Mcp SolverBLOCK
Model Context Protocol (MCP) server for constraint optimization and solving"
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://opensource.org/licenses/MIT) [](https://www.python.org/)
An MCP server for constraint solving (SAT, MaxSAT, SMT, CP, ASP, DP). It turns the connected LLM host into a solver-writing agent: the host gets a Python kernel preloaded with a real solver library, modeling instructions for the chosen backend, and a submission gate. The host encodes the problem, runs and verifies it against the real solver, and submits the final program — the outcome is the solution plus the verified solver program that produced it.
Version 4 is a complete re-architecture. Both the MCP interface and the solving engine changed; the design from the SAT 2025 paper (v3) lives on unchanged on the `v3` branch. See From v3 to v4 below.
The MCP server
mcp-solver-serve runs over stdio and works with any MCP host: Claude Desktop, Claude Code, Cursor, or your own client. The host LLM does the solving itself — the server is a solver toolkit; it runs no LLM and needs no API key:
- `select_backend(solver)` sets up a persistent IPython kernel with the
backend's solver library and helper functions, and returns the modeling instructions for that backend. Calling it again recycles the kernel for the next problem.
- Kernel tools (
python_exec,python_reset,python_status,
python_interrupt) let the host write, run, and verify a real solver program; bare python_exec calls are routed to the solving kernel automatically.
- `submit_code(code)` is the finish line: the final self-contained
program is syntax-checked and, on success, stored and linked back as an MCP resource (mcp-solver://submissions/{id}), with the verdict as structured content.
- Resources:
mcp-solver://guide(backend selection and workflow)
f35edcdc53aaOBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-solver --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} -- uvx mcp-solver{
"mcpServers": {
"mcp-solver": {
"command": "uvx",
"args": [
"mcp-solver"
],
"env": {
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}"
}
}
}
}Exposed tools (12)
8 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add | write | Add two numbers |
divide | read | Divide the first number by the second. |
echo | read | Echo back the input message |
greet | read | Greet someone by name |
multiply | read | Multiply two numbers together. |
python_exec | write | Execute Python code in the persistent solving kernel. |
python_interrupt | read | Interrupt running code in the solving kernel (state is preserved). |
python_reset | destructive | Create a new kernel (no kernel_id) or reset one (with kernel_id). |
python_status | read | Check kernel state: active kernels, defined variables, packages. |
select_backend | read | global _kernel_id |
submit_code | write | Submit the final, verified, self-contained solver program. |
subtract | read | Subtract the second number from the first. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- none-observed
- Shell
- declared (1 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (4)
print("\nsolver valid/run tokens(avg) exec(avg) wall(avg)", file=sys.stderr)python_reset
file is read even when the environment variable is unset, so the file alone is
curl -LsSf https://astral.sh/uv/install.sh | sh
Gates applied: no_behavioural_pass.
f35edcdc53aafull audit observations/trust-audit/mcp-server/szeider__mcp-solver.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | f35edcdc53aa | BLOCK | D | 69 | first audit |
Questions
What is the Mcp Solver MCP server?
Model Context Protocol (MCP) server for constraint optimization and solving"
What tools does Mcp Solver expose?
12 in total: 8 read-only, 3 that write, and 1 that can delete or overwrite (python_reset). Every one is listed on this page with its risk.
Is Mcp Solver safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Mcp Solver need?
It reads OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Mcp Solver run?
It speaks stdio, so it runs as a local process your client starts. It is published on PyPI as mcp-solver.
How current is this page?
The grade is for one exact copy of the source (f35edcdc53aa), read on 2026-10-06. The repository is watched and re-audited when it changes.