slither-mcp

Overview

The Slither MCP server provides comprehensive static analysis capabilities for Solidity smart contracts through the Model Context Protocol. It wraps the Slither analysis tool to expose contract metadata, function signatures, inheritance hierarchies, and security vulnerabilities as MCP tools. The server includes caching for faster subsequent analysis and offers both query tools for examining code structure and security analysis tools for detecting vulnerabilities. It appears to be actively maintained by Trail of Bits, a well-known security firm specializing in blockchain security.

Try asking AI

After installing, here are 7 things you can ask your AI assistant:

• list_contracts

  List contracts with filters by type or path pattern

  Try:List all contracts in the projectTry:Find all interface contracts
• get_contract

  Get detailed contract information including functions and inheritance

  Try:Get details for the MyToken contractTry:Show information about the Owned contract
• get_contract_source

  Get the complete source code of a contract's Solidity file

  Try:Show source code for the MyToken contractTry:Get the complete source for the Auction contract
• get_function_source

  Get source code for a specific function with line numbers

  Try:Show the transfer function implementationTry:Get the code for the approve function
• list_functions

  List functions with filters by contract, visibility, or modifiers

  Try:List all public functionsTry:Show all functions with the 'onlyOwner' modifier
• function_callees

  Get function call relationships including internal, external, and library calls

  Try:What functions does the transfer function call?Try:Show all library calls in the approve function
• function_callers

  Get all functions that call a target function grouped by call type

  Try:Which functions call the transfer function?Try:Show all callers of the withdraw function
• get_inherited_contracts

  Get a recursive tree of all contracts that a contract inherits from

  Try:Show the inheritance hierarchy for the MyToken contractTry:What contracts does the Derived contract inherit from?
• get_derived_contracts

  Get a recursive tree of all contracts that inherit from a contract

  Try:Show all contracts that inherit from the Base contractTry:Which contracts extend the Token contract?
• list_function_implementations

  Find all implementations of a function signature across contracts

  Try:Where is the transferFrom function implemented?Try:Find all implementations of the approve function
• list_detectors

  List available Slither detectors with metadata

  Try:Show all available Slither detectorsTry:List detectors related to reentrancy
• run_detectors

  Get detector results with filtering by name, impact, or confidence

  Try:Run all high-impact detectorsTry:Check for reentrancy vulnerabilitiesTry:Show informational detectors

Comparable tools

Installation

# Install dependencies
uv sync

# Or install in development mode
uv pip install -e .

uv run slither-mcp

{
  "mcpServers": {
    "slither-mcp": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/trailofbits/slither-mcp", "slither-mcp"]
    }
  }
}

FAQ

What metrics does Slither MCP collect?

Slither MCP collects tool call events (which tools are used) and success/failure status. It does NOT collect tool call parameters, contract details, function names, or any project-specific information. Metrics are enabled by default but can be disabled with the --disable-metrics flag.

What Solidity project setups are supported?

The server supports any Solidity project that can be analyzed by Slither, including Foundry, Hardhat, and other popular development frameworks. Projects are automatically cached in <path>/artifacts/project_facts.json for faster subsequent queries.

Can I use Slither MCP as a regular API?

Yes, the package includes a typed Python client (SlitherMCPClient) for programmatically interacting with the Slither MCP server. This can be used to build tools, scripts, or agents that need to query Solidity projects outside of an MCP context.

Compare slither-mcp with