DEV Community: rakhmad aulad alie

TypeScript SDK for autonomous Solidity security auditing — 7 breach scenarios, LangChain.js + Vercel AI SDK integration

rakhmad aulad alie — Mon, 07 Sep 2026 08:40:28 +0000

I've been working on an autonomous security auditing gateway for Solidity smart contracts. The TypeScript SDK just went live on npm — it runs 7 automated breach simulations against any Solidity source code in ~2ms, with no signup or API key required for the free tier.

What problem does this solve?

Most Solidity security tools are either:

Paid SaaS (Slither Pro, MythX) — requires account, subscription, API key
CLI-only (Slither, Mythril) — requires local installation, Python/Foundry setup
Manual — human auditors, weeks of lead time

This SDK gives you a programmatic, agent-native audit that runs 7 breach scenarios via a single function call. No local toolchain. No signup. No API key for the free tier.

Install

npm install nexus-gateway-sdk

The 7 Breach Scenarios

ID	Scenario	Question
BS-001	Unauthorized Minting	Can tokens be minted without authorization?
BS-002	Transfer Violation	Can transfers bypass balance/allowance checks?
BS-003	Fund Drain	Can funds be withdrawn without authorization?
BS-004	Emergency Freeze	Is there an emergency stop / pause mechanism?
BS-005	Ownership Renounce	Can ownership renunciation lock admin functions?
BS-006	Reentrancy Attack	Are external calls protected against reentrancy?
BS-007	Replay Attack	Is nonce-based replay protection implemented?

Each scenario returns a structured result: risk_level, affected_functions, detected, mitigation.

Usage — 3 lines

import { NexusClient } from "nexus-gateway-sdk";

const client = new NexusClient({ clientId: "my-app" });

const result = await client.dryRun({
  source_code: contractSource
});

// result.breach_simulation.overall_risk → "high" | "medium" | "low" | "critical"
// result.deployable → true | false
// result.breach_simulation.scenarios → array of 7 scenario objects
// result.digital_twin_v3_matrix → clause-to-code mapping
// result.urgency_signal → time-decay warning for M2M orchestrators

Agent Framework Integration

The SDK ships with native tool wrappers for AI agent frameworks:

// LangChain.js
import { createNexusTools } from "nexus-gateway-sdk";
const tools = createNexusTools({ clientId: "my-agent" });
// → Returns Tool[] compatible with LangChain.js agent executor

// Vercel AI SDK
import { createNexusVercelTools } from "nexus-gateway-sdk";
const tools = createNexusVercelTools({ clientId: "my-agent" });
// → Returns tools compatible with Vercel AI SDK generateText

This means any LangChain.js or Vercel AI agent can autonomously audit Solidity contracts as part of its toolset — no custom integration needed.

Digital Twin v3.1 Matrix

Beyond the 7 breach scenarios, the audit produces a Digital Twin matrix — a clause-to-code mapping that links contract functions to their breach conditions:

// Each function in the contract gets mapped:
{
  function_signature: "withdraw()",
  visibility: "external",
  modifiers: [],
  breach_conditions: ["BS-006: reentrancy via external call before state update"]
}

This is designed for M2M orchestration — agents can programmatically assess which functions are safe to call and which require additional guards.

Production Verification

The gateway passed 17/17 self-validation checks:

✅ All 7 gateway endpoints live
✅ ERC-8004 on-chain identity (Agent #636, Polygon Mainnet)
✅ EIP-712 USDC pull payment contract deployed
✅ npm + PyPI packages live
✅ OpenAPI 3.0.3 spec with M2M x-extensions
✅ A2A discovery manifest (.well-known/agent.json)
✅ Treasury wallet funded
✅ USDC contract verified

Try It Now — No Install

Interactive playground: https://rakhmadaa-gif.github.io/nexus-core-gateway/

Paste any Solidity code → click "Run Security Audit" → instant results with 7 breach scenarios, risk badges, and recommendations.

Or via curl:

curl -X POST https://xibzsthfrbomefnvbicb.supabase.co/functions/v1/hello-world/gateway/dry-run \
  -H 'Content-Type: application/json' \
  -d '{"source_code": "pragma solidity ^0.8.20; contract Token { }"}'

SDK Stats

npm: nexus-gateway-sdk@1.0.0 — 136 downloads
PyPI: nexus-gateway-sdk@1.0.0 — 498 downloads
License: MIT
Latency: ~2ms per audit
SLA: <500ms

Links

This is part of the Nexus Gateway — an autonomous M2M legal-code gateway for Web3 compliance. ERC-8004 Agent #636 on Polygon Mainnet. The free tier (dry-run audit) is intentionally open for community use.

TypeScript SDK now available — run free Solidity security audits from Node.js

rakhmad aulad alie — Fri, 04 Sep 2026 09:21:27 +0000

Following up on the Nexus Gateway launch, the TypeScript SDK is now live on npm.

