How do I use claudit?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@claudit Search Solodit for oracle manipulation HIGH severity findings" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

claudit

by marchev

Overview Schema Related Servers Score Discussions

JavaScript

Remote

claudit

Smart contract security findings for AI coding agents

Search Solodit's 20,000+ audit findings from Claude Code and Codex CLI.

npm version license node giveth

Quick Start · Tools · Examples · Configuration

Quick Start

curl -fsSL https://raw.githubusercontent.com/marchev/claudit/main/install.sh | sh

The installer detects Claude Code and/or Codex CLI, prompts for your Solodit API key, and registers the MCP server.

Then just ask:

> Find 5 solo findings by 0x52 at Sherlock

Claude Code

claude mcp add --scope user --transport stdio solodit \
  --env SOLODIT_API_KEY=sk_your_key_here \
  -- npx -y @marchev/claudit@latest

# (Optional) Install companion skill
mkdir -p ~/.claude/skills/solodit
curl -fsSL https://raw.githubusercontent.com/marchev/claudit/main/.claude/skills/solodit/SKILL.md \
  -o ~/.claude/skills/solodit/SKILL.md

Codex CLI

codex mcp add solodit \
  --env SOLODIT_API_KEY=sk_your_key_here \
  -- npx -y @marchev/claudit@latest

Related MCP server: solidit-mcp-server

Tools

`search_findings`

Search across all findings with filters.

Parameter	Type	Description
`keywords`	`string`	Text search in title and content
`severity`	`string[]`	`HIGH` `MEDIUM` `LOW` `GAS` (case-insensitive)
`firms`	`string[]`	Audit firm names
`tags`	`string[]`	Vulnerability tags
`language`	`string`	Programming language
`protocol`	`string`	Protocol name (partial match)
`reported`	`string`	`30` `60` `90` `alltime`
`sort_by`	`string`	`Recency` `Quality` `Rarity`
`sort_direction`	`string`	`Desc` (default) `Asc`
`page`	`int`	Page number (default 1)
`page_size`	`int`	Results per page (default 10, max 100)
`advanced_filters`	`object`	See below

Field	Type	Description
`quality_score`	`number`	Minimum quality score (0-5)
`rarity_score`	`number`	Minimum rarity score (0-5)
`user`	`string`	Finder/auditor handle
`min_finders`	`number`	Minimum number of finders
`max_finders`	`number`	Maximum number of finders
`reported_after`	`string`	ISO date string
`protocol_category`	`string[]`	Protocol categories
`forked`	`string[]`	Forked protocol names

`get_finding`

Get full details for a specific finding by numeric ID, Solodit URL, or slug.

`get_filter_options`

List all valid filter values — firms, tags, categories, languages — with finding counts.

Examples

Search Solodit for oracle manipulation HIGH severity findings
Find all Sherlock findings about flash loans
What reentrancy issues exist in lending protocols?
Show me solo findings by 0x52
Get recent HIGH severity Solidity findings sorted by quality

Configuration

Claude Code:

claude mcp remove solodit
claude mcp add --scope user --transport stdio solodit \
  --env SOLODIT_API_KEY=sk_new_key \
  -- npx -y @marchev/claudit@latest

Codex CLI:

codex mcp remove solodit
codex mcp add solodit \
  --env SOLODIT_API_KEY=sk_new_key \
  -- npx -y @marchev/claudit@latest

Cursor MCP

{
  "mcpServers": {
    "solodit": {
      "command": "npx",
      "args": ["-y", "@marchev/claudit@latest"],
      "env": {
        "SOLODIT_API_KEY": "sk_new_key"
      }
    }
  }
}

Claude Code:

claude mcp remove solodit
rm -rf ~/.claude/skills/solodit

Codex CLI:

codex mcp remove solodit

git clone https://github.com/marchev/claudit.git
cd claudit
npm install
npm run build

