatorB
Calculates exact 32-byte EVM storage slots for complex Solidity state variables (nested mappings, dynamic arrays, packed structs) according to ABI specification. (0.035 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It clarifies that the operation is a calculation following the ABI specification and discloses a fee, but it does not state pure/read-only behavior, input format expectations, or limitations. This is adequate for an obvious calculator but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence that immediately states the action and scope, followed by a short parenthetical fee note. There is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a fairly specialized tool with only a generic 'payload' string parameter and no output schema, the description does not specify what payload structure to send (e.g., variable declarations, slot numbers, mapping keys/array indices) or what the result looks like. An agent could select the tool but would struggle to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description hints that payload should describe complex Solidity state variables, but it does not add concrete syntax or field-level semantics for the generic 'payload' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Calculates') and a precise resource ('exact 32-byte EVM storage slots') with the scope of complex Solidity state variables including nested mappings, dynamic arrays, and packed structs. This makes it readily distinguishable from EVM sibling tools like decode_evm_calldata or verify_evm_signature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool over alternatives, nor any exclusions or prerequisites. An agent gets no help deciding between this and other storage/ABI/calldata tools; it must infer use from the name and description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evm_trace_call_revert_debuggerA
Parses Geth/Nethermind debug_traceTransaction call trees, pinpointing the exact depth, instruction opcode, sub-contract, and revert message of failed calls. (0.045 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description has to disclose behavior itself. It does: it is a parsing-only operation with no mutation, and the cost note '(0.045 USDC on Base L2)' alerts the agent to payment implications. However, it does not say whether the operation is local vs network-backed, what happens if no valid paymentSignature is provided, or how failures are surfaced, so the burden is only partially met.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence front-loads the core behavior and concrete outputs, and the parenthetical fee is the only extra detail. There is no boilerplate or redundancy, so every token earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema and only a generic payload parameter, the description lists the returned diagnostic fields (depth, opcode, sub-contract, revert message) and names the input domain, which is reasonably complete. It is weakened by leaving payload formatting unspecified and by stating a fee while the input schema marks paymentSignature optional, so an agent may not know whether payment is mandatory.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% but the payload description is generic ('Input parameters or JSON string payload'). The tool description adds that the payload should be a debug_traceTransaction call tree, which helps, but it never explains the expected shape of that tree or how the optional paymentSignature interacts with the stated cost. This meets the baseline without adding strong parameter-level value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Parses') and a specific resource ('Geth/Nethermind debug_traceTransaction call trees'), then names the exact outputs (depth, instruction opcode, sub-contract, revert message). This is enough to distinguish it from siblings like decode_revert_reason_hex, which only decodes a revert hex string, without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context for use is clear: when the agent has failed debug_traceTransaction call trees and needs to locate the exact failing depth, opcode, sub-contract, or revert message. It does not name alternatives or exclusions, so it falls just short of 5, but the domain is specific enough that misuse with unrelated EVM tools is unlikely.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
smart_contract_reentrancy_auditorA
Symbolic execution analyzer scanning Solidity ASTs for cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions. (0.050 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It reveals the analysis method (symbolic execution), the scanned input, and the cost (0.050 USDC on Base L2), but does not state whether execution is read-only, what side effects occur, or what happens if payment is not included. The fee note provides some extra transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one focused sentence plus a parenthetical cost note. No fluff; the key behavior is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a security analysis tool with no annotations and no output schema, the description is too thin. It never describes the return value (e.g., vulnerability reports, paths, severity), the exact payload format expected, or how payment affects execution. An agent could call it but not know what to do with the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that the payload should be a Solidity AST (or content to parse), which the generic schema field name doesn't convey. It also hints at the payment context, complementing paymentSignature.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific analyzer type (symbolic execution), the input (Solidity ASTs), and three concrete vulnerability classes (cross-function reentrancy, check-effects-interaction violations, read-only reentrancy). This clearly distinguishes it from sibling audit verification tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The tool's domain is explicit: it is for reentrancy auditing on Solidity code, so an agent can infer when to select it. It stops short of stating when not to use it or naming alternatives, but the context is still clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
