evmoleBLOCK
EVMole is an open-source library that analyzes deployed EVM bytecode to infer function selectors, argument types, state mutability, persistent and transient storage layout, control flow, and compiler metadata, including for unverified contracts
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://evmole.xyz/) [](https://www.npmjs.com/package/evmole) [](https://crates.io/crates/evmole) [](https://pypi.org/project/evmole) [](https://pkg.go.dev/github.com/cdump/evmole/go)
EVMole is a powerful library that extracts information from Ethereum Virtual Machine (EVM) bytecode, including function selectors, arguments, state mutability, persistent and transient storage layouts, and CBOR metadata, even for unverified contracts.
Key Features
- Multi-language support: Available as JavaScript, Rust, Python, and Go libraries.
- High accuracy and performance: Outperforms existing tools.
- Broad compatibility: Tested with both Solidity and Vyper compiled contracts.
- Lightweight: Clean codebase with minimal external dependencies.
- Unverified contract analysis: Extracts information even from unverified bytecode.
- Selector dispatch classification: Distinguishes normal ABI dispatch from selectors handled by fallback logic.
- CBOR metadata: Extracts string-keyed values from a terminal, length-suffixed CBOR map without assuming a particular compiler.
Usage
JavaScript
API documentation and usage examples (Node.js, Vite, webpack, Parcel, esbuild)
npm i evmole
import { contractInfo } from 'evmole'
const code = '0x6080604052348015600e575f80fd5b50600436106030575f3560e01c80632125b65b146034578063b69ef8a8146044575b5f80fd5b6044603f3660046046565b505050565b005b5f805f6060823199f921dbaOBSERVED · 2026-10-10Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add evmole-mcp -- npx -y [email protected]
Exposed tools (1)
1 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
analyze_evm_bytecode | read |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (19)
pub fn exec(&mut self, code: &[u8], start: usize, end: Option<usize>) -> Option<StackSym> {.gitmodules
const javascriptRoot = resolve(mcpRoot, "../../javascript");
new URL("../../../javascript/dist/evmole_cli.mjs", import.meta.url),new URL(`../../tests/fixtures/${name}`, import.meta.url),} from "../../../javascript/dist/agent_api.mjs";
} from "../../../javascript/dist/agent_api.mjs";
const code = '0x6080604052348015600e575f80fd5b50600436106030575f3560e01c80632125b65b146034578063b69ef8a8146044575b5f80fd5b6044603f3660046046565b505050565b005b5f805f606084860312156057575f80fd5b833563ff
let code = hex::decode("6080604052348015600e575f80fd5b50600436106030575f3560e01c80632125b65b146034578063b69ef8a8146044575b5f80fd5b6044603f3660046046565b505050565b005b5f805f606084860312156057575f80fd5bcode = '0x6080604052348015600e575f80fd5b50600436106030575f3560e01c80632125b65b146034578063b69ef8a8146044575b5f80fd5b6044603f3660046046565b505050565b005b5f805f606084860312156057575f80fd5b833563ffffffff
code, _ := hex.DecodeString("6080604052348015600e575f80fd5b50600436106030575f3560e01c80632125b65b146034578063b69ef8a8146044575b5f80fd5b6044603f3660046046565b505050565b005b5f805f606084860312156057575f8const testCodeHex = "6080604052348015600e575f80fd5b50600436106026575f3560e01c8063fae7ab8214602a575b5f80fd5b603960353660046062565b6052565b60405163ffffffff909116815260200160405180910390f35b5f605c8260016
metadata_code = bytes.fromhex('6000a164736f6c634300081a000a')assert info.metadata.entries[0].value.value == bytes.fromhex('00081a')parcel
parcel
vite
html-webpack-plugin, webpack, webpack-cli
jsdoc-to-markdown, rollup, typescript, wasm-pack, ajv
Gates applied: no_behavioural_pass.
23199f921dbafull audit observations/trust-audit/mcp-server/cdump__evmole.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-10 | 23199f921dba | BLOCK | D | 69 | first audit |
Questions
What is the evmole MCP server?
EVMole is an open-source library that analyzes deployed EVM bytecode to infer function selectors, argument types, state mutability, persistent and transient storage layout, control flow, and compiler metadata, including for unverified contracts
What tools does evmole expose?
1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is evmole safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on.
What credentials does evmole need?
No credential environment variables were found in its source, so it appears to need none.
How does evmole run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as examples-tests at 0.0.1.
How current is this page?
The grade is for one exact copy of the source (23199f921dba), read on 2026-10-10. The repository is watched and re-audited when it changes.