Aikido MCP Server

Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors. The aikido mcp server wraps that behind the Model Context Protocol, so an assistant can use it through 14 defined tools rather than through you.

What it actually does

Aikido goes beyond static analysis. It combines a 75-detector suite with SMT verification, transaction simulation, compliance analysis, protocol pattern detection, and grammar-aware fuzzing to find vulnerabilities in Aiken smart contracts before they reach mainnet. Multi-lane analysis cross-correlates evidence across techniques, producing findings with source context, severity ratings, CWE/CWC classifications, and actionable remediation guidance.

• The only security tool for Aiken — - no alternatives exist in the ecosystem
• 75 detectors — with CWC (Cardano Weakness Classification) and CWE mappings
• Multi-lane analysis — - static detectors, compliance, SMT verification, transaction simulation, protocol detection, fuzzing
• Validated against professional audit — - 85% coverage on TxPipe's Strike Finance audit findings (full comparison)
• Evidence framework — - findings corroborated across multiple analysis techniques (PatternMatch -> SmtProven -> SimulationConfirmed)
• 9 output formats — - terminal, JSON, SARIF, Markdown, HTML, PDF, CSV, GitLab SAST, reviewdog

Its toolset

Everything the assistant can do here goes through one of these:

• Multi — lane analysis** - static detectors, compliance, SMT verification, transaction simulation, protocol detection, fuzzing
• uses — actions/checkout@v4
• name — Install Aikido
• Lane — What it does
• Compliance — Securify2-style dual-pattern system: every security property has compliance (safe) and violation (unsafe) patterns. 10 security property variants
• Metric — Result
• Project — Findings
• Acca — 20
• Total — 176
• Detector — CWE
• double-satisfaction — CWE-362
• missing-minting-policy-check — CWE-862

Adding it to your client

Installation goes through your MCP client rather than a global install: point it at aikido-aiken on npm and it is fetched when the client starts. The copy-paste blocks for Claude Desktop, Claude Code and Cursor are further down this page.

When to reach for it

Plenty of payments and commerce servers cover similar ground. The differences that matter in practice are scope of access and how much setup stands between you and a working tool call. Aikido's toolset — Multi, uses, name and 11 more — is a fair guide to whether it matches your workflow. It is maintained by Bajuzjefe; worth a glance at recent repository activity before you build anything load-bearing on it.

SyncDev reviews every entry in this directory against the project's own documentation before publishing, and revisits them as servers change.

Caveats

• It runs with your machine's permissions. That is convenient and also the reason to think about what you point it at before you approve a tool call.
• With 14 tools registered it takes up a noticeable share of the context window; turn it off in projects that never touch Aikido.
• MCP clients confirm each tool call by default. Leave that on until you have watched what the aikido mcp server does with a few real requests.