AuditPilot

A Codex-native smart contract audit toolkit for Solidity and Solana, with a web app and MCP tools for agent-driven security analysis.

Comment

Inspiration

Smart contract teams need fast security feedback before a formal audit, but existing tools are often chain-specific, expensive, or too shallow for real codebase review. AuditPilot was built to make Codex useful as a security assistant for Solidity and Solana/Anchor developers.

What It Does

AuditPilot has two surfaces:

  1. A web app where developers sign in with GitHub, save their own OpenAI API key securely, run audits, and return later to see audit history.
  2. An MCP server that lets Codex, IDE agents, or ChatGPT use AuditPilot as a deterministic security toolkit.

The MCP server exposes three tools:

  • clone_and_parse_contract: parses Solidity or Solana repos into contract units.
  • get_vulnerability_checklist: returns chain-specific audit checks.
  • search_solodit_findings: searches Solodit/Cyfrin historical findings for precedent.

The important design choice is that MCP reasoning happens inside the developer’s own Codex session. AuditPilot MCP does not spend our OpenAI key.

How We Used Codex and GPT-5.6

Codex was used heavily to build the project: scaffolding the Next.js app, refactoring the MCP server, wiring Supabase auth, debugging GitHub API issues, and validating the developer-tool flow.

GPT-5.6 is used in the web audit path when a signed-in user provides their own OpenAI API key. The MCP path is intentionally deterministic: it gives Codex structured repo data and vulnerability context, then Codex performs the reasoning with the user’s own account.

Challenges

The hardest part was designing the split between the hosted web app and the MCP server. The web app can use GPT-5.6 directly with BYOK, but the MCP server should never call our model key. We refactored the MCP server into deterministic tools only, so Codex performs the reasoning client-side.

We also had to handle GitHub rate limits, Supabase OAuth, encrypted API key storage, and persistent audit history.

Accomplishments

  • Built a working Next.js web app.
  • Added Supabase GitHub OAuth.
  • Added encrypted per-user OpenAI key storage.
  • Added persistent audit run history.
  • Built a working MCP server for Codex.
  • Verified MCP locally against foundry-rs/forge-std.
  • Added Solodit/Cyfrin historical finding lookup.

What’s Next

Next, AuditPilot can add deeper Solidity/Solana static analysis, automatic patch PRs, more chain adapters like Move and CosmWasm, and a remote MCP transport for hosted agent integrations.

Built With

Share this project:

Updates