🛡️ EVM MCP Auditor

Production-grade Model Context Protocol (MCP) server for EVM Smart Contract security auditing, static vulnerability analysis, and multi-chain telemetry for Claude & Claude Code.

⚡ Overview

EVM MCP Auditor connects Anthropic's Claude, Claude Desktop, and Claude Code CLI directly to Ethereum and EVM ecosystems. It equips Claude with specialized security auditing tools to automatically inspect Solidity smart contracts for critical attack vectors, fetch verified source code from block explorers, decode raw transaction calldata, and estimate multi-chain gas costs.

┌───────────────────────────┐         ┌───────────────────────────────┐
│                           │  stdio  │                               │
│  Claude Desktop / Code    │ ◄─────► │  EVM MCP Auditor Server       │
│  (Anthropic AI)           │         │  (@zalana/evm-mcp-auditor)    │
│                           │         │                               │
└───────────────────────────┘         └──────────────┬────────────────┘
                                                     │
                                                     ▼
                                      ┌───────────────────────────────┐
                                      │  EVM Networks & Explorers     │
                                      │  • Ethereum • Base • Arbitrum │
                                      │  • Optimism • Polygon • BSC   │
                                      └───────────────────────────────┘

Related MCP server: Elytra Security MCP Server

🚀 Features & MCP Tools

📦 Quickstart & Installation

Option 1: Claude Desktop Integration

Add the following snippet to your claude_desktop_config.json:

{
  "mcpServers": {
    "evm-auditor": {
      "command": "npx",
      "args": ["-y", "@zalana/evm-mcp-auditor"]
    }
  }
}

Option 2: Claude Code CLI

claude mcp add evm-auditor npx -y @zalana/evm-mcp-auditor

Option 3: Local Development

# Clone repository
git clone https://github.com/zalana28/evm-mcp-auditor.git
cd evm-mcp-auditor

# Install dependencies
npm install

# Run automated test suites
npm test

# Build TypeScript to dist/
npm run build

# Run local MCP server
npm start

🛡️ Supported Vulnerability Scanners (SWC / CWE)

• EVM-SEC-001: Reentrancy (Checks-Effects-Interactions violation) SWC-107 / CWE-841

• EVM-SEC-002: Arbitrary / Uncontrolled Delegatecall SWC-112 / CWE-829

• EVM-SEC-003: Vulnerable Authentication via tx.origin SWC-115 / CWE-287

• EVM-SEC-004: Unchecked Return Value of Low-Level Call SWC-104 / CWE-252

• EVM-SEC-005: Block Timestamp Manipulation SWC-116 / CWE-330

• EVM-SEC-006: Deprecated selfdestruct / Unprotected State Lock SWC-106 / CWE-284

• EVM-SEC-007: Floating Pragma Compiler Warning SWC-103 / CWE-664

• EVM-SEC-008: Missing Zero-Address (address(0)) Setter Validation SWC-100 / CWE-20

🤝 Contributing

Contributions, issues, and feature requests are welcome! Please check the Contributing Guide.

📄 License

This project is licensed under the MIT License.

Built with ⚡ by Zalana for the global Open-Source and Web3 developer community.