solidity_assembly_yul_sanitizerB
Scans inline Yul assembly in Solidity smart contracts for uninitialized memory pointer bugs, 64-bit clean memory corruption, and memory expansion gas bombs. (0.040 USDC on Base L2)
| Name | Required | Description | Default |
|---|---|---|---|
| payload | Yes | Input parameters or JSON string payload for the tool execution | |
| paymentSignature | No | Base L2 USDC micropayment signature or transaction hash for x402 settlement |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It only states that the tool scans and lists vulnerability categories; it does not disclose whether analysis is static, what output or report format is returned, what preconditions exist, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense, front-loaded sentence. It states the action, target, specific bug classes, and cost with no filler or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex domain tool with no output schema and no annotations, the description is incomplete: it does not explain what the result looks like, what form the input payload should take, or what conditions are needed for successful invocation. It supports tool selection but not reliable invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds the micropayment amount relevant to paymentSignature, but it does not clarify how the payload should be structured or what content the payload should contain beyond what the schema already says.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action verb ('Scans') and a precise resource ('inline Yul assembly in Solidity smart contracts'), then names three concrete bug classes. This narrowly defines the tool's scope and makes it easy to distinguish from sibling security tools like smart_contract_reentrancy_auditor.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the scanning scope, but the description never explicitly says when to prefer this tool over alternatives or mentions any exclusions. An agent can infer usage, but the guidance is not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v1.0.0- First observed
decode_evm_calldata - First observed
eip1271_smart_contract_signature_verifier - First observed
evm_storage_slot_layout_calculator - First observed
evm_trace_call_revert_debugger - First observed
smart_contract_reentrancy_auditor - First observed
solidity_assembly_yul_sanitizer
TDQS
Scored across 6 tools
Each tool targets a clearly distinct task in EVM debugging/auditing, such as Yul sanitization, reentrancy analysis, trace debugging, calldata decoding, storage layout calculation, and EIP-1271 verification. There is no overlap in purpose, so an agent can easily select the correct tool.
All tool names use snake_case and are descriptive, but the pattern is predominantly noun-based (e.g., _sanitizer, _verifier, _debugger, _auditor, _calculator) with one verb-first name (decode_evm_calldata). This is a minor deviation from a uniform verb_noun convention, though still readable and predictable.
Six tools is well-scoped for a specialized EVM debugging and auditing server. Each tool addresses a unique concern without redundancy, and the count falls comfortably within the ideal 3–15 range.
The surface covers core auditing and debugging tasks such as reentrancy detection, Yul bug scanning, storage layout calculation, calldata decoding, trace debugging, and EIP-1271 signature verification. However, it lacks coverage for EOA signature verification, event log decoding, and bytecode disassembly, which are common ancillary needs in this domain.
Maintenance
Related MCP Connectors
EVM audit (Slither + source + security.txt + MCP-probe + wallet-exposure). 6 tools + /trace.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Decode EVM bytes to JSON: event-log decoder, calldata explainer, selector lookup, ABI fetch.
Read-only smart-contract security intelligence for autonomous agents.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceProvides tools for querying onchain data across 12+ blockchain networks, including token balances, transaction analysis, and smart contract security auditing. It enables users to interact with multiple EVM-compatible chains and perform deep contract evaluations through natural language interfaces.1-
- AlicenseAqualityCmaintenanceEnables static security audit of Solidity smart contracts by analyzing source code or deployed bytecode for vulnerabilities, providing risk scores and detailed findings.1MIT
- AlicenseAqualityCmaintenanceEnables AI assistants to audit Solidity smart contracts for security vulnerabilities, fetch verified source code from block explorers, decode calldata, and estimate gas costs across major EVM networks.4MIT
- FlicenseNot gradedqualityBmaintenanceEnables Solidity callgraph and control-flow analysis to detect reentrancy vulnerabilities in smart contracts, with MCP integration for automated security auditing and DeFi vulnerability triage.8-