Slither MCP Server
Static analysis for Solidity smart contracts using the Slither engine.
Data last scanned today · Reviewed today
Overview
Slither MCP Server provides a specialized interface to perform deep static analysis on Solidity smart contract projects, including those built with Foundry or Hardhat. By wrapping the Slither framework, it enables developers to extract rich metadata regarding inheritance hierarchies, function signatures, call relationships, and potential security vulnerabilities directly through the Model Context Protocol.
Our verdict
With a security score of 53/100, this server is currently classified as high-risk. While the project is maintained by Trail of Bits, it currently lacks an editorially reviewed authentication method and provides full write access to your filesystem, which necessitates caution. It is suitable for developers integrating Solidity analysis into their local workflows, provided they are aware of the default-enabled metrics and the lack of fine-grained access controls.
- Maintained directly by Trail of Bits
- Zero direct dependencies reduce supply-chain surface area
- Includes automated result caching for faster query performance
- No read-only mode restricts potential security isolation
- Lack of OAuth support limits authentication options
- Metrics are enabled by default for all tool interactions
Tools
| Tool | Description | Risk |
|---|---|---|
| list_contracts | List contracts with filters | low |
| get_contract | Get detailed contract information | low |
| get_contract_source | Get contract source code | low |
| get_function_source | Get function source code | low |
| list_functions | List functions with filters | low |
| function_callees | Get function call relationships | low |
| function_callers | Get functions that call a target function | low |
| get_inherited_contracts | Get contract inheritance | low |
| get_derived_contracts | Get contracts that inherit from this one | low |
| list_function_implementations | Find function implementations | low |
Compatibility
| Client | Local | Docker | Remote | Read-only |
|---|---|---|---|---|
| Claude Desktop | ||||
| Cursor | ||||
| VS Code | ||||
| Windsurf | ||||
| ChatGPT |
Frequently asked questions
›What are the prerequisite software requirements?
The server requires Python 3.11+ and uses the UV package manager for installation and execution.
›How are analysis results stored?
Slither runs are automatically cached to {$PROJECT_PATH}/artifacts/project_facts.json to improve performance for subsequent loads.
›What data is collected by the built-in metrics feature?
The server collects tool call events and success/failure status, but it does not collect parameters, contract details, function names, or any project-specific information.
›How can I disable metrics reporting?
Metrics are enabled by default but can be permanently disabled by running the server with the --disable-metrics flag.
›Are there any specific configuration requirements for using this with Cursor?
If you are on Linux or macOS, you may need to ensure uvx is in your path by running a command like sudo ln -s ~/.local/bin/uvx /usr/local/bin/uvx.
Badge
Maintain this server? Add the live badge to your README.