Aikido Mcp

io.github.BajuzjefePublished by GitHub account Bajuzjefev0.1.1Updated Oct 24, 2026

Security analysis for Aiken smart contracts on Cardano. 75 vulnerability detectors.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs Aikido security scans on Aiken smart contracts for Cardano, letting an assistant analyze projects, list detectors and look up weaknesses.

What you can do
  • Scan an Aiken project for vulnerabilities, with options for minimum severity, static-only mode, incremental analysis against a Git ref, and a config file
  • List the 75 detectors with severity, category, CWE mapping and tier, filtered by severity or category
  • Explain a specific detector in detail
  • Search the Cardano Weakness Classification registry by CWC ID, severity, detector name or keyword
When to use it
Useful when developing or auditing Aiken smart contracts on Cardano and you want vulnerability findings, detector documentation or weakness-classification context available inside the assistant during development.
Requirements
Runs locally over stdio, typically via npx. The aikido-aiken binary must be installed (for example globally via npm) or located through the AIKIDO_BINARY environment variable; otherwise it is looked up on PATH. The CWC lookup tool works without the binary.
Before you install
The server spawns a local binary and reads project files from the path you give it, so point it only at projects you intend to scan. Scans may take time on large projects; static-only mode trades depth for speed.

Installation

In SourceWeft

  1. Open Aikido Mcp in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

aikido-mcp

MCP server for Aikido — security analysis for Aiken smart contracts (Cardano).

Lets any MCP-compatible AI assistant (Claude Code, Cursor, Windsurf) run security scans on Aiken projects inline during development.

Setup

Claude Code

Add to ~/.claude/settings.json:

json
{  "mcpServers": {    "aikido": {      "command": "npx",      "args": ["-y", "aikido-mcp"]    }  }}

Cursor / Windsurf

Add to .cursor/mcp.json or equivalent:

json
{  "mcpServers": {    "aikido": {      "command": "npx",      "args": ["-y", "aikido-mcp"]    }  }}

Prerequisites

The aikido-aiken binary must be available. Install via:

bash
npm install -g aikido-aiken

Or set AIKIDO_BINARY env var to point to the binary.

Tools

aikido_analyze

Scan an Aiken project for security vulnerabilities.

ParameterTypeRequiredDescription
project_pathstringyesPath to Aiken project (must contain aiken.toml)
min_severityenumnoMinimum severity: info, low, medium, high, critical
static_onlybooleannoSkip multi-lane analysis for speed
diffstringnoGit ref for incremental analysis
configstringnoPath to .aikido.toml config

aikido_list_rules

List all 75 detectors with severity, category, CWE mapping, and tier.

ParameterTypeRequiredDescription
severityenumnoFilter by minimum severity
categorystringnoFilter by category

aikido_explain

Detailed explanation of a specific detector.

ParameterTypeRequiredDescription
detectorstringyesDetector name (e.g., missing-signature-check)

aikido_cwc_lookup

Search the Cardano Weakness Classification registry.

ParameterTypeRequiredDescription
querystringyesCWC ID, severity, detector name, or keyword

How it works

The server spawns the aikido binary with --format json and parses the structured output. Binary discovery checks (in order):

  1. AIKIDO_BINARY environment variable
  2. npm sibling (aikido-aiken package)
  3. aikido or aikido-aiken on PATH

The CWC lookup tool uses a static registry and does not require the binary.

License

MIT

Source: mcp-server/README.md at commit 2c59560

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.1LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts