MCP server for analyzing Solidity smart contracts using Mythril security analysis tool
MythrilMCP has three tools with complete input schemas and descriptions, but significant quality gaps limit production readiness. All tools accept parameters with types and defaults, but descriptions lack LLM-optimization guidance (too generic, missing WHEN/WHY context). Output is unstructured plain text rather than structured JSON. No error recovery guidance, no parameter constraints (enums for output_format, network), and no documentation of what fields agents should extract from responses. Tool names are verb-noun compliant (analyze_*), but descriptions don't explain when to choose between the three similar tools or what distinguishes them.
Analyze an on-chain smart contract using Mythril.
Analyze a Solidity smart contract file using Mythril.
Analyze a smart contract with advanced options using Mythril.
Output format not constrained to enum. 'output_format' accepts free-form strings (text, markdown, json, jsonv2) but no enum validation. LLMs may hallucinate invalid formats like 'yaml' or 'xml'.
Network parameter not constrained to enum. 'network' accepts free-form strings but should be enum (mainnet, rinkeby, kovan, ropsten, ganache). LLMs may pass invalid network names.
Unstructured text output. All tools return raw subprocess stdout as plain text. LLMs cannot reliably parse vulnerability lists, severity levels, or line numbers. Should return structured JSON with vulnerability array, each with {id, type, severity, line, description}.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
No error recovery guidance. Subprocess errors return 'Error analyzing file: {stderr}' with no actionable next steps. Should categorize as retryable (timeout, network) vs user-fixable (invalid file path, bad contract address) vs fatal.
Tool descriptions lack LLM-optimization. Generic docstrings ('Analyze a Solidity smart contract file using Mythril') don't explain WHEN to use each tool vs the others, what prerequisites exist (Mythril installed?), or what the output contains. Should include: 'Use for local .sol files. Returns vulnerability list with severity, line number, and remediation hints. Requires Mythril CLI installed.'