Production-ready Claude Code configuration for full-stack Solana development. Combines best practices from multiple sources into an agent-optimized, token-efficient config you can install and adapt to your specific project.
Production-grade security audit for any codebase, powered by AI agents. 20 checklists · 1,346 verification items · 131 known attack vectors · executable PoCs + fix patches A full audit-firm lifecycle (automated + interactive) · Benchmarked against CertiK, SOC
@solanabrFAQ
solana-ai-kit is a Claude Code plugin with 3 hand-picked skills for development work, indexed on Flowy. Install it with the command on its page. It includes hackathon, idea-sprint, pitch-deck. Its skills do not fire on their own yet. Request auto-invocation to have Flowy route them as you prompt. Free and open source.
> /plugin marketplace add solanabr/solana-ai-kit> /plugin install solana-ai-kit@stbr
Repo: solanabr/solana-ai-kit
Production-ready Claude Code configuration for full-stack Solana development. Combines best practices from multiple sources into an agent-optimized, token-efficient config you can install and adapt to your specific project.
The idea here is to provide a generic CLAUDE.md that relies on subagents to plan and execute actions, dynamically loading markdown files, saving tokens and context in the end of the day. This config fully leverages the official Claude Code config recommendations:
Current multi-agent workflow favors monorepos, so we use a single CLAUDE.md/config for the whole project while leveraging agents and context-specific skills to solve each step of builder flow.
If you installed manually, remember to rename ./CLAUDE-solana.md back to ./CLAUDE.md, as the current top-level CLAUDE.md file is focused on maintaining the repo itself.
A complete .claude/ configuration that turns Claude into a Solana development expert with:
# Option 0: Fork Template (Github UI)
claude -m "/cleanup" # then start claude code running /cleanup so top-level directory of your project isn't polluted
# Option 1: One-liner installer (Claude Code)
curl -fsSL https://aikit.superteam.codes | bash
# Fallback (or before the aikit.superteam.codes DNS is live): curl -fsSL https://raw.githubusercontent.com/solanabr/solana-ai-kit/main/install.sh | bash
# Option 2: One-liner installer (Codex, Opencode, everything else)
curl -fsSL https://aikit.superteam.codes | bash -s -- --agents
# Fallback (or before the aikit.superteam.codes DNS is live): curl -fsSL https://raw.githubusercontent.com/solanabr/solana-ai-kit/main/install.sh | bash -s -- --agents
# Option 3: Manual setup
git clone --recurse-submodules https://github.com/solanabr/solana-ai-kit.git
cp -r solana-ai-kit/.claude /path/to/your-project/
cp solana-ai-kit/CLAUDE-solana.md /path/to/your-project/CLAUDE.md
cd /path/to/your-project && git submodule update --init --recursive
# Option 4: Claude Code plugin (run inside Claude Code)
/plugin marketplace add solanabr/solana-ai-kit
/plugin install solana-ai-kit@stbr
# Commands then namespace as /solana-ai-kit:<name>. The plugin is the CORE kit
# (agents/commands/local skills/MCP/hooks); the curl one-liner (Option 1) is the
# FULL install, adding rules + permissions/sandbox + the 18 ext/ submodules.
# Details: see "Install as a Claude Code plugin" below.
# Start Claude Code
claude
--agents FlagPass --agents to install everything into .agents/ instead of .claude/. Same content, different directory name. Useful when .claude/ is already taken or for non-Claude AI tools (Cursor, Windsurf, Copilot, etc.).
bash install.sh --agents /path/to/your-project
To update an --agents install:
# Run from your project root:
bash .agents/bin/update.sh
To keep your project clean, the installer adds .claude/, CLAUDE.md, .mcp.json, and .gitmodules to .gitignore — the kit reads as ignorable infrastructure, not your app code (the ext/ skill submodules are ignored too, re-fetched via git submodule update).
Want the config tracked in git (team setup, reproducible config)? Run /commit-claude-config — it un-ignores those files and commits them (or edit .gitignore by hand). If your project already commits .claude/ or its own .gitmodules, the new ignore lines are a no-op — git keeps tracking files it already tracks.
After installation, configure MCP servers for enhanced capabilities:
# In your project with Claude Code running:
/setup-mcp
This guides you through API key configuration for Helius, Context7, and other MCP servers.
solana-ai-kit is also its own Claude Code marketplace serving one core plugin. From inside Claude Code:
/plugin marketplace add solanabr/solana-ai-kit
/plugin install solana-ai-kit@stbr
The plugin ships the core kit: the 15 agents, 30 commands, the local go-to-market + registry skills (idea-sprint, pitch-deck, hackathon), the 7 MCP servers, and the dev hooks (banner, formatter, pre-deploy/commit gates). Commands and skills are namespaced — /deploy becomes /solana-ai-kit:deploy.
