weasel

<h1 align="center">Weasel</h1>

<p align="center"> <strong>Solidity static analyzer you can talk to</strong> </p>

<p align="center"> Ask your AI assistant to audit your contracts. Get explained results. </p>

<p align="center"> <a href="https://opensource.org/licenses/MIT"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License: MIT"></a> <a href="#installation"><img src="https://img.shields.io/badge/install-weaselup-green.svg" alt="Install"></a> <img src="https://img.shields.io/badge/⚡-Blazing_Fast-orange" alt="Blazing Fast"> </p>

<p align="center"> <img src="assets/demo.gif" alt="Weasel demo" width="800"> </p>

# 1. Install weasel
curl -L https://raw.githubusercontent.com/slvDev/weasel/main/weaselup/install | bash

# 2. Add to your AI tool:
# Claude Code (recommended - MCP + skills)
/plugin marketplace add slvDev/weasel
/plugin install weasel

# MCP only for Claude Code, Cursor, Windsurf, Codex, Gemini
weasel mcp add

Now just say weasel <command>:

"weasel analyze my contracts"

"weasel poc for this reentrancy bug"

"weasel report this finding"

"weasel explain this function"

Weasel skills activate. Your AI runs analysis, writes PoCs, formats reports, and more.

Features

• •AI-Native Skills — 9 specialized skills for Claude Code (PoC writing, report formatting, gas optimization, and more)
• •Blazing Fast — Parallel Rust analysis, instant MCP responses
• •MCP Server — Works with Claude Code, Cursor, Windsurf, OpenAI Codex, Gemini CLI, and any MCP-compatible tool
• •Extensive Detectors — Vulnerabilities, gas optimizations, and code quality checks
• •Auto-Detection — Automatically configures for Foundry, Hardhat, and Truffle projects

Why Weasel?

Installation

curl -L https://raw.githubusercontent.com/slvDev/weasel/main/weaselup/install | bash

Update anytime with weaselup. Use weaselup --nightly for latest dev build.

<details> <summary>From Source</summary>

git clone https://github.com/slvDev/weasel.git
cd weasel && cargo build --release

</details>

Claude Code Integration

For Claude Code users, install the Weasel plugin for intelligent skills:

/plugin marketplace add slvDev/weasel
/plugin install weasel

Use weasel prefix to activate skills:

Audit:

Dev:

Skills provide context-aware expertise — Claude knows how to analyze Solidity, write PoCs in Foundry/Hardhat, format audit reports, and more. The weasel prefix ensures skills only activate when you want them.

To update the plugin, run /plugin update weasel in Claude Code.

IDE Integration (MCP)

For Cursor, Windsurf, Codex, Gemini, or Claude Code without skills:

weasel mcp add                      # auto-detect all installed IDEs
weasel mcp add --target cursor      # Cursor only
weasel mcp add --target windsurf    # Windsurf only
weasel mcp add --target claude      # Claude Code only
weasel mcp add --target codex       # OpenAI Codex only
weasel mcp add --target gemini      # Gemini CLI only

MCP tools (weasel_analyze, weasel_finding_details, weasel_detectors) work in all IDEs. Skills (PoC writing, report formatting, etc.) are Claude Code exclusive.

What It Detects

Run weasel detectors to see all checks, or ask your AI: _"what can weasel detect?"_

How It Works

<p align="center"> <img src="assets/flow.png" alt="Weasel flow" width="800"> </p>

<p align="center"> Your AI calls Weasel via MCP, gets structured findings, and explains them to you. </p>

Standalone Usage

No AI? Weasel works great from the terminal.

weasel run                              # analyze ./src
weasel run -s ./contracts               # specify path
weasel run -e ./test -e ./mocks         # exclude paths
weasel run -m High                      # only critical
weasel run -o report.md                 # save report
weasel run -o report -f json            # JSON format
weasel run -o report -f sarif           # SARIF format (for GitHub Code Scanning)

Detectors

weasel detectors                # list all
weasel detectors -s High        # filter by severity
weasel detectors -d <id>        # details for one

Configuration

Create weasel.toml with weasel init:

scope = ["src", "contracts"]
exclude = ["test", "script"]
min_severity = "Low"
format = "md"
remappings = ["@openzeppelin/=lib/openzeppelin-contracts/"]
exclude_detectors = ["floating-pragma", "line-length"]

[protocol]
uses_fot_tokens = true       # Fee-on-transfer token detectors
uses_weird_erc20 = true      # Non-standard ERC20 detectors
uses_native_token = true     # Native ETH handling detectors
uses_l2 = true               # L2-specific detectors (Arbitrum, Optimism)
uses_nft = true              # NFT-related detectors

Priority: CLI flags > config file > auto-detection

GitHub Actions

Run Weasel in your CI/CD pipeline:

- uses: slvDev/weasel@main

Example Workflow

name: Security

on: [push, pull_request]

jobs:
  weasel:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: slvDev/weasel@main
        with:
          path: ./src
          fail-on: High
          exclude: test,mocks

Nightly Builds

Use the latest development version:

- uses: slvDev/weasel@main
  with:
    version: nightly

GitHub Code Scanning

Enable inline findings in PR diffs and the Security tab:

- uses: slvDev/weasel@main
  with:
    sarif: true
    upload-sarif: true

Requires security-events: write permission.

AI-Powered Review (Experimental)

Combine Weasel with Claude, OpenAI, or Gemini for intelligent security review:

- uses: anthropics/claude-code-action@v1
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
    claude_args: |
      --mcp-config '{"mcpServers":{"weasel":{"command":"weasel","args":["mcp","serve"]}}}'

AI can analyze findings, filter false positives, and suggest fixes.

Ready-to-use examples in `gh-actions-examples/`:

Verify Downloads

Release binaries include SHA256 checksums and build attestation:

# Verify checksum
sha256sum -c checksums.txt

# Verify attestation (requires gh CLI)
gh attestation verify weasel-<target>.tar.gz --owner slvDev
# Example: gh attestation verify weasel-aarch64-apple-darwin.tar.gz --owner slvDev

Inputs

Outputs

Project Support

Foundry — Remappings loaded in order:

1. Default paths (forge-std/, @openzeppelin/)
2. remappings.txt
3. foundry.toml
4. CLI -r flags

Hardhat / Truffle — Auto-detects config, uses node_modules/, defaults to ./contracts

FAQ

<details> <summary><strong>AI can't find Weasel?</strong></summary>

which weasel          # should show path
weasel mcp add        # re-run setup
# restart your AI tool

</details>

<details> <summary><strong>How do I check MCP config?</strong></summary>

cat ~/.claude.json              # Claude Code
cat ~/.cursor/mcp.json          # Cursor
cat ~/.codeium/windsurf/mcp_config.json  # Windsurf

</details>

<details> <summary><strong>Manual MCP setup</strong></summary>

Add to your AI tool's config:

{
  "mcpServers": {
    "weasel": {
      "type": "stdio",
      "command": "/path/to/weasel",
      "args": ["mcp", "serve"]
    }
  }
}

</details>

<details> <summary><strong>How do I exclude test files?</strong></summary>

weasel run -e ./test -e ./src/mocks

</details>

<details> <summary><strong>How do I analyze only critical issues?</strong></summary>

weasel run -m High

</details>

License

MIT — LICENSE.md