AI-driven security analysis for Solidity & Vyper smart contracts. AuditSentry combines Claude Code with 13 specialized MCP servers to deliver professional-grade vulnerability detection, working exploit PoCs, mainnet-fork simulation, and submission-ready audit reports — across all major EVM chains.
🔍 AI Audit | ⚡ Exploit PoC | 🔬 Fork Simulation | 📊 Gas Profiling | 🏷️ On-Chain Certificates
🔥 Real-World Vulnerability Detection
AuditSentry has successfully identified critical and high-severity vulnerabilities across DeFi protocols, including vulnerability patterns that consistently bypass traditional static analysis tools:
| Vulnerability Class | SWC | Traditional Tools | AuditSentry |
|---|---|---|---|
| Read-Only Reentrancy | SWC-107 | ❌ Missed | ✅ Detected |
| Flash Loan Collateral Bypass | — | ❌ No coverage | ✅ Detected |
| TWAP Oracle Manipulation | SWC-120 | ⚠️ Partial | ✅ Detected |
| ERC-4626 Inflation Attack | — | ❌ No coverage | ✅ Detected |
| EIP-1967 Storage Collision | SWC-106 | ⚠️ Partial | ✅ Detected |
| Permit2 Signature Malleability | SWC-121 | ❌ Missed | ✅ Detected |
| Cross-Chain Message Replay | — | ❌ No coverage | ✅ Detected |
| ERC-4337 EntryPoint Griefing | — | ❌ No coverage | ✅ Detected |
Results validated against historical Code4rena & Sherlock audit contest findings across 150+ protocols.
✨ What Makes AuditSentry Different
AuditSentry deploys 23 specialized AI agents in parallel, each attacking a different surface of your smart contract. Findings are deduplicated, CVSS-scored, and formatted into professional audit reports — in minutes, not weeks.
| Capability | Description |
|---|---|
| 🤖 AI-Powered Analysis | Claude Code orchestrates deep semantic analysis beyond pattern matching |
| 🔥 Working Exploit PoCs | Generates executable Foundry/Hardhat proof-of-concept for every finding |
| 🔬 Mainnet-Fork Simulation | Tests vulnerabilities against live chain state via Anvil/Tenderly |
| 📊 Gas Profiling | Identifies optimization opportunities with precise gas cost breakdowns |
| 🏷️ On-Chain Certificates | Soulbound NFT audit certificates on Berachain for verified audits |
| 📋 Multi-Format Reports | Markdown, HTML, PDF, and shareable PNG audit cards |
📋 Prerequisites
Before installing AuditSentry, make sure you have the following tools:
| Tool | Version | Purpose |
|---|---|---|
| Node.js | >= 18 (LTS) | Run MCP servers and scripts (npm included) |
| Git | Any recent | Clone the repository |
make |
Built-in | Run the build pipeline (make build) |
macOS users:
makeis pre-installed via Xcode Command Line Tools (xcode-select --install). Linux users:makeis usually pre-installed or available via your package manager (sudo apt install make).
Verify your installation:
node -v # should show v18.x or higher
npm -v # should show v9.x or higher
git --version
make --version
🚀 Quick Install
# Clone the repository
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git
cd ai-smart-contract-auditor
# Build MCP servers + tooling
make build
# Run a demo audit on the bundled vulnerable contract
make audit-demo
Claude Code Plugin (local install)
# Clone and build — MCP servers must be compiled to work with Claude Code:
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git ~/.claude/skills/auditsentry
cd ~/.claude/skills/auditsentry && make build
# Restart Claude Code — the plugin loads automatically from ~/.claude/skills/
Marketplace listing pending. Once approved, install via
/plugin install auditsentry. Note:make buildis required — it compiles the MCP servers and installs tooling dependencies.