What the plugin cannot carry (Claude Code plugins are plain git clones — they can't init submodules or ship a permissions/sandbox policy), so these stay exclusive to the full install (install.sh):
.claude/rules/* code-style law (Rust, Anchor, Pinocchio, TypeScript, .NET)ext/ skill submodules (protocol, security, infra, ecosystem depth)For protocol-skill depth in plugin form, add the upstream marketplaces instead (routing, not copying) — e.g. /plugin marketplace add sendaifun/skills, ghostsecurity/skills, trailofbits/skills, cloudflare/skills. The plugin's skill hub and skill-registry.json list the current targets.
The two paths are complementary: individuals wanting Solana agents/commands across all their projects → plugin at user scope; project teams working in one repo → install.sh (full kit). If you enable both in the same project, /doctor warns about duplicate commands/hooks/MCP and advises picking one. Plugin auto-update is off by default for third-party marketplaces — refresh with /plugin marketplace update + claude plugin update.
| Submodule | Source | Purpose |
|---|---|---|
ext/solana-dev | solana-foundation/solana-dev-skill | Core Solana development (programs, frontend, testing, security) |
ext/sendai | sendaifun/skills | DeFi protocol integrations (Jupiter, Raydium, Kamino, perps, cross-chain, oracles, etc.) |
ext/solana-game | solanabr/solana-game-skill | Game development (Unity, PlaySolana, PSG1) |
ext/cloudflare | cloudflare/skills | Infrastructure (Workers, Agents SDK, MCP servers) |
ext/trailofbits | trailofbits/skills | Security auditing and vulnerability scanning |
ext/qedgen | QEDGen/solana-skills | Formal verification with Lean 4 theorem proving |
ext/solana-mobile | solana-mobile/solana-mobile-dev-skill | Mobile Wallet Adapter, Genesis Token, SKR address resolution |
ext/colosseum | ColosseumOrg/colosseum-copilot | Startup research, idea validation, hackathon projects |
ext/safe-solana-builder | frankcastleauditor/safe-solana-builder | Security-first code generation (70+ audit-derived rules) |
ext/vercel | vercel-labs/agent-skills | Vercel deployment, Next.js, AI SDK, v0, edge functions |
ext/solana-new | sendaifun/solana-new |
Each agent loads its own specialized context on invocation:
"Use solana-architect to design the vault program"
"Use anchor-engineer to implement the deposit instruction"
"Use defi-engineer to integrate Jupiter swaps"
"Use solana-qa-engineer to write comprehensive tests"
Claude will spawn each specialized agent by itself based on context and, with CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS enabled, orchestrate multi-agent workflows:
"Create an agent team: solana-architect for design, anchor-engineer for implementation, solana-qa-engineer for testing"
Recommended team patterns:
| Pattern | Flow | Use Case |
|---|---|---|
| program-ship | architect → anchor/pinocchio → qa | Build program from spec to tested |
| full-stack | architect → anchor → frontend → qa | End-to-end feature |
| audit-and-fix | qa → trailofbits context → anchor | Audit and remediate |
| game-ship | game-architect → unity → qa | Game feature |
| defi-compose | researcher → defi-engineer → qa | DeFi integration |
| token-launch | token-engineer → frontend → qa | Token creation + launch UI |
Pre-configured MCP servers in .mcp.json (API keys go in .env):
| Server | Capabilities |
|---|---|
| Helius | 60+ tools: RPC, DAS API, webhooks, priority fees, token metadata, NFT data |
| solana-dev | Solana Foundation official MCP — Solana docs, guides, and API references |
| Context7 | Up-to-date library documentation lookup |
| Playwright | Browser automation for dApp testing and visual verification |
| context-mode | Context window optimization — compresses large RPC responses, build logs, and code analysis |
| memsearch | Persistent AI memory across sessions — auto-captures summaries, semantic search, git-friendly storage |
| Surfpool | Agent-driven local validator / mainnet-fork control via the Surfpool CLI — surfpool mcp (requires the surfpool CLI) |
CLAUDE.local.md for private scratch notes (gitignored, never shared)| Layer | Stack |
|---|---|
| Programs | Anchor 1.0+, Pinocchio, Rust 1.82+ |
| Token Extensions | Token-2022 (transfer hooks, confidential transfers, metadata) |
| Testing | Mollusk, LiteSVM, Surfpool, Trident |
| Frontend | @solana/kit, Next.js 15, React 19 |
| Mobile | React Native, Expo, Mobile Wallet Adapter |
| Backend | Axum 0.8+, Tokio 1.40+, sqlx |
| Unity Games | Solana.Unity-SDK, .NET 9, C# 13 |
| PlaySolana | PSG1 console, PlayDex, SvalGuard |
| DeFi | Jupiter, Drift, Kamino, Raydium, Orca, Meteora |
| Infrastructure | Cloudflare Workers, GitHub Actions, Docker |
Beyond the bundled submodules above, the kit ships a curated catalog of opt-in skills, plugins, and MCPs that are not installed by default — the agent installs them only on your request, at your own expense. The set is deduped against solana-new's vendored ecosystem catalogs so it surfaces net-new, high-signal picks rather than restating what's already reachable.
