{"id":"d0957156-7332-4698-9387-1cd58fe7111e","repo":"sendaifun/solana-agent-kit","status":"done","verdict":"no_red_flags","headline":"No red flags found. README claims backed by the code: 4 of 8.","error":null,"report":{"ai":{"kind":"framework","claims":[{"claim":"Open-source toolkit for connecting AI agents to Solana protocols","verdict":"supported","evidence":"Plugins in packages/plugin-* plus adapters in packages/core/src/{vercel-ai,langchain,openai,claude} and packages/adapter-mcp"},{"claim":"Any agent using any model can autonomously perform 60+ Solana actions","verdict":"supported","evidence":"Well over 60 actions are registered across plugins (packages/plugin-defi/src/index.ts:396-512, packages/plugin-misc/src/index.ts:306-382). 'Any model' depends on the adapter, with Vercel AI, LangChain, OpenAI, Claude and MCP provided."},{"claim":"Trade tokens, launch tokens, lend assets, send compressed airdrops, bridge across chains","verdict":"supported","evidence":"Jupiter trade, Pump.fun launch, Lulo lend, compressed airdrop in packages/plugin-token/src/index.ts and plugin-defi/src/index.ts. deBridge is in plugin-defi; Mayan swap is in plugin-token."},{"claim":"Bridge tokens across chains using Wormhole","verdict":"unsupported","evidence":"The README lists Wormhole, and docs exist, but no Wormhole tool or action is registered in the provided plugin indexes (plugin-token, plugin-defi). Only deBridge and Mayan appear."},{"claim":"Jito Bundles and Meteora Alpha Vault listed as DeFi features","verdict":"unsupported","evidence":"The Meteora tools registered are only DLMM and Dynamic AMM pool creation (packages/plugin-defi/src/index.ts:70-73). No Jito or Alpha Vault tool appears in the plugin registries."},{"claim":"Autonomous modes with configurable action intervals and built-in error handling/recovery","verdict":"unsupported","evidence":"The core package has no agent loop or scheduler. executeAction only returns an error object (packages/core/src/utils/actionExecutor.ts). Any autonomy would live in the example apps, not the library."},{"claim":"DALL-E integration for NFT artwork generation","verdict":"unsupported","evidence":"No image generation tool appears in the provided plugin registries. Only an OPENAI_API_KEY config field exists (packages/core/src/types/index.ts:14)."},{"claim":"Security: handles transaction generation, signing and sending using provided wallets","verdict":"supported","evidence":"KeypairWallet and signOrSendTX do local signing and sending (packages/core/src/utils/keypairWallet.ts, packages/core/src/types/wallet.ts). There is no spending limit or confirmation guard; the LLM-driven tools can move funds."}],"costUsd":0.307324,"summary":"Solana Agent Kit is a TypeScript monorepo SDK that wraps many Solana and DeFi protocol integrations (Jupiter, Drift, Orca, Raydium, Metaplex, Lulo, deBridge, OKX, and others) as plugins. Each plugin exposes methods and zod-schema 'Actions'. Adapters convert those Actions into tools for Vercel AI, LangChain, OpenAI Agents, Claude Agent SDK, and MCP servers. The library holds a wallet and signs and sends transactions when an external LLM calls the tools. It does not contain its own LLM loop.","capabilities":[{"evidence":"packages/core/src/agent/index.ts:75-98","capability":"Plugin system: SolanaAgentKit.use() registers plugin methods and actions, rejecting duplicate method names"},{"evidence":"packages/core/src/vercel-ai/index.ts:6-45, packages/core/src/langchain/index.ts:6-48, packages/core/src/openai/index.ts:7-36, packages/core/src/claude/index.ts:42-115","capability":"Converts Actions into tools for Vercel AI, LangChain, OpenAI Agents and Claude Agent SDK (capped at 127 tools)"},{"evidence":"packages/adapter-mcp/src/index.ts:55-190","capability":"Exposes actions as an MCP server over stdio"},{"evidence":"packages/core/src/utils/keypairWallet.ts:29-110, packages/core/src/utils/owsWallet.ts:24-50","capability":"Holds a local private-key wallet that signs and sends transactions (KeypairWallet), plus an OWS vault-backed wallet that exports the key