Skip to main content
Glama
Sign In
solana-auditor

solana-auditor

by jdjdjjdrjnsn
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Remote

Solana Agent Audit MCP

An autonomous security audit MCP server and CLI utility designed for Solana programs, Anchor frameworks, and AI Agent Wallets.

Supports automated x402 payment headers and micropayments in USDC for pay-per-audit AI workflows.

Features

  • Program Vulnerability Scanner: Static analysis detecting missing Signer checks on authority accounts, unconstrained PDA derivations in invoke_signed, unverified external CPI program targets, and unsafe account closure resurrect vectors.

  • x402 Micropayment Protocol: Built-in paywall invoice generator that creates standardized x402 payment memos for automated agent-to-agent transactions.

  • Standard MCP Protocol: Implements Model Context Protocol tools (audit_solana_code and get_payment_invoice) compatible with Claude Code, Cursor, Codex, and OpenClaw.

Related MCP server: token-security-mcp

Payout Recipient Configuration

All generated audit invoices route payments directly to the designated Solana recipient address:

FCGFGq1WRawg4oQ8zicwt3qX3FdsJPBZzAoC1ZSfp7oD

Quickstart

1. Install & Build

npm install
npm run build
npm test

2. Configure with MCP Client (Claude Code / Cursor / Codex)

Add to your MCP configuration:

{
  "mcpServers": {
    "solana-auditor": {
      "command": "node",
      "args": ["dist/index.js"]
    }
  }
}

3. Available Tools

  • audit_solana_code({ sourceCode, programName }): Performs static security audit returning structured findings, severity, recommendations, and security score (0-100).

  • get_payment_invoice({ serviceName, amountUsdc }): Generates an x402 payment request invoice with recipient address and unique transaction memo.

License

MIT

Available Tools

2 tools
audit_solana_codeA

Runs static security vulnerability audit on Solana Rust/Anchor source code.

Inputs: sourceCode (required), programName.

get_payment_invoiceB

Generates an x402 payment invoice for automated agent micropayments in USDC.

Inputs: amountUsdc, serviceName.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    Deploy Server
    One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

    TDQS

    A3.7/5.0

    Scored across 2 tools

    Disambiguation5/5

    The two tools have completely distinct purposes: one audits Solana code, the other generates payment invoices. There is no overlap or ambiguity between them.

    Naming Consistency5/5

    Both tools follow a consistent verb_noun pattern (audit_solana_code, get_payment_invoice), making the naming predictable and clear.

    Tool Count3/5

    With only two tools, the server feels thin. The payment invoice tool is tangential to the core auditing purpose, making the tool count borderline for the stated domain.

    Completeness3/5

    The audit surface is minimal with only a single audit operation, lacking supporting features like audit history or status retrieval. The inclusion of payment invoicing is odd and doesn't fill functional gaps in the auditing workflow.

    Maintenance

    ActivityStale
    ResponsivenessNo recent community issues

    Resources

    Related MCP Connectors

    Related MCP Servers

    • solidity-sentinel

      Baneado98
      A
      license
      A
      quality
      C
      maintenance
      Enables static security audit of Solidity smart contracts by analyzing source code or deployed bytecode for vulnerabilities, providing risk scores and detailed findings.
      1
      MIT

    • pyresec

      renaat-s
      A
      license
      Not graded
      quality
      B
      maintenance
      Enables MCP-compatible agents to submit source code for automated SAST/SCA security audits paid via x402 USDC micropayments on Base, returning structured vulnerability findings, CWE IDs, and optional remediated code patches.
      MIT

    • Watchdog

      OxToF
      A
      license
      A
      quality
      C
      maintenance
      Enables agents to run pre-signature security checks: identifying who can replace a Solana program's code or control an EVM contract's upgrades, surfacing dependency advisories for lockfiles, scanning public repos before release, and setting 30-day signed-webhook alerts on changes. Calls are paid per use in USDC over x402 from a wallet with per-call caps and a session budget.
      8
      58 npm
      MIT