Featured add-ons by domain:
/diff-review + cso)Where we scout new tools (aggregators, not installable): ComposioHQ/awesome-claude-skills · travisvn/awesome-claude-skills · davepoon/buildwithclaude · hesreallyhim/awesome-claude-code · VoltAgent/awesome-claude-code-subagents.
For broader Solana coverage, see solana-new's vendored catalogs at ext/solana-new/cli/data/ (MCPs, skills, clonable repos).
See skill-registry.json for the complete extended catalog — every entry with its install command, license, and safety caveats.
.
├── CLAUDE.md # Main hub - Claude reads this first
├── README.md # This file
├── .mcp.json # MCP server configurations (project root)
├── install.sh # One-liner installer
├── update.sh # Deprecation wrapper → .claude/bin/update.sh
├── validate.sh # Config integrity checker
├── LICENSE # MIT
├── tests/ # Config integrity test suite
├── .github/workflows/
│ ├── ci.yml # PR validation
│ ├── claude-code.yml # Claude Code action template
│ └── claude.yml # @claude mention responder (issues/PRs)
└── .claude/
├── VERSION # Semver version (e.g. 2.0.0)
├── agents/ # 15 specialized agents
├── bin/
│ ├── update.sh # In-place update from upstream
│ └── resync.sh # Submodule resync script
├── commands/ # 30 workflow commands
├── skills/ # Progressive-loading knowledge
│ ├── SKILL.md # Unified hub routing to all skills
│ ├── ext/ # External skill submodules
│ │ ├── solana-dev/ # Solana Foundation dev skill (core)
│ │ ├── sendai/ # SendAI protocol skills (DeFi)
│ │ ├── solana-game/ # Solana game skill (Unity, PSG1)
│ │ ├── cloudflare/ # Cloudflare Workers, Agents SDK
│ │ ├── trailofbits/ # Trail of Bits security skills
│ │ ├── qedgen/ # QEDGen formal verification (Lean 4)
│ │ ├── solana-mobile/ # Mobile Wallet Adapter, Genesis Token
│ │ ├── colosseum/ # Colosseum Copilot (startup research)
│ │ ├── safe-solana-builder/ # Security-first code generation
│ │ ├── vercel/ # Vercel deployment, Next.js, AI SDK
│ │ ├── solana-new/ # SendAI idea→launch journey skills + datasets
│ │ ├── ghostsecurity/ # Ghost Security AppSec skills
│ │ ├── defending-code/ # Anthropic vuln-discovery reference harness
│ │ ├── jupiter/ # Official Jupiter skills (swap, lend, VRFD)
│ │ ├── metaplex/ # Official Metaplex (NFT, candy machine)
│ │ ├── helius/ # Official Helius infra + SVM internals
│ │ ├── quicknode-anchor/ # Anchor/Quasar reference files (quarantined)
│ │ └── eth-to-sol/ # EVM/Solidity → Anchor porting
│ ├── skill-registry.json # Opt-in add-on catalog (repos/skills/MCPs)
│ ├── idea-sprint/ # Wrapper: find + validate crypto ideas (GTM)
│ ├── pitch-deck/ # Wrapper: pitch decks for crypto projects (GTM)
│ ├── hackathon/ # Wrapper: hackathon submissions + grants (GTM)
│ ├── token-2022.md # Token Extensions guide (local)
│ ├── backend-async.md # Axum/Tokio patterns (local)
│ └── deployment.md # Deployment workflows (local)
├── rules/ # Auto-loading constraints
└── settings.json # Permissions, hooks, agent teams
| Agent | Purpose | Model |
|---|---|---|
| solana-architect | System design, PDA schemes, token economics, multi-program architecture | Opus |
| anchor-engineer | Anchor development, IDL generation, account constraints | Opus |
| pinocchio-engineer | CU optimization (80-95% savings), zero-copy, minimal binary | Opus |
| defi-engineer | DeFi integrations: Jupiter, Drift, Kamino, Raydium, Orca, Meteora | Opus |
| token-engineer | Token-2022 extensions, token economics, launch mechanics | Opus |
| solana-frontend-engineer | React/Next.js, wallet UX, transaction flows, accessibility | Opus |
| mobile-engineer | React Native/Expo, mobile wallet adapter, deep linking | Sonnet |
| rust-backend-engineer | Axum APIs, indexers, WebSocket services | Opus |
