For most of last year my smart contract workflow had an awkward seam in it: I would let an AI assistant draft a contract, then quit the editor, drop into a terminal, run a static analyzer, copy findings back, and paste them into the chat. Two tools brought security analysis into the editor itself through the Model Context Protocol (MCP), and they closed that seam for me. This is a practical walkthrough of running the OpenZeppelin Contracts MCP alongside Trail of Bits' slither-mcp inside Cursor and Claude, what each one actually checks, and the workflow I settled on for writing Solidity with fewer surprises.
MCP is a shared protocol that lets an AI assistant call external tools directly. Instead of a language model guessing at Solidity syntax from its training data, an MCP server hands the model real, structured capabilities: generate a validated contract, list every detector finding, pull the exact source of a function by line number. That distinction matters for security. A raw AI draft is a plausible-looking string; an MCP-backed answer is grounded in a tool that either enforces a rule set or runs an actual analyzer over your code.
The two servers I lean on split the job cleanly. One validates code as it is written against a maintained security-and-style rule set. The other runs static analysis on the project and exposes the results so the assistant can reason about them. Generation and auditing, both in the editor, both without me leaving the tab. That is the whole pitch of MCP smart contract security, and after a few weeks of daily use I think it holds up.
The OpenZeppelin Contracts MCP brings the library's proven security and style rules directly into any AI-driven workflow. It runs as a server and works with Cursor, Claude, Gemini, Windsurf, and VS Code. The important detail is what happens to the model's output: every line of contract code is validated against the same rule set that powers the Contracts Wizard. It automatically applies imports, modifiers, naming conventions, and security checks.
Here is the part that changed how I trust the output. Unlike generic AI code generation, the MCP does not just suggest code and hope it compiles cleanly. It replaces the model's output with verified, production-ready code that returns predictable results across platforms. So when I ask for an ERC20 with a supply cap, I am not getting the model's best imitation of OpenZeppelin — I am getting code assembled from the actual library primitives. The server can instantly generate ERC20, ERC721, and ERC1155 contracts with custom names, symbols, and supply caps from natural language prompts, without me writing the boilerplate from scratch.
In practice I use it as a scaffolding engine I can defend in a review. "Give me a mintable, pausable ERC721 with an owner role" produces a contract wired with the correct access-control modifiers and imports, rather than a hand-rolled onlyOwner that quietly forgets an edge case.
Setup is short. The package is published as @openzeppelin/contracts-mcp.
For Claude, one command registers the server:
claude mcp add OpenZeppelinContracts -- npx -y @openzeppelin/contracts-mcp
For Cursor, add the server to your MCP configuration file and point it at the server entry — Cursor reads server definitions from ~/.cursor/mcp.json. A minimal entry looks like this:
{
"mcpServers": {
"openzeppelin-contracts": {
"command": "npx",
"args": ["-y", "@openzeppelin/contracts-mcp"]
}
}
}
Restart the editor, confirm the server shows as connected in the MCP panel, and the generation tools become available to the assistant. From there I just describe the contract I want in the chat and let the server assemble it.
Generation is half the story; the other half is checking what already exists. That is where slither-mcp comes in. Trail of Bits announced it in November 2025, and it wraps Slither — their long-standing static analyzer — behind MCP so an LLM can call it.
The value is concrete. Without it, an assistant asked "who calls this function?" falls back on rudimentary tools like grep and read_file, which are error-prone on a real codebase. slither-mcp exposes Slither's static analysis API as tools, so the model can find critical code faster and navigate the project structurally. It analyzes Solidity projects built with Foundry, Hardhat, and similar toolchains, and generates metadata about contracts, functions, and inheritance hierarchies.
A few of the tools I actually see the assistant reach for:
That last one is the difference between "the AI thinks this might reenter" and "Slither flagged a reentrancy pattern here, High impact, Medium confidence, at these lines." The server also ships a typed Python client, SlitherMCPClient, if you want to script the same queries outside the editor.
slither-mcp is easy to stand up. It runs over stdio via uvx, so you do not have to manage a separate install.
For Claude Code:
claude mcp add --transport stdio slither -- uvx --from git+https://github.com/trailofbits/slither-mcp slither-mcp
For Cursor, add the equivalent server command to ~/.cursor/mcp.json:
{
"mcpServers": {
"slither": {
"command": "uvx",
"args": ["--from", "git+https://github.com/trailofbits/slither-mcp", "slither-mcp"]
}
}
}
One prerequisite worth stating plainly: Slither needs your project to compile. Point it at a real Foundry or Hardhat project and make sure forge build or npx hardhat compile succeeds first, otherwise the analyzer has nothing to chew on. Once the server connects, ask the assistant to run the detectors and it will call slither-mcp instead of guessing.
Here is the loop I run now, with both servers live in the same editor:
get_function on the flagged function and walk the call path with get_contracts. Line-numbered source keeps the conversation honest.The compounding win is that generation and audit share the same session. The assistant that wrote the code is the one reading Slither's verdict on it, so I am not re-explaining the contract to a fresh tool. I still read every finding myself — this is an assistant, not an auditor — but the friction that used to make me skip the static-analysis pass is gone.
I want to be straight about what this is not. Neither server replaces a professional audit. Slither is a static analyzer: it is excellent at known bug classes and code navigation, but it does not understand your protocol's economic assumptions, and it produces false positives you have to triage. The OpenZeppelin MCP validates against a library rule set — it makes your building blocks sound, not your business logic correct. An MCP-generated ERC20 can still be misused in a broken vesting scheme.
Two smaller gotchas from my own use. First, an LLM can still misread a correct Slither finding, so I treat detector output as the source of truth and the chat prose as commentary. Second, these are young tools — slither-mcp dates to late 2025 — so pin versions and expect the tool surface to shift. Used with that framing, though, moving security into the editor genuinely raised the floor on what I ship.
Do I need both servers, or does one cover it? They do different jobs. The OpenZeppelin Contracts MCP generates and validates new code against a security-and-style rule set; slither-mcp runs static analysis over code that already exists. I run both, but you can adopt either alone.
Does slither-mcp work with Foundry and Hardhat? Yes. It analyzes Solidity projects built with Foundry, Hardhat, and similar toolchains. The main requirement is that the project compiles before you run the detectors.
Is the OpenZeppelin MCP limited to Cursor and Claude? No. It works with Cursor, Claude, Gemini, Windsurf, and VS Code — any editor that speaks MCP. The setup command differs per client, but the server is the same.
Can I use these tools outside an editor?
slither-mcp ships a typed Python client, SlitherMCPClient, so you can query a project programmatically from scripts or agents, not only from a chat session.
Bringing security into the editor did not make me a better auditor — it made me a more consistent one. The OpenZeppelin Contracts MCP gives me generation I can defend because it is validated against a real library rule set, and Trail of Bits' slither-mcp gives me static analysis my assistant can actually reason over instead of grepping blindly. Together they turn a two-tool, two-window chore into one loop. Install both, keep your project compiling, read every finding yourself, and treat the whole thing as a strong first pass rather than a final sign-off. That framing is what makes MCP smart contract security worth the ten minutes of setup.