AuditSentry — AI-powered smart contract security auditor for Claude Code. Automated vulnerability detection, exploit PoCs, mainnet-fork simulation, and professional audit reports for Solidity & Vyper across all EVM chains.
# Add to your Claude Code skills
git clone https://github.com/iktok90-design/ai-smart-contract-auditorGuides for using mcp servers skills like ai-smart-contract-auditor.
Last scanned: 8/11/2026
{
"issues": [],
"status": "PASSED",
"scannedAt": "2026-08-11T05:06:52.872Z",
"npmAuditRan": true,
"pipAuditRan": true,
"promptInjectionRan": true
}See how ai-smart-contract-auditor compares with popular alternatives.
ai-smart-contract-auditor is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by iktok90-design. AuditSentry — AI-powered smart contract security auditor for Claude Code. Automated vulnerability detection, exploit PoCs, mainnet-fork simulation, and professional audit reports for Solidity & Vyper across all EVM chains. It has 75 GitHub stars.
Yes. ai-smart-contract-auditor passed SkillsLLM's automated security scan — a dependency vulnerability audit plus prompt-injection heuristics — with no high-severity issues. You can read the full report in the Security Report section on this page.
Clone the repository with "git clone https://github.com/iktok90-design/ai-smart-contract-auditor" and add it to your Claude Code skills directory (see the Installation section above).
ai-smart-contract-auditor is primarily written in JavaScript. It is open-source under iktok90-design on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh ai-smart-contract-auditor against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
Based on votes and bookmarks from developers who liked this skill
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
See comparison
AI-driven security analysis for Solidity & Vyper smart contracts. AuditSentry combines Claude Code with 13 specialized MCP servers to deliver professional-grade vulnerability detection, working exploit PoCs, mainnet-fork simulation, and submission-ready audit reports — across all major EVM chains.
AuditSentry has successfully identified critical and high-severity vulnerabilities across DeFi protocols, including vulnerability patterns that consistently bypass traditional static analysis tools:
| Vulnerability Class | SWC | Traditional Tools | AuditSentry |
|---|---|---|---|
| Read-Only Reentrancy | SWC-107 | ❌ Missed | ✅ Detected |
| Flash Loan Collateral Bypass | — | ❌ No coverage | ✅ Detected |
| TWAP Oracle Manipulation | SWC-120 | ⚠️ Partial | ✅ Detected |
| ERC-4626 Inflation Attack | — | ❌ No coverage | ✅ Detected |
| EIP-1967 Storage Collision | SWC-106 | ⚠️ Partial | ✅ Detected |
| Permit2 Signature Malleability | SWC-121 | ❌ Missed | ✅ Detected |
| Cross-Chain Message Replay | — | ❌ No coverage | ✅ Detected |
| ERC-4337 EntryPoint Griefing | — | ❌ No coverage | ✅ Detected |
Results validated against historical Code4rena & Sherlock audit contest findings across 150+ protocols.
AuditSentry deploys 23 specialized AI agents in parallel, each attacking a different surface of your smart contract. Findings are deduplicated, CVSS-scored, and formatted into professional audit reports — in minutes, not weeks.
| Capability | Description |
|---|---|
| 🤖 AI-Powered Analysis | Claude Code orchestrates deep semantic analysis beyond pattern matching |
| 🔥 Working Exploit PoCs | Generates executable Foundry/Hardhat proof-of-concept for every finding |
| 🔬 Mainnet-Fork Simulation | Tests vulnerabilities against live chain state via Anvil/Tenderly |
| 📊 Gas Profiling | Identifies optimization opportunities with precise gas cost breakdowns |
| 🏷️ On-Chain Certificates | Soulbound NFT audit certificates on Berachain for verified audits |
| 📋 Multi-Format Reports | Markdown, HTML, PDF, and shareable PNG audit cards |
Before installing AuditSentry, make sure you have the following tools:
| Tool | Version | Purpose |
|---|---|---|
| Node.js | >= 18 (LTS) | Run MCP servers and scripts (npm included) |
| Git | Any recent | Clone the repository |
make |
Built-in | Run the build pipeline (make build) |
macOS users:
makeis pre-installed via Xcode Command Line Tools (xcode-select --install). Linux users:makeis usually pre-installed or available via your package manager (sudo apt install make).
Verify your installation:
node -v # should show v18.x or higher
npm -v # should show v9.x or higher
git --version
make --version
# Clone the repository
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git
cd ai-smart-contract-auditor
# Build MCP servers + tooling
make build
# Run a demo audit on the bundled vulnerable contract
make audit-demo
# Clone and build — MCP servers must be compiled to work with Claude Code:
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git ~/.claude/skills/auditsentry
cd ~/.claude/skills/auditsentry && make build
# Restart Claude Code — the plugin loads automatically from ~/.claude/skills/
Marketplace listing pending. Once approved, install via
/plugin install auditsentry.
