RugProof - Smart contract security auditor for Claude Code —

项目说明

Rugproof

> Rugproof your code before someone else does.

🌐 Live site: omermaksutii.github.io/RugProof
📦 Latest: v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-E, and post-deploy monitoring

A Claude Code plugin that turns your editor into a full-stack smart contract security auditor: detection, working exploit PoCs, mainnet-fork simulation, in generation, gas profiling, soulbound on-chain audit certificates, and shareable audit cards — Solidity + Vyper across every major E.

Install

From this GitHub source (works today)

From the official Anthropic marketplace

Pending review. Once listed at claude.com/plugins:

Submit your own plugin at claude.ai/settings/plugins/submit or platform.claude.com/plugins/submit.

Local dev

Quickstart

What's in the box

45 slash commands

Audit: /audit /audit-deep /audit-strict /audit-changes /audit-live /audit-history /audit-deps /audit-multi-chain /quick-scan /rug-check /score /explain
Output: /report /card /remediate
Exploit: /exploit /exploit-chain /exploit-live
Simulation: /simulate /replay-incident
Tests / proofs: /test-gen /in /fuzz /co /symbolic /prover
Analysis: /gas /upgrade-safety / /diff-audit /audit-diff /pre-deploy /monitor
Tooling integration: /slither /mythril
Workflow: /rugproof-init /dismiss / /bounty /bounty-submit /demo
Notifications: /notify-slack /notify-discord /tweet
On-chain: /mint-cert (Berachain soulbound audit certificate)

23 specialist subagents

Functional: attacker · defender · exploit-poc-writer · in · gas-optimizer · remediation-suggester · report-writer · assembly-auditor

Protocol-specific: amm-specialist · lending-specialist · staking-specialist · bridge-specialist · go · yield-aggregator-specialist · nft-specialist

Hot-topic specialists (2025): aa-specialist (ERC-4337) · crosschain-messaging-specialist (LayerZero V2 / CCIP / Hyperlane / Wormhole / Axelar) · restaking-specialist (EigenLayer / Symbiotic / Karak) · intents-specialist (ERC-7683 / UniswapX / CoW)

Language / chain / economics: (Vyper compiler-class bugs) · l2-sequencer-specialist (rollup finality, sequencer uptime, L1↔L2) · economic-rug-specialist (owner powers + 0–100 rugability score) · zk- (proof- correctness)

45 auto-invoked skills

A detection-skill library that auto-activates when Claude sees matching code patterns. Covers the full CWE/SWC catalog plus modern DeFi-specific issues:

Classic (19): reentrancy (incl. read-only and cross-contract) · access control · oracle manipulation · flash-loan attacks · ME · signature replay · storage layout · initialization · unchecked calls · DoS · integer issues · delegatecall risks · tx-context misuse · token compatibility · appro · EIP-6780 self-destruct · inline assembly · pragma & address hygiene · centralization risk.

Hot-topic 2025 (8): ERC-4337 account abstraction · cross-chain messaging · Permit2 / EIP-2612 · ERC-1271 contract signatures · Diamond / EIP-2535 · restaking & EigenLayer AVS · ERC-7683 intents · ERC-4626 inflation/donation.

v0.2 additions (8): go · fee-on-transfer accounting · signature malleability · MEV / PBS · liquidation cascades · oracle redundancy failure · cross-contract state inconsistency · ZK bugs.

AI-quality meta-skills (4): confidence scoring · multi-pass self-critique (/audit-strict) · known-good reference comparison · false-positi loop (/dismiss + .rugproof.yml ignore: + inline // rugproof-ignore markers).

DX meta-skills (2): caching-and-incremental (skip unchanged files) · progress-and-streaming (li during long audits).

13 MCP servers

Chain I/O, test runners, history databases, static-analyzer + fuzz runners — block-explorer (Etherscan v2 multichain, EIP-1967/1822 proxy resolution) · forge-runner · hardhat-runner · anvil · tenderly · c4-history · sherlock-history · gas-tracker · token-metadata (+ GoPlus safety) · slither-runner · mythril-runner · fuzz-runner (Echidna/Medusa/Halmos). Every ser gracefully to labeled mock data offline, so the plugin works with zero configuration.

4 hooks

Pre-commit quick-scan · pre-push full audit · pre-deploy build-artifact check · post-test co analyzer. (Pre-commit and pre-push live as git hook scripts; pre-deploy and post-test wire into Claude Code's Bash hook events via plugin.json.)

5 bundled demo contracts

examples/ ships a "wow on first install" set: classic reentrancy vault, spot-oracle lending market, flash-loan go, ERC-4626 inflation attack, replay-able bridge. Run /demo after install to see Rugproof in action without bringing your own code.

Configuration

Create a .rugproof.yml at the repo root. See .rugproof.yml.example.

Inline suppression in code:

Supported

Chains: Ethereum · Berachain · Arbitrum · Base · Optimism · Polygon · BSC · Linea · zkSync · Scroll

Languages: Solidity (full) · Vyper (specialist + skill) · Stylus/Rust · CosmWasm · Solana-Anchor (dedicated skills for top vuln classes) · Yul / inline assembly (specialist)

Output formats

/report produces Markdown, HTML, PDF, JSON, and a shareable PNG audit card. /card produces just the PNG — built for social sharing.

Live site

📖 Docs + sample reports + gallery: omermaksutii.github.io/RugProof

The site is built from the docs/ folder via the GitHub Pages workflow at .github/workflows/pages.yml — every push to main that touches docs/ redeploys.

Repository layout

Build

One-liner :

Or manually:

The plugin.json points to mcp/<name>-mcp/dist/index.js for each server. Most return mock data when API keys / external tools are absent so the plugin works out-of-the-box e a fully configured en.

Roadmap

v0.1 shipped the full skeleton; the 0.2 → 1.0 arc hardened it into a tested,
real-integration, launch-ready tool.

| | Scope | Status |
|------:|:------|:------|
| 0.1.0 | Full skeleton: every command · agent · skill · MCP · hook · template · demo · NFT cert · Action · Pages site | ✅ |
| 0.2.0 | Bug-fixes + real test suites + CI gates + Etherscan v2 / GoPlus / Slither / Mythril MCPs + 4 specialists / 8 skills / 5 commands + source-generated docs | ✅ |
| 0.3.0 | EIP-1967/1822 proxy resolver · li CI · dependency maintenance | ✅ |
| 0.4.0 | Rule-pack + 2 real packs · accuracy benchmark harness | ✅ |
| 0.5.0 | fuzz-runner MCP (Echidna/Medusa/Halmos) · non-E (Stylus/CosmWasm/Solana) | ✅ |
| 0.6.0 | Monitoring MCP + /monitor · Immunefi bounty formatter | ✅ |
| 0.7.0 | On-chain certificate deploy-readiness (Berachain runbook + targets) | ✅ |
| 0.8.0 | Source-dri audit gallery | ✅ |
| 0.9.0 | Incremental cache · MCP-boundary input safety · _shared tests | ✅ |
| 1.0.0 | Launch: frozen findings schema + sem + owner-gated handoff (LAUNCH.md) | ✅ |

Shipping to users is the only remaining work, and it's external (marketplace
submission, mainnet cert deploy, API keys, hosting) — see LAUNCH.md.

License

MIT

项目信息

开发语言：JavaScript

Star 数：10

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Smart contract security auditor for Claude Code — vuln detection, exploit PoCs, mainnet-fork simulation, audit cards, on-chain certificates. Solidity + Vyper · 38 commands · 19 agents · 33 skills · 9 MCP servers.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。