English Français العربية

Kestrova: Solidity Vulnerability Scan

Official registry Security

Solidity smart contract vulnerability scan (Slither) for AI agents. Free preview; paid full report.

Source code Website Documentation

What can you do with Kestrova: Solidity Vulnerability Scan?

  • scan_solidity_preview (free, no key): severity counts and High/Medium detector names.
  • scan_solidity_full (paid, optional): every finding with detector, impact, confidence and file/line locations.
  • payment_terms (free): current price and payment details.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http kestrova-solidity-vulnerability-scan 'https://kestrova.onrender.com/mcp?src=registry'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "kestrova-solidity-vulnerability-scan": {
            "type": "http",
            "url": "https://kestrova.onrender.com/mcp?src=registry"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. Kestrova: Solidity security review for coding agents
  2. Install (pick one)
  3. What it does
  4. Limits (read this)
  5. Privacy
  6. Contents

Kestrova: Solidity security review for coding agents

An agent skill plus a remote MCP server. When your coding agent writes, changes or prepares to deploy a Solidity contract, it runs a free Slither static-analysis preview, explains the results without overclaiming, and offers an optional paid line-level report only after you approve the price.

Install (pick one)

AgentCommand
Claude Code (plugin: skill + MCP)/plugin marketplace add som2026-commits/kestrova-solidity-security then /plugin install solidity-security-review@kestrova
Any agent that supports skills (SKILL.md)npx skills add som2026-commits/kestrova-solidity-security --skill solidity-security-review
MCP only (any MCP client)remote Streamable HTTP server https://kestrova.onrender.com/mcp?src=registry (Claude Code: claude mcp add --transport http kestrova "https://kestrova.onrender.com/mcp?src=skill")

In our tests, agents with only the MCP server did not run the check unprompted; the skill is what makes them do it.

What it does

  • scan_solidity_preview (free, no key): severity counts and High/Medium detector names.
  • scan_solidity_full (paid, optional): every finding with detector, impact, confidence and file/line locations. Paid per call via x402 in USDC on Solana from your own wallet tool; charged only if the scan succeeds. The skill forbids paying without your explicit approval and never handles keys.
  • payment_terms (free): current price and payment details.

Limits (read this)

Automated pattern detection (Slither), not an audit. A clean result does not mean a contract is safe. Not covered: business logic, economic/oracle/MEV attacks, access-control intent, upgrade and admin-key risk, code not sent, deployment configuration. Use professional audits and tests for anything holding value.

Privacy

Sources you send are scanned in a temporary directory that is deleted after each scan; the service does not store or log them. The service's usage log records the route, status, client family and the src install-channel tag, never IP addresses or source code (IP addresses are held in memory only for rate limiting). The hosting providers (Render, Cloudflare) may keep their own standard request logs.

Contents

.claude-plugin/marketplace.json (marketplace), solidity-security-review/ (plugin: .claude-plugin/plugin.json, .mcp.json, skills/solidity-security-review/SKILL.md). No server code.

License: MIT (see LICENSE).

Frequently asked questions

What is Kestrova: Solidity Vulnerability Scan?

Solidity smart contract vulnerability scan (Slither) for AI agents. Free preview; paid full report.

How do I install Kestrova: Solidity Vulnerability Scan?

It runs as a remote server. In Claude Code: claude mcp add --transport http kestrova-solidity-vulnerability-scan 'https://kestrova.onrender.com/mcp?src=registry'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Kestrova: Solidity Vulnerability Scan need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Kestrova: Solidity Vulnerability Scan open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains Kestrova: Solidity Vulnerability Scan?

It is published by som2026-commits. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.