{
  "markdown": "# Rugproof\n\n> Rugproof your code before someone else does.\n\n🌐 **Live site:** [omermaksutii.github.io/RugProof](https://omermaksutii.github.io/RugProof/)\n📦 **Latest:** v1.0.0 — 45 commands · 23 agents · 45 skills · 13 MCP servers · tested, offline-first, with rule packs, a benchmark, non-EVM coverage, and post-deploy monitoring\n\nA Claude Code plugin that turns your editor into a full-stack smart contract security auditor: vulnerability detection, working exploit PoCs, mainnet-fork simulation, invariant generation, gas profiling, soulbound on-chain audit certificates, and shareable audit cards — Solidity + Vyper across every major EVM chain.\n\n## Install\n\n### From this GitHub source (works today)\n\n```bash\n# In Claude Code:\n/plugin marketplace add omermaksutii/RugProof\n/plugin install rugproof@omermaksutii-RugProof\n/rugproof-init                              # 60-second setup\n/audit examples/VulnerableVault.sol         # try it on the bundled vulnerable demo\n```\n\n### From the official Anthropic marketplace\n\nPending review. Once listed at [claude.com/plugins](https://claude.com/plugins):\n\n```bash\n/plugin install rugproof\n```\n\nSubmit your own plugin at [claude.ai/settings/plugins/submit](https://claude.ai/settings/plugins/submit) or [platform.claude.com/plugins/submit](https://platform.claude.com/plugins/submit).\n\n### Local dev\n\n```bash\ngit clone https://github.com/omermaksutii/RugProof\ncd RugProof\nmake build       # MCP servers + scripts\nmake test        # forge tests + NFT tests + MCP smoke test\nmake audit-demo  # runs the bundled reentrancy exploit (passes)\n```\n\n## Quickstart\n\n```bash\n# In any Solidity project:\n/audit                          # full audit on the repo\n/audit src/Vault.sol            # audit one file\n/quick-scan                     # fast pre-commit-style scan\n/audit-live 0xabc... --chain ethereum  # audit a deployed contract by fork\n/exploit <finding-id>           # write a working Foundry PoC\n/report                         # render Markdown / HTML / PDF / PNG card\n```\n\n## What's in the box\n\n### 45 slash commands\n\n**Audit:** `/audit` `/audit-deep` `/audit-strict` `/audit-changes` `/audit-live` `/audit-history` `/audit-deps` `/audit-multi-chain` `/quick-scan` `/rug-check` `/score` `/explain`\n**Output:** `/report` `/card` `/remediate`\n**Exploit:** `/exploit` `/exploit-chain` `/exploit-live`\n**Simulation:** `/simulate` `/replay-incident`\n**Tests / proofs:** `/test-gen` `/invariant` `/fuzz` `/coverage` `/symbolic` `/prover`\n**Analysis:** `/gas` `/upgrade-safety` `/verify-deploy` `/diff-audit` `/audit-diff` `/pre-deploy` `/monitor`\n**Tooling integration:** `/slither` `/mythril`\n**Workflow:** `/rugproof-init` `/dismiss` `/verify-finding` `/bounty` `/bounty-submit` `/demo`\n**Notifications:** `/notify-slack` `/notify-discord` `/tweet`\n**On-chain:** `/mint-cert` (Berachain soulbound audit certificate)\n\n### 23 specialist subagents\n\n**Functional:** `attacker` · `defender` · `exploit-poc-writer` · `invariant-writer` · `gas-optimizer` · `remediation-suggester` · `report-writer` · `assembly-auditor`\n\n**Protocol-specific:** `amm-specialist` · `lending-specialist` · `staking-specialist` · `bridge-specialist` · `governance-specialist` · `yield-aggregator-specialist` · `nft-specialist`\n\n**Hot-topic specialists (2025):** `aa-specialist` (ERC-4337) · `crosschain-messaging-specialist` (LayerZero V2 / CCIP / Hyperlane / Wormhole / Axelar) · `restaking-specialist` (EigenLayer / Symbiotic / Karak) · `intents-specialist` (ERC-7683 / UniswapX / CoW)\n\n**Language / chain / economics:** `vyper-specialist` (Vyper compiler-class bugs) · `l2-sequencer-specialist` (rollup finality, sequencer uptime, L1↔L2) · `economic-rug-specialist` (owner powers + 0–100 rugability score) · `zk-verifier-specialist` (proof-verifier correctness)\n\n### 45 auto-invoked