Install

npm install nexus-gateway-sdk

Free Solidity Security Audit — 3 Lines

import { NexusClient } from "nexus-gateway-sdk";

const client = new NexusClient({ clientId: "my-app" });

const result = await client.dryRun({
  source_code: "pragma solidity ^0.8.20; contract Token { }"
});

The audit returns:

7 breach scenarios — Unauthorized Minting, Transfer Violation, Fund Drain, Emergency Freeze, Ownership Renounce, Reentrancy Attack, Replay Attack
Risk levels per scenario (low / medium / high / critical)
Overall risk assessment with deployable check
Digital Twin v3.1 matrix — clause-to-code mapping with breach conditions
Nonce & replay defense check
Recommendations for fixing issues

Latency: ~2ms. SLA: <500ms. No signup or API key needed for the free dry-run.

LangChain.js + Vercel AI SDK Integration

The SDK ships with native tool wrappers for AI agent frameworks:

import { createNexusTools, createNexusVercelTools } from "nexus-gateway-sdk";

// LangChain.js tools
const langchainTools = createNexusTools({ clientId: "my-agent" });

// Vercel AI SDK tools
const vercelTools = createNexusVercelTools({ clientId: "my-agent" });

Each wrapper returns tool objects compatible with their respective frameworks — just pass them to your agent and it can call the Nexus Gateway services directly.

Try It Without Installing

Visit the interactive playground — paste Solidity code in your browser, click "Run Security Audit", and get instant results with visual risk badges:

👉 https://rakhmadaa-gif.github.io/nexus-core-gateway/

Three example contracts are pre-loaded: ERC-20 token, Vulnerable Vault, and Escrow — click to load and audit them instantly.

Production Verified: 17/17 Checks PASS

The gateway passed all 17 self-validation checks including:

✅ All 7 gateway endpoints live
✅ ERC-8004 on-chain identity (Agent #636, Polygon Mainnet)
✅ EIP-712 USDC pull payment contract deployed
✅ npm + PyPI packages live
✅ OpenAPI 3.0.3 spec with M2M x-extensions

SDK Stats

npm: 136 downloads
PyPI: 498 downloads (pip install nexus-gateway-sdk)
License: MIT

Paid Services

Beyond the free dry-run, the gateway offers:

Service	Cost	What you get
Structured Data	20 CRED ($0.20)	Verified JSON schemas for Web3/compliance
Code Modules	120 CRED ($1.20)	Audited Solidity smart contracts (ERC-20, ERC-721, Escrow)
Legal-Code Hybrid	29,900 CRED ($299)	Bilingual EN/ID legal contracts + Digital Twin v3.1 mapping

Payment via USDC pull payment (EIP-712) on Polygon PoS — 1 USDC = 100 CRED.

Building Nexus Gateway: M2M Legal-Code Engine with Polygon EIP-712 & Free Solidity Security Checker

rakhmad aulad alie — Wed, 02 Sep 2026 16:10:11 +0000

Nexus Gateway: Bridging Legal Contracts & Smart Contracts

Smart contract code and off-chain legal contracts are often disconnected. A legal document might state "only the project owner can mint tokens," but if the Solidity code misses an onlyOwner modifier, a breach occurs with zero programmatic enforcement.

Nexus Gateway solves this by using a Digital Twin v3.1 parser that maps legal clauses directly to Solidity function signatures, visibility, modifiers, and breach conditions.

Key Features

Free Solidity Security Checker (Dry-Run)
- Simulates 7 breach scenarios (BS-001 to BS-007) without registration or API keys.
- Evaluates deployability, risk levels (Low, Medium, Critical), and actionable recommendations.
Machine-to-Machine (M2M) API Billing
- Built on Polygon PoS using EIP-712 pull-payment permits.
- No manual subscription management; clients sign off-chain permits, and the gateway executes micro-transactions in USDC.
Legal-Code Mapping
- Generates bilingual (English/Indonesian) legal contracts side-by-side with compiled Solidity modules (ERC-20, ERC-721, Escrow).

Try the Security Checker Right Now

You can test the dry-run endpoint directly from your terminal using curl:

curl -X POST https://xibzsthfrbomefnvbicb.supabase.co/functions/v1/hello-world/gateway/dry-run \
  -H "Content-Type: application/json" \
  -d '{"source_code": "pragma solidity ^0.8.20; contract Token { function mint(address to, uint256 amount) public {} }"}'

Or use the interactive playground (no terminal needed): https://rakhmadaa-gif.github.io/nexus-core-gateway/

SDK

TypeScript: npm install nexus-gateway-sdk (136 downloads)
Python: pip install nexus-gateway-sdk (498 downloads)

Both SDKs ship with native tool wrappers for AI agent frameworks (LangChain, CrewAI, Vercel AI SDK).

Production Verified: 17/17 Checks PASS

✅ All 7 gateway endpoints live
✅ ERC-8004 on-chain identity (Agent #636, Polygon Mainnet)
✅ EIP-712 USDC pull payment contract deployed
✅ npm + PyPI packages live
✅ OpenAPI 3.0.3 spec with M2M x-extensions
✅ A2A discovery manifest (.well-known/agent.json)