Documentation
Every command, flag, and output of soliint.
Installation
curl one-liner (recommended)
curl -fsSL https://soliint.vercel.app/install.sh | bashChecks for Node.js, installs soliint globally, verifies the binary, shows a success message with a quick-start guide, then the first soliint run opens the AI-agent picker automatically.
npm
npm install -g soliint-cliDirect npm install. Package name is soliint-cli; the command it registers is soliint.
Auditing
audit
soliint audit [path]Recursively scan a .sol file or folder with all 19 rules. Produces HTML report, PDF, report.json and report.sarif (GitHub code scanning) in .soliint/audit/<timestamp>/.
Options / flags:
--json--fail-on <severity>--out <dir>--theme <dark|light>--quietnuke
soliint nuke [path]The full AI deep-audit pipeline: severity re-ranking, exploit PoC specs, hack correlation (The DAO, Parity, Wormhole, BonqDAO), 17-check professional checklist, iterative autofix with fix-verify loop, forge test gate, rollback backup, and a final report with score journey + attack-surface summary.
Options / flags:
--target <grade>--max-iters <n>--max-high <n>--no-fix--no-forge--out <dir>--theme <dark|light>fix
soliint fix [path]Autofix deterministic findings (floating pragma, tx.origin, assert/require) with a backup first, then re-audit to verify the fix actually improved the score.
Options / flags:
--dry-runwatch
soliint watch [path]Re-audit on file save. Shows live before/after score diffs as you edit - dev loop feedback.
AI & Intelligence
nuke (AI deep audit)
soliint nuke . --target AIterative AI loop: re-rank findings, generate exploit PoC specs, correlate with real hacks, run a professional 17-check audit checklist, then autofix + re-verify until the target grade is reached (capped by --max-iters).
Options / flags:
--no-fix (intel only)--max-iters 3--target A--max-high 0install
soliint installInteractive wizard that wires soliint-mcp into your AI agents. Pick from Claude Code, Cursor, Windsurf, Hermes, OpenClaw, Codex, OpenCode and Pi - it writes the MCP config for each. First run of soliint opens this automatically.
Options / flags:
--agents <ids>--all--dry-run--hermes-dir <path>V2 Analyzers
v2 gas
soliint v2 gas [path]Gas optimization hints for each function - storage vs memory, loops, SLOADs, etc.
v2 storage
soliint v2 storage [path]Storage layout visualizer with slot estimation and packing suggestions.
v2 deps
soliint v2 deps [path]Dependency and import vulnerability lookup.
v2 freshness
soliint v2 freshness [path]EIP / pattern freshness checker - flags deprecated or outdated patterns.
v2 history
soliint v2 history [path]Audit history trends from .soliint/history.json.
v2 coverage
soliint v2 coverage [path] --lcov <file>Cross-reference findings with forge coverage (lcov) to focus on uncovered lines.
Utility
init
soliint initCreate a .soliint config file with severity thresholds and ignored files.
rules
soliint rulesList all 19 vulnerability rules with severity and description.
explain
soliint explain <rule-id>Deep-dive into a single rule: severity, description, vulnerable patterns and fix guidance.
Options / flags:
reentrancytx-originfloating-pragmaselfdestruct...badge
soliint badgeGenerate a README score badge (badge.svg + markdown) from the latest audit.
pr-comment
soliint pr-commentPost a findings summary comment on a GitHub PR (CI usage).
rollback
soliint rollbackRestore files from the last fix/nuke backup if something broke.
Exit codes & CI
CI usage
--fail-on high makes the audit exit 1 when any high-or-above finding exists - perfect for pre-merge gates. GitHub Action publishes SARIF for code scanning and posts a PR comment.