# Test locally
SOLODIT_API_KEY=sk_your_key node dist/index.js

Support

Claudit is a solo-maintained public good for Ethereum security. If it saves you time or finds bugs for you, consider supporting its continued development on Giveth:

giveth.io/project/claudit-0

MIT License

Available Tools

4 tools

get_claudit_versionA

Returns the currently running version of the Claudit MCP server.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It accurately states the tool returns the version, implying a safe read operation with no side effects. No additional context like auth requirements or rate limits is given, but the simplicity of the tool makes this acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence, front-loaded with the key information. No superfluous words, every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has zero parameters and no output schema, the description fully covers what the tool does. It leaves no ambiguity for the agent about the purpose and result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and schema description coverage is 100%. According to guidelines, 0 parameters baseline is 4. The description adds no parameter information, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the currently running version of the Claudit MCP server, using a specific verb ('Returns') and resource ('currently running version'). It clearly distinguishes from siblings like 'get_filter_options' and 'search_findings' which deal with filtering/searching, not version info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not-to guidance is provided, but for a simple version retrieval tool the context is clear. The description implies it should be used when the agent needs to know the server version, and no alternatives are mentioned. Lacks explicit exclusions but is adequate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_filter_optionsA

List available filter values for Solodit search (firms, tags, categories, languages). Use this to discover valid values for search_findings filters.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.5/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears full responsibility for behavioral disclosure. It states the tool lists values but does not describe output format, performance characteristics, or how the list is generated (static vs dynamic). For a simple list operation, the lack of detail is acceptable but not exemplary.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no redundancy. The first sentence states purpose, and the second provides usage context. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (no parameters, no output schema), the description is mostly complete. It could specify the output structure (e.g., whether it returns a list of strings or a mapping), but the current level is sufficient for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the description adds meaning beyond the empty schema by explaining what the output represents (filter categories) and how it relates to search_findings. This exceeds the baseline of 4 for zero-parameter tools.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists available filter values for Solodit search, specifying the categories (firms, tags, categories, languages). It distinguishes from sibling tool 'search_findings' by explicitly linking the output to its filters.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to discover valid values for search_findings filters,' providing clear guidance on when and how to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_findingA

Get full details for a specific Solodit finding by its numeric ID (preferred), URL, or slug. Returns complete markdown content and all metadata.

ParametersJSON Schema

Name	Required	Description	Default
`identifier`	Yes	Finding numeric ID (e.g., '64195'), Solodit URL, or finding slug. Prefer numeric ID from search results.

TDQS

A3.8/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full burden. It states what it returns but does not disclose behavioral traits such as error handling (e.g., what if identifier is invalid), rate limits, authentication requirements, or side effects. This is a significant gap for a tool with no annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, concise and front-loaded. Every sentence is essential, no filler. Efficiently communicates purpose and key details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and no annotations, the description provides a reasonable level of completeness for a fetch tool. It explains what it does, the input format, and what it returns. However, it lacks details on error behavior and prerequisites, which would be helpful for robust usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers the parameter fully with a description of acceptable identifier types. The description adds value by recommending numeric ID from search results, which aids correct invocation. Schema coverage is 100%, baseline 3, and the added guidance justifies a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool retrieves full details for a specific Solodit finding, specifying three types of identifiers (numeric ID, URL, slug) and that it returns complete markdown and metadata. This distinguishes it from sibling tools like search_findings which is for searching, not fetching full details.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for obtaining full details of a specific finding and recommends preferring numeric ID from search results, but does not explicitly state when not to use it or provide alternatives. It lacks explicit when-to-use and when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_findingsA

Search Solodit's 20k+ smart contract security findings from real audits. Returns severity, firm, protocol, tags, quality score, content snippet, and Solodit URL for each finding. IMPORTANT: Each result includes a Solodit URL — always include it when presenting results to the user.

ParametersJSON Schema

Name	Required	Description
`page`	No	Page number (default 1)
`tags`	No	Vulnerability tags (e.g., ["Reentrancy", "Oracle", "Flash Loan"])
`firms`	No	Audit firm names (e.g., ["Sherlock", "Code4rena", "Trail of Bits"])
`sort_by`	No	Sort order (default: Recency)
`keywords`	No	Text search in title and content
`language`	No	Programming language (e.g., "Solidity", "Rust", "Cairo")
`protocol`	No	Protocol name (partial match)
`reported`	No	Time period filter
`severity`	No	Filter by severity: "HIGH", "MEDIUM", "LOW", "GAS" (case-insensitive)
`page_size`	No	Results per page (default 10, max 100). Use 'page' to paginate.
`sort_direction`	No	Sort direction (default: Desc)
`advanced_filters`	No	Advanced filters for niche queries

