An automated security review of smart contract source code, delivered as a PDF report. The service runs as a remote MCP server operated by SOKEN LTD.
What It Does
You provide a deployed contract address and chain, a public repository and commit, source files in the conversation, or private code through a one-time upload link. The server pins the exact source, builds it in a sandboxed environment, runs static analysis, and maps entry points, roles, external calls and upgrade authority. Your AI client session reads the pinned code through read-only tools, confirms or dismisses each finding with quoted code references, and submits the results. The server enforces source integrity (rejecting quotes that differ from the pinned code), computes all counts and totals, and applies a fixed severity matrix. The output is a PDF report hosted on soken.dev.
No person at SOKEN LTD reads the code or the findings before the report is issued. This is an automated review, not a manual audit.
How to Connect
Add the server URL to any MCP-compatible client:
https://mcp.soken.dev/mcp
No authentication is required. The following steps apply to most MCP clients:
- Claude (claude.ai or Claude Code): Add the URL as a remote MCP server in your MCP server settings. The tools will appear automatically in your conversation.
- ChatGPT: Add the URL through the MCP server configuration in your settings. Once added, the review tools will be available in your session.
- Cursor: Add the URL in your MCP server configuration file. The tools will be available in your editor's AI panel.
- Other MCP clients: Any client that supports the Model Context Protocol can connect using the URL above. Consult your client's documentation for configuration details.
Once connected, start a review with review_start, follow progress with review_status, and retrieve the finished report with review_report.
Supported Networks
- EVM chains (Ethereum and EVM-compatible networks, including HyperEVM)
- TRON
- Solana
- TON
- Aptos
Starknet and Sui are not supported at this time.
Supported Languages
- Solidity, Vyper (EVM, HyperEVM, TRON)
- Rust: Anchor, native, Pinocchio (Solana)
- FunC, Tact, Tolk (TON)
- Move (Aptos)
Fair-Use Limits
Two reports per user per day. For requests relayed through shared AI platform infrastructure, the limit is applied per reviewed contract, with a shared daily cap for that platform.
Publication
After a report is completed, you may choose to publish it. Publication requires your explicit consent, provided through the publication tool. Published reports are made available in our public report library at soken.dev/audits and its public mirror repository, and carry the label "Automated by SOKEN MCP".
One published report is maintained per reviewed target (same contract address on the same chain, or same repository). A later published review of the same target replaces the earlier one. Published reports remain publicly accessible until removed under our Report Removal Policy.
For reports on code you do not own, exploit details of High and Critical findings are withheld in the public profile until the code owner verifies ownership.
Legal and Policy Documents
Source Code
The source code for this service is available at github.com/Soken-LTD/contract-review.
Contact
For support, questions or feedback: hello@soken.dev