aikido-aiken

Security analysis platform for Aiken smart contracts on Cardano.

75 detectors, SMT verification, transaction simulation, compliance analysis, protocol pattern detection, and grammar-aware fuzzing. Built in Rust.

Install

npm install -g aikido-aiken

Or run directly with npx:

npx aikido-aiken /path/to/your-aiken-project

Usage

# Scan an Aiken project
aikido-aiken /path/to/project

# JSON output
aikido-aiken /path/to/project --format json

# SARIF output (for GitHub Code Scanning)
aikido-aiken /path/to/project --format sarif

# Filter by severity
aikido-aiken /path/to/project --min-severity medium

# Fail CI on high+ findings
aikido-aiken /path/to/project --fail-on high

Example Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  AIKIDO v0.3.1  Static Analysis Report
  Project: my-project v0.1.0
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  [CRITICAL] double-satisfaction
    validators/treasury.ak:23
    Spend handler accesses tx.outputs without own OutputReference.
    An attacker can satisfy multiple script inputs with a single output.

  [HIGH] missing-signature-check
    validators/treasury.ak:45
    No signer verification found in handler.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  Summary: 2 findings (1 critical, 1 high)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

How It Works

This package is a thin wrapper that downloads the pre-built Aikido binary for your platform during npm install. Supported platforms:

| OS | x64 | ARM64 | |----|-----|-------| | macOS | Yes | Yes | | Linux | Yes | Yes | | Windows | Yes | - |

If no pre-built binary is available, install from source:

cargo install --git https://github.com/Bajuzjefe/Aikido-Security-Analysis-Platform aikido-cli

Other Installation Methods

# Homebrew (macOS/Linux)
brew install Bajuzjefe/tap/aikido

# Docker
docker run --rm -v $(pwd):/project ghcr.io/bajuzjefe/aikido:0.3.1 /project

# GitHub Action
- uses: Bajuzjefe/[email protected]

Output Formats

text json sarif markdown html pdf csv gitlab-sast rdjson

Links

• GitHub
• 75 Detectors
• Configuration
• CI/CD Integration

License

MIT