into memory"},{"evidence":"packages/core/src/types/wallet.ts:104-199","capability":"Sign-only mode or sign-and-send via the wallet, with compute-budget and priority-fee handling"},{"evidence":"packages/plugin-defi/src/index.ts:258-512","capability":"DeFi plugin: perps (Adrena, Flash, Drift, Lavarage, Ranger), lending (Lulo), pool creation (Raydium, Orca, Meteora, Openbook), bridging (deBridge), OKX DEX swaps, Sanctum LST"},{"evidence":"packages/plugin-token/src/index.ts:85-149","capability":"Token plugin: Jupiter swaps and limit orders, transfers, balances, SOL staking, compressed airdrops, Pump.fun launches, Mayan swaps, rugcheck, Pyth prices"},{"evidence":"packages/plugin-nft/src/index.ts:60-116","capability":"NFT plugin: Metaplex deploy/mint, Tensor listing, 3Land collectibles, Magic Eden operations"},{"evidence":"packages/plugin-misc/src/index.ts:216-382","capability":"Misc plugin: data and utility integrations (CoinGecko, Helius, Alchemy, Elfa AI, Messari, SNS/AllDomains), Squads multisig, Gibwork, Crossmint checkout, OtterSec verification"},{"evidence":"packages/core/src/utils/actionExecutor.ts:7-40","capability":"Input validation of LLM-supplied tool parameters with zod before running the handler"},{"evidence":"packages/plugin-defi/src/ranger/index.ts:14-21","capability":"Ranger module defaults to hardcoded staging API endpoints (overridable via env vars)"}],"findingReviews":[{"id":"obf.base64_blob","path":"packages/plugin-defi/src/okx/actions/getSwapData.ts","reason":"The long base58 string is the `tx.data` field in an example output object in the action's `examples` array. It is documentation sample data passed to the LLM and is never decoded or executed.","assessment":"benign"},{"id":"obf.base64_blob","path":"packages/plugin-misc/src/ottersec/actions/decodeVerificationPdaData.ts","reason":"The hex string is the sample `input.hex` in the action's examples, showing an OtterSec verification PDA payload that the tool decodes. It is example data, not hidden code.","assessment":"benign"}]},"url":"https://github.com/sendaifun/solana-agent-kit","stats":{"files":1671,"binaries":71,"textFiles":1596,"truncated":false},"verdict":"no_red_flags","findings":[{"id":"obf.base64_blob","title":"Large encoded blob in source code","detail":"A long base64 string inside code can hide a payload. It may also be an embedded image or certificate.","evidence":[{"line":94,"path":"packages/plugin-defi/src/okx/actions/getSwapData.ts","excerpt":"data: \"3UfFcAn6toX6QG3XuYGFA24PKaK4o62QKQQTD4fBR1U7nKPurhPBnLWXZsAymchhkAM9kHJKM3moahBMR9sJUmGHdL59gxq6PXidgJ5e7FUuePqzCRyutowo5qXSGARUpuJ46eMcXG2SgFo3pHx1bi3WH…"},{"line":18,"path":"packages/plugin-misc/src/ottersec/actions/decodeVerificationPdaData.ts","excerpt":"hex: \"ce65c2888771730ca28e257dae8c81dc8ce27c9cc2451fb1837c52039847481f5b65cc6f152573c3efae07731701872e5391cb1a51627c845f1e12e9754d110f87751ac868003b5f0500000030…"}],"severity":"warn"},{"id":"keys.handles_private_keys","title":"Handles wallet private keys or seed phrases","detail":"Expected for agents that sign transactions. The keys should stay on your machine and only be used to sign.","evidence":[{"line":89,"path":"packages/core/src/utils/keypairWallet.ts","excerpt":"const signature = nacl.sign.detached(message, this.payer.secretKey);"},{"line":32,"path":"packages/core/src/utils/owsWallet.ts","excerpt":"let secretKey: Uint8Array;"},{"line":33,"path":"packages/plugin-defi/src/lavarage/tools/lavarage.ts","excerpt":"const txBuffer = Buffer.from(bs58.decode(txBase58));"},{"line":26,"path":"packages/plugin-defi/src/okx/tools/execute_swap.ts","excerpt":"secretKey: agent.config.OKX_SECRET_KEY ?? \"\","},{"line":15,"path":"packages/plugin-defi/src/okx/tools/get_chain_data.ts","excerpt":"secretKey: agent.config.OKX_SECRET_KEY ?? \"\","},{"line":15,"path":"packages/plugin-defi/src/okx/tools/get_liquidity.ts","excerpt":"secretKey: agent.config.OKX_SECRET_KEY ?? \"\","}],"severity":"info"}],"headline":"No red flags found. README claims backed by the code: 4 of 8.","provenance":[],"generatedAt":"2026-10-14T12:26:44.559Z"}}