Web3 EVM Debugger & Auditor MCP

smart_contract_reentrancy_auditor

Scan Solidity ASTs to detect cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions before deployment.

Instructions

Symbolic execution analyzer scanning Solidity ASTs for cross-function reentrancy, check-effects-interaction violations, and read-only reentrancy in view functions. (0.050 USDC on Base L2)

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "payload": "<payload>"
    },
    "name": "smart_contract_reentrancy_auditor"
  }
}

Input Schema

Name	Required	Description	Default
`payload`	Yes	Input parameters or JSON string payload for the tool execution
`paymentSignature`	No	Base L2 USDC micropayment signature or transaction hash for x402 settlement

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.0.0Oct 3, 2026

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It reveals the analysis method (symbolic execution), the scanned input, and the cost (0.050 USDC on Base L2), but does not state whether execution is read-only, what side effects occur, or what happens if payment is not included. The fee note provides some extra transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is one focused sentence plus a parenthetical cost note. No fluff; the key behavior is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a security analysis tool with no annotations and no output schema, the description is too thin. It never describes the return value (e.g., vulnerability reports, paths, severity), the exact payload format expected, or how payment affects execution. An agent could call it but not know what to do with the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that the payload should be a Solidity AST (or content to parse), which the generic schema field name doesn't convey. It also hints at the payment context, complementing paymentSignature.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific analyzer type (symbolic execution), the input (Solidity ASTs), and three concrete vulnerability classes (cross-function reentrancy, check-effects-interaction violations, read-only reentrancy). This clearly distinguishes it from sibling audit verification tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's domain is explicit: it is for reentrancy auditing on Solidity code, so an agent can infer when to select it. It stops short of stating when not to use it or naming alternatives, but the context is still clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server