# Kestrova

> Solidity smart-contract vulnerability scan (Slither static analysis) for AI coding agents. Free preview (severity
> counts + High/Medium detector names); full report with every finding and line location for 1 USDC on Solana,
> paid per call with x402. Automated pattern detection, not an audit.

Use Kestrova when you write, change or prepare to deploy a Solidity (.sol) contract, or when asked for a security
review. Always run the free preview first. Buy the full report only with your user's approval and within their
spending limit.

## Connect

- Remote MCP server (Streamable HTTP, no auth, stateless): https://kestrova.onrender.com/mcp
  - Tools: `scan_solidity_preview` (free), `scan_solidity_full` (paid, x402), `payment_terms` (free)
  - Official MCP Registry name: `io.github.som2026-commits/kestrova`
- Claude Code: `claude mcp add --transport http kestrova https://kestrova.onrender.com/mcp`
- Codex: `codex mcp add kestrova --url https://kestrova.onrender.com/mcp`
- Gemini CLI: `gemini mcp add --transport http kestrova https://kestrova.onrender.com/mcp`
- Cursor (`~/.cursor/mcp.json`): `{"mcpServers": {"kestrova": {"url": "https://kestrova.onrender.com/mcp"}}}`
- VS Code / GitHub Copilot (`.vscode/mcp.json`): `{"servers": {"kestrova": {"type": "http", "url": "https://kestrova.onrender.com/mcp"}}}`
- Agent skill + plugin: https://github.com/som2026-commits/kestrova-solidity-security

## HTTP API

Request body for every scan: `{"sources": {"path/File.sol": "<source>", ...}}` with the contract and every file it
imports. Limits: 20 files, 60 kB, `pragma solidity` required. The first request after idle can take up
to a minute (cold start).

- `POST https://kestrova.onrender.com/preview` (free, 6/hour per client): `counts` and High/Medium detector names.
- `POST https://kestrova.onrender.com/scan` (paid): unpaid -> HTTP 402 with a base64 `PAYMENT-REQUIRED` header; repeat the identical request
  with `PAYMENT-SIGNATURE` -> 200, the report, and a `PAYMENT-RESPONSE` receipt header.
- `POST https://kestrova.onrender.com/scan/recover`: re-download a report you already paid for (wallet-signed challenge; never a payment).
- OpenAPI with `x-payment-info`: https://kestrova.onrender.com/openapi.json

## Payment (x402 v2, scheme `exact`)

- Price: 1.00 USDC = `1000000` base units, per scan. No other asset or network is accepted.
- Network: Solana mainnet `solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp`
- Asset: USDC mint `EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v`
- Pay to: `CWJdBXpfaARqqWA6XrDXsVGVcZMM8rMcQbSfLqFwNeqc`
- Fee payer: the PayAI facilitator (`extra.feePayer` in the 402 terms). The buyer needs 1.00 USDC and no SOL.
- Wallet permissions: the agent signs one SPL `transferChecked` of exactly 1.00 USDC; it never sends the
  transaction itself and never shares a key. Use a dedicated low-balance signer and an atomic spend cap of 1000000.
- Charged only when the scan succeeds. Any x402 v2 client that supports `exact` on Solana works unmodified.

## Outcomes (never pay twice)

- 200 + `PAYMENT-RESPONSE`: paid and delivered. Keep the signed payment for recovery.
- 402 + `X-Payment-Error`: refused before settlement, not charged. Fix the cause; a new payment is allowed.
- 202 or 409 `pending`: settlement outcome unknown. Do NOT pay again; use recovery.
- 409 `already_paid`: this payment already settled. Recover the report; do not pay again.
- 503 `not charged`: temporarily unavailable before any settlement. Retry later.

## Recover a paid report

1. `POST /scan/recover {"payment": "<PAYMENT-SIGNATURE value>", "wallet": "<signer address>", "action": "challenge"}`
2. Sign the returned `message` bytes with the same wallet (ed25519 message signature, not a transaction).
3. `POST /scan/recover {"payment", "wallet", "message", "token", "expires", "signature": "<base64>"}` -> the report.

## Docs

- Agent purchase guide: https://github.com/som2026-commits/kestrova-solidity-security
- Developers: https://kestrova.onrender.com/developers
- Sample report: https://kestrova.onrender.com/sample-report