KESTROVA | Solidity Security Analysis

Developer Tools

The same Slither scanner the website uses, available to scripts, CI and AI coding agents. The free preview needs no key. The full report is paid per call with x402 (1 USDC on Solana), signed by your own wallet tool, and only after you approve the price.

REST API

Free preview: severity counts and high/medium detector names. Up to 60 kB of source, a few calls per hour.

curl -s https://kestrova.onrender.com/preview \
  -H 'content-type: application/json' \
  -d '{"sources": {"Token.sol": "pragma solidity ^0.8.20; contract T {}"}}'

POST /scan returns every finding with locations. Without a payment it answers 402 Payment Required with the terms in the PAYMENT-REQUIRED header and runs nothing. Use an x402 client to pay; you are charged only after a successful scan.

Interactive API reference (OpenAPI) · openapi.json

Remote MCP server

Streamable HTTP endpoint for any MCP client:

https://kestrova.onrender.com/mcp
  • scan_solidity_preview: free counts and detector names
  • scan_solidity_full: optional, paid full report (x402 payment in _meta["x402/payment"])
  • payment_terms: current price and payment details

Also listed in the official MCP Registry as io.github.som2026-commits/kestrova.

Claude Code

Install the plugin (skill and MCP server together):

/plugin marketplace add som2026-commits/kestrova-solidity-security
/plugin install solidity-security-review@kestrova

Or add only the MCP server:

claude mcp add --transport http kestrova "https://kestrova.onrender.com/mcp?src=skill"

Codex, Cursor, VS Code / Copilot, Gemini CLI

OpenAI Codex (CLI and IDE):

codex mcp add kestrova --url "https://kestrova.onrender.com/mcp?src=codex"

Gemini CLI (extension with MCP server and instructions, or MCP only):

gemini extensions install https://github.com/som2026-commits/kestrova-solidity-security
gemini mcp add --transport http kestrova "https://kestrova.onrender.com/mcp?src=gemini"

Cursor, in ~/.cursor/mcp.json:

{"mcpServers": {"kestrova": {"url": "https://kestrova.onrender.com/mcp?src=cursor"}}}

VS Code / GitHub Copilot, in .vscode/mcp.json:

{"servers": {"kestrova": {"type": "http", "url": "https://kestrova.onrender.com/mcp?src=vscode"}}}

Agent-readable summary of everything on this page: /llms.txt.

Paying as an autonomous agent

  • Price: 1.00 USDC per full scan (1000000 base units), x402 v2 exact, Solana mainnet only. You are charged only if the scan succeeds.
  • Wallet: the signer needs 1.00 USDC and no SOL; the PayAI facilitator pays the network fee. The signer signs one USDC transferChecked; it never broadcasts.
  • Never pay twice: after pending, already_paid or a timeout, recover the report with a wallet-signed challenge at POST /scan/recover. Recovery is free and never a payment.

AI agent skills

For agents that support SKILL.md skills. The skill tells the agent to run the free check after writing Solidity, to explain results without overclaiming, and never to pay without your explicit approval.

npx skills add som2026-commits/kestrova-solidity-security --skill solidity-security-review

GitHub

Install instructions, the skill and the plugin manifest (MIT licensed; contains no server code): github.com/som2026-commits/kestrova-solidity-security