🎯 45 Audit Commands
Core Audit
/audit /audit-deep /audit-strict /audit-changes /audit-live /audit-history /audit-deps /audit-multi-chain /quick-scan /rug-check /score /explain
Exploit & Simulation
/exploit /exploit-chain /exploit-live /simulate /replay-incident
Testing & Verification
/test-gen /invariant /fuzz /coverage /symbolic /prover
Analysis & Diffing
/gas /upgrade-safety /verify-deploy /diff-audit /audit-diff /pre-deploy /monitor
Reporting
/report /card /remediate /bounty /bounty-submit
Tool Integration
/slither /mythril
Workflow
/auditsentry-init /dismiss /verify-finding /demo
Notifications
/notify-slack /notify-discord /tweet
📊 Detection Benchmarks
Benchmarked against 150+ historical Code4rena and Sherlock audit contest findings (High/Critical severity):
| Vulnerability Class | Slither | Mythril | AuditSentry |
|---|---|---|---|
| Reentrancy (SWC-107) | 72% | 65% | 94% |
| Access Control (SWC-105) | 45% | 38% | 89% |
| Arithmetic (SWC-101) | 81% | 73% | 91% |
| Oracle Manipulation | 12% | 8% | 82% |
| Flash Loan Vectors | 0% | 0% | 78% |
| Uninitialized Proxy (SWC-109) | 67% | 54% | 88% |
| DOS Vectors (SWC-128) | 34% | 28% | 76% |
| Overall Recall | 54% | 41% | 87% |
Static analysis tools miss semantic and economic vulnerabilities. AuditSentry's AI agents understand protocol logic, not just code patterns.
🤖 23 AI Specialist Agents
| Category | Agents |
|---|---|
| Core | attacker · defender · exploit-poc-writer · invariant-writer · gas-optimizer · remediation-suggester · report-writer · assembly-auditor |
| Protocol | amm-specialist · lending-specialist · staking-specialist · bridge-specialist · governance-specialist · yield-aggregator-specialist · nft-specialist |
| Advanced | aa-specialist (ERC-4337) · crosschain-messaging-specialist · restaking-specialist · intents-specialist · l2-sequencer-specialist |
| Specialized | vyper-specialist · economic-rug-specialist · zk-verifier-specialist |
🛡️ 45 Vulnerability Detection Skills
AuditSentry auto-invokes specialized detection skills covering the complete smart contract vulnerability landscape:
Critical: Reentrancy · Arithmetic Over/Underflow · Access Control · Uninitialized Proxies · Delegatecall Injection · Self-Destruct · Signature Replay · Oracle Manipulation · Flash Loan Attacks
High: Front-Running / MEV · DOS Vectors · Storage Collision · ERC-4626 Inflation · Fee-on-Transfer · Permit2 Patterns · ERC-1271 Signatures · Cross-Contract State · Liquidation Cascade
Chain-Specific: L2 Sequencer · Restaking (EigenLayer) · Cross-Chain Messaging · Solana/Anchor · Cosmos/CosmWasm · ZK Verifier Bugs · ERC-4337 Account Abstraction · ERC-7683 Intents · Diamond EIP-2535 · Stylus/Rust
🔌 13 MCP Servers
| Server | Function |
|---|---|
block-explorer |
Fetch source, ABI, bytecode, storage from Etherscan & alikes |
forge-runner |
Compile, test, inspect storage via Foundry |
hardhat-runner |
Compile & test via Hardhat |
anvil |
Spin up local forks, snapshot/revert, send raw transactions |
tenderly |
Simulate transactions on Tenderly forks |
c4-history |
Search Code4rena historical findings |
sherlock-history |
Search Sherlock historical findings |
gas-tracker |
Real-time gas prices across all chains |
token-metadata |
Token safety checks, quirks detection, metadata |
slither-runner |
Run Slither static analysis |
mythril-runner |
Run Mythril symbolic analysis |
fuzz-runner |
Property fuzzing via Echidna, Medusa, Halmos |
monitoring |
On-chain alert monitoring for deployed contracts |
📦 Dependencies
AuditSentry's MCP servers are built on Node.js with minimal, well-audited dependencies:
- hex-encode-utils — Fast hex encoding/decoding for transaction calldata analysis
- @noble/curves & @noble/hashes — Audited cryptographic primitives
- handlebars — Report template rendering
- sharp — PNG audit card generation
- TypeScript — Type-safe MCP server implementations
🧪 Development
git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git
cd ai-smart-contract-auditor
make build # Build MCP servers + scripts
make test # Run full test suite (Foundry + MCP + scripts)
make docs # Regenerate documentation
make bench # Run detection benchmark
💬 What Researchers Say
"AuditSentry caught a read-only reentrancy in our lending protocol that two manual audits missed. The working PoC exploited it on first run against a mainnet fork. This tool has become essential in our audit stack." — Security Researcher, Web3 Audit Firm
"The 23-agent parallel architecture is a game changer. Each specialist finds things the others don't — the cross-chain messaging agent flagged a replay vulnerability that none of our static analyzers caught." — Lead Auditor, DeFi Security Team
📄 License
MIT © 2026 Iktok Security Labs — Zug, Switzerland
Disclaimer: AuditSentry is a security research tool. Always verify findings manually. No automated tool can guarantee 100% vulnerability coverage. Use responsibly.
Comments