vulnerability skills\n\nA detection-skill library that auto-activates when Claude sees matching code patterns. Covers the full CWE/SWC catalog plus modern DeFi-specific issues:\n\n**Classic (19):** reentrancy (incl. read-only and cross-contract) · access control · oracle manipulation · flash-loan attacks · MEV/front-running · signature replay · storage layout · initialization · unchecked calls · DoS vectors · integer issues · delegatecall risks · tx-context misuse · token compatibility · approval issues · EIP-6780 self-destruct · inline assembly · pragma & address hygiene · centralization risk.\n\n**Hot-topic 2025 (8):** ERC-4337 account abstraction · cross-chain messaging · Permit2 / EIP-2612 · ERC-1271 contract signatures · Diamond / EIP-2535 · restaking & EigenLayer AVS · ERC-7683 intents · ERC-4626 inflation/donation.\n\n**v0.2 additions (8):** ve-lock governance · fee-on-transfer accounting · signature malleability · MEV / PBS · liquidation cascades · oracle redundancy failure · cross-contract state inconsistency · ZK verifier bugs.\n\n**AI-quality meta-skills (4):** confidence scoring · multi-pass self-critique (`/audit-strict`) · known-good reference comparison · false-positive feedback loop (`/dismiss` + `.rugproof.yml ignore:` + inline `// rugproof-ignore` markers).\n\n**DX meta-skills (2):** caching-and-incremental (skip unchanged files) · progress-and-streaming (live status during long audits).\n\n### 13 MCP servers\n\nChain I/O, test runners, history databases, static-analyzer + fuzz runners — `block-explorer` (Etherscan v2 multichain, EIP-1967/1822 proxy resolution) · `forge-runner` · `hardhat-runner` · `anvil` · `tenderly` · `c4-history` · `sherlock-history` · `gas-tracker` · `token-metadata` (+ GoPlus safety) · `slither-runner` · `mythril-runner` · `fuzz-runner` (Echidna/Medusa/Halmos). Every server degrades gracefully to labeled mock data offline, so the plugin works with zero configuration.\n\n### 4 hooks\n\nPre-commit quick-scan · pre-push full audit · pre-deploy build-artifact check · post-test coverage analyzer. (Pre-commit and pre-push live as git hook scripts; pre-deploy and post-test wire into Claude Code's Bash hook events via `plugin.json`.)\n\n### 5 bundled vulnerable demo contracts\n\n`examples/` ships a \"wow on first install\" set: classic reentrancy vault, spot-oracle lending market, flash-loan governance, ERC-4626 inflation attack, replay-able bridge. Run `/demo` after install to see Rugproof in action without bringing your own code.\n\n## Configuration\n\nCreate a `.rugproof.yml` at the repo root. See `.rugproof.yml.example`.\n\n```yaml\nseverity_threshold: high       # block CI on this severity or worse\nchains: [ethereum, berachain, arbitrum, base]\ninclude: [\"src/**/*.sol\"]\nexclude: [\"test/**\", \"script/**\"]\nignore:\n  - id: REENT-001\n    reason: \"Single-trusted-caller, reviewed 2025-Q4\"\n```\n\nInline suppression in code:\n\n```solidity\n// rugproof-ignore: REENT-001 — single trusted caller, reviewed 2025-Q4\nfunction trustedOp() external onlyOwner { ... }\n```\n\n## Supported\n\n**Chains:** Ethereum · Berachain · Arbitrum · Base · Optimism · Polygon · BSC · Linea · zkSync · Scroll\n\n**Languages:** Solidity (full) · Vyper (specialist + skill) · Stylus/Rust · CosmWasm · Solana-Anchor (dedicated skills for top vuln classes) · Yul / inline assembly (specialist)\n\n## Output formats\n\n`/report` produces Markdown, HTML, PDF, JSON, and a shareable PNG audit card. `/card` produces just the PNG — built for social sharing.\n\n## Live site\n\n📖 **Docs + sample reports + gallery:** [omermaksutii.github.io/RugProof](https://omermaksutii.github.io/RugProof/)\n\nThe site is built from the `docs/` folder via the GitHub Pages workflow at `.github/workflows/pages.yml` — every push to `main` that touches `docs/` redeploys.