Mainnet-fork invariant fuzzer that replays your contract against live state and stateful sequences to break protocol invariants before deploy.
Single tool 'forkfuzz_scan' has a basic description (97 chars) but critically lacks parameter descriptions. The input schema defines 'target' as a string with a description ('Target path or contract specification to scan'), which is present but minimal. No output schema is documented. The tool description is generic and does not explain when to use it, what it returns, or prerequisites. No error handling guidance. The implementation is a simple wrapper around scan(target) returning JSON, but the MCP interface does not expose structured output schema or error recovery patterns.
Mainnet-fork invariant fuzzer that replays your contract against live state and stateful sequences to break protocol invariants before deploy.. Returns JSON findings.
No output schema documented. LLMs cannot infer what fields the JSON response contains, forcing them to guess at result structure and downstream tool chaining.
Tool description lacks context: does not explain WHEN to use it (what problem does it solve?), WHAT it returns (structure of findings?), or PREREQUISITES (does target need to be a file path, directory, or contract address?).
Parameter 'target' description is vague ('Target path or contract specification'). Does it accept file paths, directory paths, contract addresses, or JSON specs? No format constraints, examples, or validation rules provided.
No error handling guidance. If scan fails (invalid target, permission denied, timeout), the tool returns no recovery hints. LLM cannot determine if the error is retryable or user-fixable.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
Tool name 'forkfuzz_scan' does not start with a clear action verb. 'scan' is present but generic. Consider 'scan_contract_invariants' or 'fuzz_contract_for_invariants' to clarify intent.