| devops-engineer | CI/CD, monitoring, RPC infrastructure, Cloudflare Workers | Sonnet |
| solana-qa-engineer | Testing (Mollusk/LiteSVM/Trident), CU profiling, code quality | Opus |
| tech-docs-writer | READMEs, API docs, integration guides | Sonnet |
| game-architect | Solana game design, Unity architecture, on-chain game state, PlaySolana | Opus |
| unity-engineer | Unity/C# implementation, Solana.Unity-SDK, wallet integration, NFT display | Sonnet |
| solana-guide | Learning, tutorials, concept explanations, progressive learning paths | Sonnet |
| solana-researcher | Ecosystem research, protocol investigation, SDK analysis | Sonnet |
| Command | Purpose |
|---|---|
/build-program | Build Anchor or native Solana program |
/build-app | Build Next.js/Vite web client |
/build-unity | Build Unity project (WebGL, Desktop, PSG1) |
/scaffold | Generate project scaffolding (program + frontend + tests + CI) |
| Command | Purpose |
|---|---|
/test-rust | Run Mollusk, LiteSVM, Surfpool, Trident tests |
/test-ts | Run TypeScript tests (Anchor, Vitest, Playwright) |
/test-dotnet | Run .NET/C# tests (Unity Test Framework, NUnit) |
/test-and-fix | Run tests and auto-fix common issues |
/audit-solana | Comprehensive security audit |
/audit-infra | Infra-first security audit: secrets, supply chain, CI/CD, LLM/skill security, OWASP, STRIDE |
/product-review | Product quality review — UX walkthrough, 8-dimension scorecard (--harsh for the roast variant) |
/diff-review | AI-powered diff review for Solana-specific issues |
/profile-cu | CU profiling per instruction with optimization suggestions |
/benchmark | CU benchmarks with before/after comparison |
/debug-user-tx | Replay a user's failing tx against forked state, map error to source |
| Command | Purpose |
|---|---|
/deploy | Deploy to devnet (always first) or mainnet |
/migrate-web3 | Migrate from @solana/web3.js to @solana/kit |
/generate-idl-client | Generate typed clients from IDL (Codama/Shank) |
| Command | Purpose |
|---|---|
/quick-commit | Create branch, format, lint, conventional commit |
/commit-claude-config | Version the kit config in git (un-ignores .claude/, CLAUDE.md, .mcp.json, .gitmodules) |
/setup-ci-cd | Configure GitHub Actions pipeline |
/setup-mcp | Configure MCP server API keys and connections |
/resync | Resync external skill submodules to latest |
/write-docs | Generate documentation for programs, APIs, components |
/explain-code | Explain complex code with visual diagrams |
/plan-feature | Plan feature implementation with specifications |
/update | Update config to latest version from upstream |
/cleanup | Initialize forked template — setup CLAUDE.md, remove scaffolding |
/doctor | Health check for dev environment + config — read-only, one fix-it command per failure |
/dream | Memory consolidation — dedupe, prune, re-rank MEMORY.md and Project Learnings |
| Script | Purpose |
|---|---|
install.sh | One-liner installer: copies config to your project (--agents for non-Claude tools) |
update.sh | Deprecation wrapper → .claude/bin/update.sh |
validate.sh | Validates all config integrity (agents, commands, skills, settings, versioning) |
tests/run_all.sh | Runs full test suite for config validation |
This config includes a pre-built GitHub Action (.github/workflows/claude-code.yml) for PR-based iteration:
ANTHROPIC_API_KEY to your repository secrets.github/workflows/claude-code.yml to your project@claude in PR commentsAll new work starts on a feature branch:
# Format: <type>/<scope>-<description>-<DD-MM-YYYY>
git checkout -b feat/program-vault-15-01-2026
git checkout -b fix/frontend-auth-15-01-2026
Use /quick-commit to automate branch creation and commits.