\n\n## Repository layout\n\n```\nRugProof/\n├── .claude-plugin/plugin.json        # marketplace manifest + MCP/hook wiring\n├── .github/                          # workflows (pages, pr-audit, release) + action + templates\n├── commands/                         # 45 slash commands (real prompts)\n├── agents/                           # 23 subagents\n├── skills/                           # 45 auto-invoked detection skills\n├── mcp/                              # 13 MCP servers (TypeScript)\n├── scripts/                          # render-card · render-report · md-to-html · telemetry · …\n├── hooks/                            # 4 hooks\n├── templates/                        # report.md.hbs · report.html.hbs · audit-card.svg.hbs\n├── examples/                         # 5 vulnerable demo contracts\n├── nft/                              # AuditCertificate.sol (soulbound) + tests\n├── samples/                          # rendered sample reports + cards\n├── docs/                             # GitHub Pages site (auto-deployed)\n├── rules/                            # community rule pack template\n├── test/                             # Foundry exploit tests\n├── lib/                              # forge-std, openzeppelin-contracts (gitmodules)\n├── foundry.toml · remappings.txt\n├── Makefile · LICENSE · SECURITY.md · CONTRIBUTING.md · CODE_OF_CONDUCT.md · CHANGELOG.md\n├── .rugproof.yml.example · .rugproofignore.example\n└── README.md\n```\n\n## Build\n\nOne-liner via Makefile:\n\n```bash\nmake build       # builds all 13 MCP servers + scripts\nmake test        # forge tests + NFT tests + MCP smoke test\nmake audit-demo  # runs the bundled reentrancy exploit PoC (passes)\nmake sample-cards   # rerender PNG audit cards from samples/\nmake sample-html    # rerender HTML pages from samples/\n```\n\nOr manually:\n\n```bash\ncd mcp && npm install && npm run build\ncd ../scripts && npm install && npm run build\nforge install                   # if you want to refresh git submodules\nforge test -vv                  # exploit PoC against VulnerableVault passes\nnode scripts/dist/test-mcp.js   # MCP smoke test (13/13 servers should pass)\n```\n\nThe plugin.json points to `mcp/<name>-mcp/dist/index.js` for each server. Most return mock data when API keys / external tools are absent so the plugin works out-of-the-box even without a fully configured environment.\n\n## Roadmap\n\nv0.1 shipped the full skeleton; the **0.2 → 1.0 arc** hardened it into a tested,\nreal-integration, launch-ready tool.\n\n| Version | Scope | Status |\n|------:|:------|:------|\n| 0.1.0 | Full skeleton: every command · agent · skill · MCP · hook · template · demo · NFT cert · Action · Pages site | ✅ |\n| 0.2.0 | Bug-fixes + real test suites + CI gates + Etherscan v2 / GoPlus / Slither / Mythril MCPs + 4 specialists / 8 skills / 5 commands + source-generated docs | ✅ |\n| 0.3.0 | EIP-1967/1822 proxy resolver · live-analyzer CI · dependency maintenance | ✅ |\n| 0.4.0 | Rule-pack validator + 2 real packs · accuracy benchmark harness | ✅ |\n| 0.5.0 | `fuzz-runner` MCP (Echidna/Medusa/Halmos) · non-EVM skills (Stylus/CosmWasm/Solana) | ✅ |\n| 0.6.0 | Monitoring MCP + `/monitor` · Immunefi bounty formatter | ✅ |\n| 0.7.0 | On-chain certificate deploy-readiness (Berachain runbook + targets) | ✅ |\n| 0.8.0 | Source-driven public audit gallery | ✅ |\n| 0.9.0 | Incremental cache · MCP-boundary input safety · `_shared` tests | ✅ |\n| **1.0.0** | **Launch: frozen findings schema + semver commitment + owner-gated handoff (`LAUNCH.md`)** | ✅ |\n\n**Shipping to users** is the only remaining work, and it's external (marketplace\nsubmission, mainnet cert deploy, API keys, hosting) — see [`LAUNCH.md`](LAUNCH.md).\n\n## License\n\nMIT\n",
  "bytes": 11218,
  "sha": "daddafd1d9678a1dc4108f97cc6dc23ee384e35c61c1119a71d8fee77a7af12b",
  "repo_slug": "omermaksutii/rugproof",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_omermaksutii_rugproof_rugproof_eeb315d6/readme"
}