aikido-mcp

MCP server for Aikido — security analysis for Aiken smart contracts (Cardano).

Lets any MCP-compatible AI assistant (Claude Code, Cursor, Windsurf) run security scans on Aiken projects inline during development.

Setup

Claude Code

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "aikido": {
      "command": "npx",
      "args": ["-y", "aikido-mcp"]
    }
  }
}

Cursor / Windsurf

Add to .cursor/mcp.json or equivalent:

{
  "mcpServers": {
    "aikido": {
      "command": "npx",
      "args": ["-y", "aikido-mcp"]
    }
  }
}

Prerequisites

The aikido-aiken binary must be available. Install via:

npm install -g aikido-aiken

Or set AIKIDO_BINARY env var to point to the binary.

Tools

aikido_analyze

Scan an Aiken project for security vulnerabilities.

Parameter	Type	Required	Description
project_path	string	yes	Path to Aiken project (must contain aiken.toml)
min_severity	enum	no	Minimum severity: info, low, medium, high, critical
static_only	boolean	no	Skip multi-lane analysis for speed
diff	string	no	Git ref for incremental analysis
config	string	no	Path to .aikido.toml config

aikido_list_rules

List all 75 detectors with severity, category, CWE mapping, and tier.

Parameter	Type	Required	Description
severity	enum	no	Filter by minimum severity
category	string	no	Filter by category

aikido_explain

Detailed explanation of a specific detector.

Parameter	Type	Required	Description
detector	string	yes	Detector name (e.g., missing-signature-check)

aikido_cwc_lookup

Search the Cardano Weakness Classification registry.

Parameter	Type	Required	Description
query	string	yes	CWC ID, severity, detector name, or keyword

How it works

The server spawns the aikido binary with --format json and parses the structured output. Binary discovery checks (in order):

1. AIKIDO_BINARY environment variable
2. npm sibling (aikido-aiken package)
3. aikido or aikido-aiken on PATH

The CWC lookup tool uses a static registry and does not require the binary.

License

MIT