Web3 EVM Debugger & Auditor MCP
Provides tools for analyzing Solidity smart contracts: symbolic-execution reentrancy auditing of Solidity ASTs (cross-function reentrancy, check-effects-interaction violations, read-only reentrancy), scanning inline Yul assembly for uninitialized memory pointers, dirty 64-bit memory and gas-bomb memory expansion, and computing exact 32-byte storage slots for complex Solidity state variables such as nested mappings, dynamic arrays and packed structs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Web3 EVM Debugger & Auditor MCP Trace why tx 0xabc123... reverted and decode its calldata."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Web3 EVM Debugger & Auditor MCP
EVM calldata decoding, debug trace revert pinpointing, storage slot layout mapping, and smart contract reentrancy auditing.
Built specifically for Solidity developers, smart contract auditors, DeFi protocol engineers, and Web3 security researchers.
⚡ Quickstart
Smithery Install
smithery skill add whambammy/web3-evm-debugger-mcpClaude Desktop / Cursor (claude_desktop_config.json)
{
"mcpServers": {
"web3-evm-debugger-mcp": {
"command": "npx",
"args": ["-y", "@whambammy/web3-evm-debugger-mcp"],
"env": {
"PAYMENT_WALLET": "0x9793E7269b3301893318dEa8338576Ba612F39B3",
"BASE_RPC_URL": "https://mainnet.base.org"
}
}
}
}Related MCP server: EVM MCP Auditor
🛠️ Included Tools
Tool Name | Price (USDC) | Capability |
| $0.045 | Parses Geth/Nethermind debug_traceTransaction call trees, pinpointing the exact depth, instruction opcode, sub-contract, and revert message of failed calls. |
| $0.050 | Symbolic execution analyzer scanning Solidity ASTs for cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions. |
| $0.01 | Decodes raw 4-byte function selectors and hex calldata into human-readable method signatures, types, and named arguments. |
| $0.035 | Calculates exact 32-byte EVM storage slots for complex Solidity state variables (nested mappings, dynamic arrays, packed structs) according to ABI specification. |
| $0.040 | Scans inline Yul assembly in Solidity smart contracts for uninitialized memory pointer bugs, 64-bit clean memory corruption, and memory expansion gas bombs. |
| $0.035 | Verifies EIP-1271 signatures on smart contract wallets (Safe, Argent, Kernel, Biconomy) using eth_staticcall validation with gas safeguards. |
🔄 End-to-End Workflow
An auditor agent investigates an on-chain transaction revert -> decodes the calldata -> traces the revert step-by-step through internal calls -> maps impacted storage slots -> audits the target contract for reentrancy bugs.
💰 The x402 Base L2 Micropayment Protocol
When an agent invokes a tool without payment, the server responds with a deterministic HTTP 402 Payment Required challenge containing:
Target tool price in USDC
Base Native USDC Contract:
0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913Recipient payout wallet address
Single-use cryptographic nonce
Once broadcasted on Base L2, resubmitting with paymentSignature unlocks deterministic execution.
📄 License
MIT License. Created by Whambammy.
Available Tools
6 toolsdecode_evm_calldataB
Decodes raw 4-byte function selectors and hex calldata into human-readable method signatures, types, and named arguments. (0.01 USDC on Base L2)
Inputs: payload (required), paymentSignature.
eip1271_smart_contract_signature_verifierA
Verifies EIP-1271 signatures on smart contract wallets (Safe, Argent, Kernel, Biconomy) using eth_staticcall validation with gas safeguards. (0.035 USDC on Base L2)
Inputs: payload (required), paymentSignature.
evm_storage_slot_layout_calculatorB
Calculates exact 32-byte EVM storage slots for complex Solidity state variables (nested mappings, dynamic arrays, packed structs) according to ABI specification. (0.035 USDC on Base L2)
Inputs: payload (required), paymentSignature.
evm_trace_call_revert_debuggerA
Parses Geth/Nethermind debug_traceTransaction call trees, pinpointing the exact depth, instruction opcode, sub-contract, and revert message of failed calls. (0.045 USDC on Base L2)
Inputs: payload (required), paymentSignature.
smart_contract_reentrancy_auditorA
Symbolic execution analyzer scanning Solidity ASTs for cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions. (0.050 USDC on Base L2)
Inputs: payload (required), paymentSignature.
solidity_assembly_yul_sanitizerB
Scans inline Yul assembly in Solidity smart contracts for uninitialized memory pointer bugs, 64-bit clean memory corruption, and memory expansion gas bombs. (0.040 USDC on Base L2)
Inputs: payload (required), paymentSignature.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 6 tools
Each tool targets a clearly distinct task in EVM debugging/auditing, such as Yul sanitization, reentrancy analysis, trace debugging, calldata decoding, storage layout calculation, and EIP-1271 verification. There is no overlap in purpose, so an agent can easily select the correct tool.
All tool names use snake_case and are descriptive, but the pattern is predominantly noun-based (e.g., _sanitizer, _verifier, _debugger, _auditor, _calculator) with one verb-first name (decode_evm_calldata). This is a minor deviation from a uniform verb_noun convention, though still readable and predictable.
Six tools is well-scoped for a specialized EVM debugging and auditing server. Each tool addresses a unique concern without redundancy, and the count falls comfortably within the ideal 3–15 range.
The surface covers core auditing and debugging tasks such as reentrancy detection, Yul bug scanning, storage layout calculation, calldata decoding, trace debugging, and EIP-1271 signature verification. However, it lacks coverage for EOA signature verification, event log decoding, and bytecode disassembly, which are common ancillary needs in this domain.
Maintenance
Related MCP Connectors
EVM audit (Slither + source + security.txt + MCP-probe + wallet-exposure). 6 tools + /trace.
Self-hosted MCP server: 26 deterministic dev, security, and EVM tools.
Decode EVM bytes to JSON: event-log decoder, calldata explainer, selector lookup, ABI fetch.
Read-only smart-contract security intelligence for autonomous agents.
Related MCP Servers
- AlicenseAqualityCmaintenanceEnables static security audit of Solidity smart contracts by analyzing source code or deployed bytecode for vulnerabilities, providing risk scores and detailed findings.1MIT
- AlicenseAqualityDmaintenanceEnables AI assistants to audit Solidity smart contracts for security vulnerabilities, fetch verified source code from block explorers, decode calldata, and estimate gas costs across major EVM networks.4MIT
- FlicenseNot gradedqualityNot gradedmaintenanceEnables automated Solidity smart contract auditing by analyzing callgraphs and control flow to detect reentrancy vulnerabilities. Integrates with MCP-compatible clients to provide deterministic, zero-dependency security assessments.-
- AlicenseAqualityCmaintenanceEnables reading and analyzing deployed EVM smart contracts by fetching bytecode, disassembling with invalid jump detection, reading storage, deriving Solidity storage slots, and decoding calldata on any EVM chain without an API key.844 npmMIT