Before merging, run /diff-review or check diff against main:
git diff main...HEAD
Remove: excessive comments, abnormal try/catch blocks, verbose errors, redundant validation.
Keep: legitimate security checks, non-obvious explanations, matching error patterns.
/cleanup — this copies CLAUDE-solana.md → CLAUDE.md and removes config repo scaffolding (tests, install scripts, docs)For monorepos, add a CLAUDE.md to each package/module with architecture decisions scoped to that directory. Claude Code automatically loads these when working in that subdirectory.
# Preferred: use /update in Claude Code, or run directly:
bash .claude/bin/update.sh
# Preview changes without applying:
bash .claude/bin/update.sh --dry-run
# Resync skill submodules only:
bash .claude/bin/resync.sh
# Or manually update submodules
git submodule update --remote --merge
MIT - See LICENSE
.claude/
.claude-plugin/
marketplace.json
agents/
anchor-engineer.md
defi-engineer.md
devops-engineer.md
game-architect.md
mobile-engineer.md
pinocchio-engineer.md
rust-backend-engineer.md
solana-architect.md
solana-frontend-engineer.md
solana-guide.md
solana-qa-engineer.md
solana-researcher.md
tech-docs-writer.md
token-engineer.md
unity-engineer.md
bin/
_env_merge.sh
resync.sh
update.sh
CHANGELOG.md
commands/
audit-infra.md
audit-solana.md
benchmark.md
build-app.md
build-program.md
build-unity.md
cleanup.md
commit-claude-config.md
debug-user-tx.md
deploy.md
diff-review.md
doctor.md
dream.md
explain-code.md
generate-idl-client.md
migrate-web3.md
plan-feature.md
product-review.md
profile-cu.md
quick-commit.md
resync.md
scaffold.md
setup-ci-cd.md
setup-mcp.md
test-and-fix.md
test-dotnet.md
test-rust.md
test-ts.md
update.md
write-docs.md
rules/
anchor.md
dotnet.md
pinocchio.md
rust.md
typescript.md
settings.json
skills/
backend-async.md
deployment.md
ext/
hackathon/
SKILL.md
idea-sprint/
SKILL.md
pitch-deck/
SKILL.md
skill-registry.json
SKILL.md
token-2022.md
VERSION
.env.example
.github/
assets/
solana-ai-kit-banner.png
workflows/
ci.yml
claude-code.yml
claude.yml
.gitignore
.gitmodules
.mcp.json
CLAUDE-solana.md
CLAUDE.md
install.sh
LICENSE
plugin/
.claude-plugin/
plugin.json
.mcp.json
agents
commands
hooks/
hooks.json
skills/
hackathon
idea-sprint
pitch-deck
skill-registry.json
SKILL.md
VERSION
QUICK-START.md
README.md
tests/
helpers.sh
run_all.sh
test_agents.sh
test_cleanup.sh
test_commands.sh
test_cross_references.sh
test_install_agents_only.sh
test_install_existing_claude.sh
test_install_idempotent.sh
test_install.sh
test_mcp_config.sh
test_plugin.sh
test_resync.sh
test_settings_deep.sh
test_settings.sh
test_skills.sh
test_update.sh
test_validate.sh
update.sh
validate.sh
vercel.json© 2026 Flowy · Free and open source
Built for Claude Code · Not affiliated with Anthropic
| 32 idea→launch journey skills + idea datasets/knowledge base; routed via local wrappers |
ext/ghostsecurity | ghostsecurity/skills | 7 AppSec skills: SAST criteria, SCA, secrets, validation |
ext/defending-code | anthropics/defending-code-reference-harness | Anthropic vuln-discovery reference harness + 6 skills |
ext/jupiter | jup-ag/agent-skills | Official Jupiter skills: Ultra swap, Lend, swap migration, VRFD |
ext/metaplex | metaplex-foundation/skill | Official Metaplex: Core, Token Metadata, Bubblegum, Candy Machine, Genesis |
ext/helius | helius-labs/core-ai | Official Helius infra skill + unique SVM internals skill |
ext/quicknode-anchor | quiknode-labs/solana-anchor-claude-skill | Anchor/financial-math/Quasar reference files (quarantined — refs only) |
ext/eth-to-sol | solana-foundation/eth-to-sol-skill | EVM/Solidity → Anchor two-pass porting |