TDQS

A3.7/5.0

Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It only lists return fields and an output instruction (URL inclusion), but omits details on side effects, permissions, rate limits, error behavior, or the fact that it's read-only. The description does not confirm safety or non-destructiveness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences plus a brief note. It front-loads the primary action and return values, and the important instruction about URLs is clearly separated. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (12 parameters, nested object, no output schema) and no annotations, the description is somewhat incomplete. It explains what the tool does and returns, but lacks guidance on parameter usage, pagination behavior, or how to construct effective queries. The return field list is helpful, but users may need more context for a tool with this many filters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds minimal value beyond the schema: it lists return fields but does not elaborate on parameter meaning, usage patterns, or how to combine filters effectively. The instruction about the URL relates to output, not parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool searches 'Solodit's 20k+ smart contract security findings' and lists return fields (severity, firm, etc.). It clearly differentiates from siblings like get_finding (single finding) and get_filter_options (filter options) by focusing on search over multiple audits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use (searching findings) and an important presentation guideline ('always include the Solodit URL'). However, it does not explicitly contrast with alternatives (e.g., when to use get_finding instead), leaving some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

4 tool updatesv0.1.19Jul 6, 2026
- First observedget_claudit_version
- First observedget_filter_options
- First observedget_finding
- First observedsearch_findings

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.2/5.0

Disambiguation5/5

Each tool targets a distinct action: version retrieval, filter discovery, single finding detail, and finding search. There is no overlap in purpose.

Naming Consistency5/5

All tools use snake_case with a verb_noun pattern. Three use 'get_' and one uses 'search_', but the verb clearly indicates the operation type, and the naming is predictable.

Tool Count5/5

With 4 tools, the server is well-scoped for its purpose of searching and retrieving audit findings, plus supporting utilities like version and filter options.

Completeness5/5

The server provides a complete surface for read-only access to findings: discover filters, search, and get full details. No missing operations for its intended use case.

Maintenance

ActivityInactive

ResponsivenessNo issues

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Maguyva
ai.maguyva
Code intelligence for coding agents: semantic, AST, graph, and full-text search. 279+ languages.
Code Analysis Coding Agents
23
Bug Bounty Intelligence
io.github.holistis
AI security scanner for Solidity + free CC0 dataset of Sherlock audit-competition acceptance rates.
Blockchain Penetration Testing
28
SOAR Record Gateway
ai.lateos
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Security Customer Support Search
1
Security Intel MCP A
io.github.selflabbs
CVE lookups (NVD) and dependency-manifest audits (OSV) for AI agents. No API keys.
Security Penetration Testing
2

Related MCP Servers

Solodit MCP Serverofficial
Blockchain Research & Data
zerotrust-labs
A
license
A
quality
D
maintenance
MCP server that provides access to Cyfrin Solodit's database of smart contract security findings, enabling search and filtering by impact, firms, tags, and more.
Updated 7 months ago (2026-01-30 18:30 UTC)
2
MIT
solidit-mcp-server
Blockchain Penetration Testing
HBlackfoxx
A
license
A
quality
D
maintenance
Connects AI assistants to Solodit's 49,000+ blockchain vulnerability database, enabling search, browse, and lookup of audit findings directly from your AI workflow.
Updated 6 months ago (2026-03-10 16:38 UTC)
4
MIT
bug-bounty-intelligence-mcp
Blockchain Code Analysis
holistis
A
license
Not graded
quality
B
maintenance
AI-powered smart contract security analysis for AI agents and developers, enabling scanning of Solidity repos for vulnerabilities.
Updated 9 days ago (2026-08-28 17:51 UTC)
16
8
MIT
ContractAudit MCP Server
RAG Systems Search Blockchain
ArmaghanRazaChaudhary
A
license
B
quality
C
maintenance
Enables read-only search over a curated, provenance-preserving corpus of EVM smart-contract security knowledge, providing tools for retrieving audit findings, document context, and source information.
Updated 2 months ago (2026-07-21 22:31 UTC)
5
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/marchev/claudit'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

claudit

Quick Start

Claude Code

Codex CLI

Tools

search_findings

get_finding

get_filter_options

Examples

Configuration

Support

Available Tools

Tool Schema Changelog

Maintenance

Resources

Looking for Admin?

Related MCP Connectors

Related MCP Servers

Solodit MCP Serverofficial

Latest Blog Posts

MCP directory API

`search_findings`

`get_finding`

`get_filter_options`