Aderyn MCP
Cyfrin's Solidity static analyzer with an MCP mode: the agent gets a project map, contracts, call graphs and AST nodes over stdio or HTTP
- 801 ★ on the repository
- Last commit
- GPL-3.0
Extended access
Why this level
- Reads the sources of the whole Solidity project and returns their fragments to the MCP client
- The http-stream mode listens on a port on 127.0.0.1, and any local process can reach it
Install
- Works in
Manual install
npm install @cyfrin/aderyn -gOther routes exist too: brew install cyfrin/tap/aderyn, the curl installer and cyfrinup. Windows needs WSL.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads the sources of the whole Solidity project and returns their fragments to the MCP client
- The http-stream mode listens on a port on 127.0.0.1, and any local process can reach it
This is third-party code. Review the repository files before installing.
What it does
Aderyn is a static analyzer for Solidity smart contracts written in Rust, and its MCP mode gives an agent navigation over the project. `aderyn mcp stdio` runs in the root of a Foundry or Hardhat project, builds the context from the sources and keeps a server on standard input and output. `aderyn mcp http-stream` does the same at `http://127.0.0.1:6277/mcp`, with the port changed by `--port`. The server exposes seven tools. The agent calls `aderyn_get_tool_guide` once at the start: it returns a glossary and ways of working with the rest. `aderyn_get_project_overview` returns the project root, the source directory, third-party libraries, remappings and the file list. `aderyn_list_contracts` lists deployable contracts of a compilation unit with file names and node IDs. `aderyn_contract_surface_inspector` shows a contract's state variables and entry functions, inherited ones included. The other three go deeper: `aderyn_explore_callgraph_from_entrypoint` traces internal calls and modifiers from an entry function with inheritance and libraries taken into account, `aderyn_node_summarizer` returns a short description of a node with a code snippet, and `aderyn_node_finder` finds nodes by exact names of functions, modifiers and contracts or by a regular expression.
Who it is for. For smart contract auditors and Solidity developers who review a foreign or large project with an agent and want to give it an accurate map of the code.
Good fit when
- You need to get oriented fast in an unfamiliar Foundry or Hardhat project: which contracts get deployed and what entry functions they have
- Before an audit you need to trace which internal functions and modifiers fire from a particular entry function
- The agent should find functions and events by name or regular expression instead of reading whole files
- You need a short breakdown of one node, such as a function or a modifier, together with its code
Not a fit when
- You need vulnerability hunting: the MCP tools only describe code structure, while reports with findings come from the plain `aderyn` command in Markdown, JSON and SARIF
- The project is not Solidity: the analysis is built on an AST produced by a Solidity-specific backend
- You work on Windows without WSL: installation is described for systems with WSL
- Sources change often during a session: the server does not refresh its data itself and has to be restarted
Example request
Connect to Aderyn, list the project's deployable contracts and build the call graph from the withdraw functionMCP
- Transport
- stdio, http
- Authentication
- not required
Limitations
GPL-3.0 license. Windows requires WSL.
The MCP mode is not described in the repository's README: the sources and the command help mention it, while detailed documentation sits on a separate project site.
The server builds its context at startup, and if the Solidity files do not compile it exits with a message that it could not create a workspace context. It has to be started from the project root.
The MCP tools describe how the project is built and do not run vulnerability detectors. The detector list and reports are available separately through the plain `aderyn` command.
How to disable. Remove the aderyn entry from your client's MCP configuration and stop the `aderyn mcp` process. The analyzer itself is removed the way it was installed: `npm uninstall -g @cyfrin/aderyn` or `brew uninstall aderyn`.
FAQ
How do I run Aderyn as an MCP server?
Go to the root of the Solidity project and run `aderyn mcp stdio` for standard input and output, or `aderyn mcp http-stream` for HTTP on port 6277. The client connects to the process or to `http://127.0.0.1:6277/mcp`.
Which tools does the agent see?
Seven: a tool guide, a project overview, a contract list, a contract surface, a call graph from an entry function, a node description and a node search. All of them read the structure of the code and change nothing in the project.
Is configuration needed for Foundry and Hardhat?
No, the analyzer works without configuration for Foundry and Hardhat projects. Settings can go in an `aderyn.toml` file, and the repository has a template for it.
What is the compilation unit number?
The compilation unit index, starting at 1, shows which set of files compiled together a node belongs to. The contract list, surface and node description tools take it together with a node ID. The agent takes the IDs from the contract list or node search response.
Can the server find vulnerabilities?
No, a plain `aderyn` run does that: it builds a report in Markdown, JSON or SARIF from the detector list. The MCP server works on the same parsed code tree but returns structure, not findings.
Discussion
No questions or reviews yet.
Related
MCP serversA repository scanner with an MCP server: dependency graph, secrets, vulnerabilities and an API map with code line citations
MCP server and CLI for reverse engineering: an agent inspects binaries, JavaScript apps, APKs and websites on your machine and returns the evidence
19 Google skills to find, reproduce and patch vulnerabilities: from a threat model to a patch and a report, plus an ADK reference harness
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
Self-hosted AI pentesting framework: attack surface graph, Kali sandbox, human approval gates and an MCP server you can drive from Claude Code
MCP server for the ARL-Next platform: returns ports, fingerprints, certificates, vulnerabilities and leaks for a domain, IP or URL from your asset database
README in short
The repository has a description of the analyzer with its features, four ways to install, a quick start and links to the documentation, a VS Code extension and a CI action. The code is split into the command part, a core with detectors and an MCP directory, alongside a configuration template, contributor guidelines and the license.