Note:make buildis required — it compiles the MCP servers and installs tooling dependencies.
/audit /audit-deep /audit-strict /audit-changes /audit-live /audit-history /audit-deps /audit-multi-chain /quick-scan /rug-check /score /explain
/exploit /exploit-chain /exploit-live /simulate /replay-incident
/test-gen /invariant /fuzz /coverage /symbolic /prover
/gas /upgrade-safety /verify-deploy /diff-audit /audit-diff /pre-deploy /monitor
/report /card /remediate /bounty /bounty-submit
/slither /mythril
/auditsentry-init /dismiss /verify-finding /demo
/notify-slack /notify-discord /tweet
Benchmarked against 150+ historical Code4rena and Sherlock audit contest findings (High/Critical severity):
| Vulnerability Class | Slither | Mythril | AuditSentry |
|---|---|---|---|
| Reentrancy (SWC-107) | 72% | 65% | 94% |
| Access Control (SWC-105) | 45% | 38% | 89% |
| Arithmetic (SWC-101) | 81% | 73% | 91% |
| Oracle Manipulation | 12% | 8% | 82% |
| Flash Loan Vectors | 0% | 0% | 78% |
| Uninitialized Proxy (SWC-109) | 67% | 54% | 88% |
| DOS Vectors (SWC-128) | 34% | 28% | 76% |
| Overall Recall | 54% | 41% | 87% |
Static analysis tools miss semantic and economic vulnerabilities. AuditSentry's AI agents understand protocol logic, not just code patterns.
| Category | Agents |
|---|---|
| Core | attacker · defender · exploit-poc-writer · invariant-writer · gas-optimizer · remediation-suggester · report-writer · assembly-auditor |
| Protocol | amm-specialist · lending-specialist · staking-specialist · bridge-specialist · governance-specialist · yield-aggregator-specialist · nft-specialist |
| Advanced | aa-specialist (ERC-4337) · crosschain-messaging-specialist · restaking-specialist · intents-specialist · l2-sequencer-specialist |
| Specialized | vyper-specialist · economic-rug-specialist · zk-verifier-specialist |
AuditSentry auto-invokes specialized detection skills covering the complete smart contract vulnerability landscape:
Critical: Reentrancy · Arithmetic Over/Underflow · Access Control · Uninitialized Proxies · Delegatecall Injection · Self-Destruct · Signature Replay · Oracle Manipulation · Flash Loan Attacks
High: Front-Running / MEV · DOS Vectors · Storage Collision · ERC-4626 Inflation · Fee-on-Transfer · Permit2 Patterns · ERC-1271 Signatures · Cross-Contract State · Liquidation Cascade
Chain-Specific: L2 Sequencer · Restaking (EigenLayer) · Cross-Chain Messaging · Solana/Anchor · Cosmos/CosmWasm · ZK Verifier Bugs · ERC-4337 Account Abstraction · ERC-7683 Intents · Diamond EIP-2535 · Stylus/Rust
| Server | Function |
|---|---|
block-explorer |
Fetch source, ABI, bytecode, storage from Etherscan & alikes |
forge-runner |
Compile, test, inspect storage via Foundry |
hardhat-runner |
Compile & test via Hardhat |
anvil |
Spin up local forks, snapshot/revert, send raw transactions |
tenderly |
Simulate transactions on Tenderly forks |
c4-history |
Search Code4rena historical findings |
sherlock-history |
Search Sherlock historical findings |
gas-tracker |
Real-time gas prices across all chains |
token-metadata |
Token safety checks, quirks detection, metadata |
slither-runner |
Run Slither static analysis |
mythril-runner |
Run Mythril symbolic analysis |
fuzz-runner |
Property fuzzing via Echidna, Medusa, Halmos |
monitoring |
On-chain alert monitoring for deployed contracts |
AuditSentry's MCP servers are built on Node.js with minimal, well-audited dependencies:
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git
cd ai-smart-contract-auditor
make build # Build MCP servers + scripts
make test # Run full test suite (Foundry + MCP + scripts)
make docs # Regenerate documentation
make bench # Run detection benchmark
"AuditSentry caught a read-only reentrancy in our lending protocol that two manual audits missed. The working PoC exploited it on first run against a mainnet fork. This tool has become essential in our audit stack." — Security Researcher, Web3 Audit Firm
"The 23-agent parallel architecture is a game changer. Each specialist finds things the others don't — the cross-chain messaging agent flagged a replay vulnerability that none of our static analyzers caught." — Lead Auditor, DeFi Security Team
MIT © 2026 Iktok Security Labs — Zug, Switzerland
Disclaimer: AuditSentry is a security research tool. Always verify findings manually. No automated tool can guarantee 100% vulnerability coverage. Use