EVMole

io.github.cdumpPublished by GitHub account cdumpv0.9.4Updated Oct 24, 2026

Local structured analysis of deployed EVM runtime bytecode

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Analyzes deployed EVM runtime bytecode locally, extracting function selectors, arguments, mutability, storage access, metadata, and control flow.

What you can do
Exposes one tool, analyze_evm_bytecode, which takes hexadecimal runtime bytecode plus optional include feature names, offset, and limit. It can extract function selectors and dispatch locations, inferred arguments and state mutability, inferred persistent and transient storage access, compiler metadata, and opt-in disassembly, basic blocks, and a control-flow graph. Results come back as structured content with a JSON text fallback, and warnings and pagination should be checked before interpreting them.
When to use it
Useful when an assistant needs to inspect or reason about deployed EVM contract bytecode without source code, for example to list selectors, infer function signatures or mutability, or look at storage access and control flow. It is a local analysis tool, not a chain client.
Requirements
Node.js 22 or newer, run locally over stdio via npx evmole-mcp@latest. No credentials, API keys, or network access are required.
Before you install
The server makes no network requests, needs no credentials, and writes no files. Its outputs are inferred, not verified source-level facts: arguments, mutability, and storage descriptions are guesses. It does not decode calldata, verify source, execute creation bytecode, or fully decompile. Disassembly and control-flow output can be large, so check warnings and pagination.

Installation

In SourceWeft

  1. Open EVMole in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

evmole-mcp

evmole-mcp is the local MCP server for EVMole, a structured analyzer for deployed EVM runtime bytecode. It exposes one tool, analyze_evm_bytecode, for use by MCP-compatible agents and clients.

Start the server

bash
npx -y evmole-mcp@latest

Node.js 22 or newer is required.

Configure an MCP client

json
{  "mcpServers": {    "evmole": {      "command": "npx",      "args": ["-y", "evmole-mcp@latest"]    }  }}

The server communicates over stdio.

Analyze runtime bytecode

The analyze_evm_bytecode tool accepts hexadecimal bytecode, optional include feature names, and optional offset and limit values. It can extract:

  • function selectors and dispatch locations;
  • inferred arguments and state mutability;
  • inferred persistent and transient storage access;
  • compiler metadata;
  • disassembly, basic blocks, and a control-flow graph.

Function selectors can be requested on their own with selectors. Requesting arguments or stateMutability also enables selector extraction, and the requested function information is combined in analysis.functions. Other requested analyses are returned in their corresponding analysis fields.

If include is omitted, the tool analyzes selectors, arguments, state mutability, both storage domains, and metadata. Disassembly and control-flow features are opt-in because their output can be large. The tool returns the canonical version 1 EVMole response as structured content plus a JSON text fallback. Check warnings and pagination before interpreting the result.

Privacy and limitations

The server uses stdio only, makes no network requests, requires no credentials, does not fetch contract addresses, and writes no files. It does not decode calldata, verify source, execute creation bytecode, or fully decompile source. Arguments, mutability, and storage descriptions are inferred rather than verified source-level facts.

Each evmole-mcp release depends on the matching exact evmole version.

See https://github.com/cdump/evmole/tree/master/agent for full setup and privacy guidance. Report problems at https://github.com/cdump/evmole/issues.

Source: agent/mcp/README.md at commit 1bcfbca

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

2
  1. v0.9.4LatestOct 13, 2026
  2. v0.9.3Sep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts