Loading ToolBench
MCP server for Aikido — security analysis for Aiken smart contracts (Cardano)
Aikido MCP has well-structured tool definitions with clear naming (verb_noun convention), complete input schemas with proper enum/type constraints, and generally good descriptions. However, output schemas are not explicitly documented in the source, parameter descriptions could be more detailed about format/constraints, and error handling guidance is minimal. The server demonstrates solid baseline quality but lacks the polish and completeness expected of A-grade production tools. All four tools follow a consistent, professional pattern with appropriate semantic rigor.
Scan an Aiken smart contract project for security vulnerabilities. Returns findings with severity, location, CWC classification, and evidence. Exit code 2 (findings above threshold) is normal, not an error.
Search the Cardano Weakness Classification (CWC) registry. Look up by CWC ID, severity, detector name, or keyword. Returns vulnerability descriptions, affected detectors, and remediation guidance.
Get a detailed explanation of a specific Aikido security detector, including what it checks, why it matters, and remediation guidance.
List all 75 Aikido security detectors with severity, category, CWE mapping, and reliability tier.
Output schemas not explicitly documented in source code. While tool descriptions mention what is returned (e.g., 'findings with severity, location, CWC classification'), no formal output schema definition (JSON Schema) is visible. This forces LLMs to infer result structure and risks context loss if the actual response differs.
Parameter descriptions lack detailed format/constraint guidance. For example, 'project_path' is described as 'Path to the Aiken project directory (must contain aiken.toml)', this is good, but 'detector' in aikido_explain has no format hint (e.g., 'kebab-case, e.g., missing-signature-check'). Descriptions should explicitly state expected format, character restrictions, and examples to guide LLM input.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 58 | 2026-07-28+ | v2 |
| 2026-03-09 | C | 61 | - | v1 |
No documented pagination or result limits in tool descriptions. aikido_list_rules and aikido_cwc_lookup could potentially return large result sets (75 rules, unbounded CWC registry). Descriptions should state maximum result count and whether pagination is supported to prevent context window exhaustion.
Error handling and recovery guidance missing. Tool descriptions do not explain how failures are communicated or what LLMs should do on error (e.g., 'if aikido binary not found, install via npm' or 'exit code 2 is a success case, not an error, contains findings above threshold'). The analyze tool mentions exit code 2 is normal, which is helpful, but other tools lack similar guidance.
Missing input validation error messages in source. Code inspection cannot verify whether tools return actionable error messages (e.g., 'Detector not found: typo-rule. Valid detectors: [list]') or generic failures. This is a code-review gap, tools should validate inputs early and guide LLM self-correction.