Docs
Use Fuzzy from an agent
An agent that is about to send money through a Solana program can check it three ways: look it up in the registry, run Fuzzy on it, or read its certification. Each works over MCP, over HTTP, and the last one directly on Solana. Everything here is free except a new scan.
The Fuzzy MCP server
A remote MCP server over Streamable HTTP. No key, no install, read only.
https://fuzzy.verafy.ai/api/mcp
Claude Code
claude mcp add --transport http fuzzy https://fuzzy.verafy.ai/api/mcp
Claude Desktop, Cursor, Windsurf and other clients
Add this to the client's MCP config, or download it:
{
"mcpServers": {
"fuzzy": { "type": "http", "url": "https://fuzzy.verafy.ai/api/mcp" }
}
}For a client that only runs local servers, bridge it with mcp-remote:
{
"mcpServers": {
"fuzzy": { "command": "npx", "args": ["-y", "mcp-remote", "https://fuzzy.verafy.ai/api/mcp"] }
}
}Tools
| Tool | Arguments | Returns |
|---|---|---|
| fuzzy_lookup | program | The latest scan of a program from the registry: score, grade, depth, proven, leads, tested on, scanned at, devnet certification, report card link. |
| fuzzy_certification | program | Reads the Verafy Certification for the exact deployed build, from Solana devnet. |
| fuzzy_registry_search | query, category, minScore, certifiedOnly | Searches the registry. Up to 25 results. |
| fuzzy_scan_instructions | program | How to scan a program that is not in the registry: the web link with the address filled in, the cost, and the CLI command. |
A good rule for an agent: before sending funds through an unfamiliar program, call fuzzy_lookup. Treat a program that is not in the registry, or has a proven finding, as unvetted, and keep amounts small until it is scanned.
HTTP API
Open to any origin. JSON.
Look a program up
GET https://fuzzy.verafy.ai/api/registry?program=<address> GET https://fuzzy.verafy.ai/api/registry # the whole registry
Returns the latest scan: score, grade, depth, depthParts, proven, leads, state (mainnet, synthetic or empty), classes (each attack class and whether it held), instructionsTried, bytecodeSha256, scannedAt and devnetCertification. A 404 means Fuzzy has not scanned the program.
Check a certification
GET https://fuzzy.verafy.ai/api/certification?program=<address>
Hashes the program's deployed bytecode (devnet first, then mainnet) and reads the certification account on devnet. Returns certified, level, levelName, score, seats, families, ruling, bytecodeHash, programCluster and reason.
Run a scan
POST https://fuzzy.verafy.ai/api/scan
content-type: application/json
{ "address": "<program address>", "network": "mainnet", "addons": ["advisories"] }Or send multipart/form-data with program (a .so file, up to 4 MB) and optional idl. addons is optional, for mainnet programs: verified (+25 credits) checks for a verified build of public source; advisories (+100, includes verified) checks that build's dependencies against RustSec. Results arrive in the report's addons field and never change the score. All add-ons and prices. A Sniff run costs 100 Verafy credits from the caller's balance (the verafy_vid cookie on .verafy.ai). The response streams newline-delimited JSON events:
| Event type | Meaning |
|---|---|
| charged | Credits were spent. Carries the new balance, or mock: true when credits are not connected. |
| note | A line of progress text. |
| progress | Transactions sent so far. |
| finding | A proven finding, with the attack transaction. |
| report | The full report. Always the last event of a successful run. |
| error | The run failed and the credits were returned. |
Build machine add-ons
Rebuild from source (500 credits), static lints (300), Deep Fuzz (1,000), property fuzzing (1,500), the AI design review (1,000), or all of them as Kitchen Sink (4,000). They run for minutes on Fuzzy's build machine, so they are jobs: start one, then poll it.
POST https://fuzzy.verafy.ai/api/jobs
{ "address": "<mainnet program>", "jobs": ["deep", "property"], "idl": { ...optional Anchor IDL } }
-> { "id": "<job id>", "jobs": [...], "skipped": [...], "charged": 2500 }
GET https://fuzzy.verafy.ai/api/jobs/<job id>
-> { "status": "queued" | "running" | "done" | "failed", "result": { "rebuild", "lints", "deep", "property", "review" } }Checks that need source (rebuild, lints, review) run only when the program has a verified build, and you are never charged for one that cannot run. A job that fails is refunded. GET /api/jobs says whether the build machine is connected.
Command line
git clone https://github.com/Verafyai/fuzzy && cd fuzzy && npm install npm run fuzzy -- run <program address> # a deployed program, mainnet by default npm run fuzzy -- run <address> --network devnet --rpc <url> npm run fuzzy -- run program.so --idl idl.json # a local build npm run fuzzy -- replay report.json F1 --program program.so # re-run a finding's transaction
Node 22. Every attack runs in LiteSVM on your machine; reading a deployed program is the only network call. A paid RPC in --rpc gives Fuzzy more recent calls to replay, and a deeper run.
Read a certification on Solana
No Fuzzy server needed. The certification program on devnet is 1dcJPW3aGMCWDkNV6do6sEUwSxLdf8NtSuQb1teCdXt.
- Read the program account. For the upgradeable loader, read its program data account and skip the 45-byte header.
- Hash the ELF: SHA-256 of the bytes up to the end of the section header table, without trailing padding.
- Derive the account at seeds
["cert", program, bytecode hash]under the certification program, and read it on devnet. - No account means no certification for this build. Otherwise the account holds the level, score, report hash, ruling and jury size.
The Verafy Harness package @verafyharness/solana exports lookupCertification, which does all four.
Limits
- Fuzzy is a prototype. Certifications live on Solana devnet, and devnet certifications so far had jurors voting by script.
- A Sniff run scores 60 at most: only Deep Fuzz measures branch coverage.
- Theft is measured in SOL everywhere, and in tokens during mainnet replay. Runs built from an IDL alone measure SOL only.
- A high score means a program survived these attacks. It is not an audit.