DEV Community

rakhmad aulad alie
rakhmad aulad alie

Posted on

TypeScript SDK for autonomous Solidity security auditing — 7 breach scenarios, LangChain.js + Vercel AI SDK integration

#typescript #solidity #web3 #security

ERC-8004 Agent #636

I've been working on an autonomous security auditing gateway for Solidity smart contracts. The TypeScript SDK just went live on npm — it runs 7 automated breach simulations against any Solidity source code in ~2ms, with no signup or API key required for the free tier.

What problem does this solve?

Most Solidity security tools are either:

  • Paid SaaS (Slither Pro, MythX) — requires account, subscription, API key
  • CLI-only (Slither, Mythril) — requires local installation, Python/Foundry setup
  • Manual — human auditors, weeks of lead time

This SDK gives you a programmatic, agent-native audit that runs 7 breach scenarios via a single function call. No local toolchain. No signup. No API key for the free tier.

Install 

npm install nexus-gateway-sdk
Enter fullscreen mode Exit fullscreen mode

The 7 Breach Scenarios

ID Scenario Question
BS-001 Unauthorized Minting Can tokens be minted without authorization?
BS-002 Transfer Violation Can transfers bypass balance/allowance checks?
BS-003 Fund Drain Can funds be withdrawn without authorization?
BS-004 Emergency Freeze Is there an emergency stop / pause mechanism?
BS-005 Ownership Renounce Can ownership renunciation lock admin functions?
BS-006 Reentrancy Attack Are external calls protected against reentrancy?
BS-007 Replay Attack Is nonce-based replay protection implemented?

Each scenario returns a structured result: risk_level, affected_functions, detected, mitigation.

Usage — 3 lines 

import { NexusClient } from "nexus-gateway-sdk";

const client = new NexusClient({ clientId: "my-app" });

const result = await client.dryRun({
  source_code: contractSource
});

// result.breach_simulation.overall_risk → "high" | "medium" | "low" | "critical"
// result.deployable → true | false
// result.breach_simulation.scenarios → array of 7 scenario objects
// result.digital_twin_v3_matrix → clause-to-code mapping
// result.urgency_signal → time-decay warning for M2M orchestrators
Enter fullscreen mode Exit fullscreen mode

Agent Framework Integration

The SDK ships with native tool wrappers for AI agent frameworks:

// LangChain.js
import { createNexusTools } from "nexus-gateway-sdk";
const tools = createNexusTools({ clientId: "my-agent" });
// → Returns Tool[] compatible with LangChain.js agent executor

// Vercel AI SDK
import { createNexusVercelTools } from "nexus-gateway-sdk";
const tools = createNexusVercelTools({ clientId: "my-agent" });
// → Returns tools compatible with Vercel AI SDK generateText
Enter fullscreen mode Exit fullscreen mode

This means any LangChain.js or Vercel AI agent can autonomously audit Solidity contracts as part of its toolset — no custom integration needed.

Digital Twin v3.1 Matrix

Beyond the 7 breach scenarios, the audit produces a Digital Twin matrix — a clause-to-code mapping that links contract functions to their breach conditions:

// Each function in the contract gets mapped:
{
  function_signature: "withdraw()",
  visibility: "external",
  modifiers: [],
  breach_conditions: ["BS-006: reentrancy via external call before state update"]
}
Enter fullscreen mode Exit fullscreen mode

This is designed for M2M orchestration — agents can programmatically assess which functions are safe to call and which require additional guards.

Production Verification

The gateway passed 17/17 self-validation checks:

  • ✅ All 7 gateway endpoints live
  • ✅ ERC-8004 on-chain identity (Agent #636, Polygon Mainnet)
  • ✅ EIP-712 USDC pull payment contract deployed
  • ✅ npm + PyPI packages live
  • ✅ OpenAPI 3.0.3 spec with M2M x-extensions
  • ✅ A2A discovery manifest (.well-known/agent.json)
  • ✅ Treasury wallet funded
  • ✅ USDC contract verified

Try It Now — No Install

Interactive playground: https://rakhmadaa-gif.github.io/nexus-core-gateway/

Paste any Solidity code → click "Run Security Audit" → instant results with 7 breach scenarios, risk badges, and recommendations.

Or via curl:

curl -X POST https://xibzsthfrbomefnvbicb.supabase.co/functions/v1/hello-world/gateway/dry-run \
  -H 'Content-Type: application/json' \
  -d '{"source_code": "pragma solidity ^0.8.20; contract Token { }"}'
Enter fullscreen mode Exit fullscreen mode

SDK Stats

  • npm: nexus-gateway-sdk@1.0.0 — 136 downloads
  • PyPI: nexus-gateway-sdk@1.0.0 — 498 downloads
  • License: MIT
  • Latency: ~2ms per audit
  • SLA: <500ms

Links

This is part of the Nexus Gateway — an autonomous M2M legal-code gateway for Web3 compliance. ERC-8004 Agent #636 on Polygon Mainnet. The free tier (dry-run audit) is intentionally open for community use.

Top comments (0)