💣 soliint

AI Security for Solidity - npm install only, zero Python. 100% free, open-source.

Slither needs Python + 400 dependencies. soliint is one npm package.

  ╔══════════════════════════════════════════════════════════╗
  ║  soliint audit  →  19 rules  →  score 0-100  →  grade A-F ║
  ║  HTML + PDF + JSON + SARIF + badge + CI + MCP            ║
  ╚══════════════════════════════════════════════════════════╝

🚀 Quick Start

curl -fsSL https://soliint.vercel.app/install.sh | bash   # one command, registers `soliint`

soliint audit ./contracts           # recursive .sol scan
soliint audit MyToken.sol --fail-on high   # CI: exit 1 on high+
soliint nuke ./contracts --target A # AI deep audit + autofix
soliint fix .                       # autofix + fix-verify loop
soliint watch ./contracts           # re-audit on save
soliint install                     # wire soliint-mcp into your AI agents

The installer checks for Node.js, installs soliint-cli globally, verifies the soliint command, shows a success message with a quick-start guide, and the first soliint run opens the AI-agent picker automatically.

Output lands in .soliint/audit/<timestamp>/: HTML report, PDF, report.json, report.sarif (GitHub code scanning), optional badge.svg.

⚡ Commands

| Command | What it does | |---|---| | soliint audit [path] | 🔍 Scan .sol file or folder. Reports: HTML, PDF, JSON, SARIF | | soliint fix [path] | 🔧 Autofix + fix-verify loop (backup → fix → re-audit) | | soliint nuke [path] | 💣 ALL THINGS AGGRESSIVE - full AI deep audit | | soliint v2 gas | ⛽ Gas optimization hints | | soliint v2 storage | 📦 Storage layout visualizer (slot estimation) | | soliint v2 deps | 🔗 Dependency/import vulnerability lookup | | soliint v2 freshness | ⏳ EIP/pattern freshness checker | | soliint v2 history | 📈 Audit history trends (.soliint/history.json) | | soliint v2 coverage | 🎯 Findings vs forge coverage (lcov) | | soliint watch | 👁️ Re-audit on save - live diff feedback | | soliint rollback | ↩️ Restore files from last backup | | soliint init / rules / explain <rule> | Config / rule list / rule deep-dive | | soliint badge | 🏅 README score badge generator | | soliint pr-comment | 💬 GitHub PR bot comment (CI) | | soliint install | 🤖 Interactive MCP setup for Claude, Cursor, Windsurf, Hermes, Codex, OpenCode, OpenClaw, Pi |

💣 soliint nuke - ALL THINGS AGGRESSIVE

The full AI deep-audit pipeline in one command:

audit (19 rules)
   ↓
⚖️ severity re-ranking (static vs historical context)
   ↓
🧪 exploit PoC specs (high/critical findings)
   ↓
🔗 hack correlation (The DAO, Parity, Wormhole, BonqDAO...)
   ↓
✅ professional audit checklist (17 checks, Hacken/Veridise-style)
   ↓
🔧 autofix + fix-verify loop (N iterations, --target A stop)
   ↓
🧪 forge test gate (if Foundry project)
   ↓
📦 rollback backup (.soliint/backups/<ts>)
   ↓
📋 FINAL REPORT: score journey + before/after diff + attack-surface summary

npx soliint-cli nuke ./contracts --target A --max-iters 3
npx soliint-cli nuke . --no-fix          # intelligence only, no autofix
npx soliint-cli audit . --theme light    # light theme report (PDF-friendly)
npx soliint-cli fix .                    # just autofix + verify
npx soliint-cli rollback                 # restore if a fix broke something

📊 Audit Report

Every audit produces a dark-themed professional report:

| Artifact | Format | Purpose | |---|---|---| | *-report.html | HTML | Interactive findings + snippets + fixes | | *-report.pdf | PDF | Print/share (rendered from HTML via Chrome) | | report.json | JSON | Machine-readable | | report.sarif | SARIF 2.1.0 | GitHub code scanning upload |

┌──────────────────────────────────────────────────────┐
│  soliint audit                                       │
│  score 0/100 (F) · 1 file · 19 rules                 │
│  1 critical, 10 high, 10 medium, 4 low, 0 info       │
└──────────────────────────────────────────────────────┘

Both dark and light themes: soliint audit . --theme light.

🛡️ 19 Vulnerability Rules

| Severity | Rules | |---|---| | 🔴 Critical | selfdestruct | | 🟠 High | reentrancy, tx-origin, missing-access-control, delegatecall, unprotected-withdraw, storage-pointer, eth-send-in-loop | | 🟡 Medium | unchecked-low-level-call, unsafe-assembly, zero-address-check, erc20-return-unchecked, unbounded-loop, abi-encodepacked-collision, blockhash-randomness | | 🔵 Low | timestamp, floating-pragma, shadowing, assert-require |

npx soliint-cli explain <rule-id> gives severity, description, and fix guidance for any rule.

🤖 soliint-mcp - AI Agent Integration

soliint install    # interactive: pick your agents

| MCP Tool | What the agent gets | |---|---| | scan | Deterministic audit (text/JSON) | | rules | All 19 rules + descriptions | | ai_audit | AI deep-analysis prompt (findings + focus area) | | test_spec | Foundry test-generation standards | | fix_standards | Strict fix standards - agent writes the diff | | exploit_poc | Exploit PoC spec - agent writes the attack test | | invariant_spec | Foundry invariant test standards | | explain | Rule deep-dive |

Supports 8 agents: Claude Code, Cursor, Windsurf, Hermes, Codex, OpenCode, OpenClaw, Pi.

🏅 Badge

soliint badge          # writes badge.svg + prints markdown

🔧 CI / GitHub Action

- uses: soliint/soliint@v1
  with:
    path: ./contracts
    fail-on: high

Posts a PR summary comment + uploads SARIF for code scanning.

❤️ Why soliint

• Zero Python - npm install and go. No venvs, no pip, no 400 transitive deps.
• 100% free - non-commercial, MIT, open-source forever.
• Deterministic + AI - consistent static rules, then AI intelligence on top.
• Community-friendly - each rule is a separate module; PRs welcome.

soliint · free forever · soliint.vercel.app