audit-infra
Infrastructure-first security audit — secrets, supply chain, CI/CD, LLM/skill security, OWASP, STRIDE. Complements /audit-solana (program-level)
Health check for the dev environment and solana-ai-kit config — read-only, with one exact fix-it command per failure
> /plugin marketplace add solanabr/solana-ai-kit > /plugin install solana-ai-kit@stbr
How it fires
How this command gets triggered: by you, by Claude, or both.
/doctorContext preview
What this command does when you run it.
Health check for the dev environment and solana-ai-kit config — read-only, with one exact fix-it command per failure
description: "Health check for the dev environment and solana-ai-kit config — read-only, with one exact fix-it command per failure"
You are running a health check on this project's toolchain and solana-ai-kit configuration. **Read-only contract: this command never writes, edits, or deletes files.** It only inspects and reports.
node --version 2>/dev/null || echo "MISSING node" npm --version 2>/dev/null || echo "MISSING npm" claude --version 2>/dev/null || echo "MISSING claude CLI"
solana --version 2>/dev/null || echo "MISSING solana CLI" solana config get 2>/dev/null | grep "RPC URL" # active cluster solana balance --url devnet 2>/dev/null || echo "NO devnet balance / no keypair"
Only flag as ✗ if the project contains Rust programs (`Anchor.toml` or `programs/` present); otherwise report `-` (n/a).
rustc --version 2>/dev/null || echo "MISSING rustc" cargo --version 2>/dev/null || echo "MISSING cargo" anchor --version 2>/dev/null || echo "MISSING anchor" avm --version 2>/dev/null || echo "MISSING avm"
git submodule status
Compare key **names** between `.env.example` and `.env`. **NEVER print, echo, or display values — names only.**
# Key names present in example but absent in .env (presence check only) comm -23 \ <(grep -oE '^[A-Z_]+=' .env.example 2>/dev/null | sort -u) \ <(grep -oE '^[A-Z_]+=' .env 2>/dev/null | sort -u) # Keys present but left empty in .env grep -E '^[A-Z_]+=$' .env 2>/dev/null | cut -d= -f1
cat .claude/VERSION git ls-remote --tags --sort=-v:refname https://github.com/solanabr/solana-ai-kit | head -3
python3 -c "import json; d=json.load(open('.mcp.json')); print('\n'.join(d.get('mcpServers', {}).keys()))" \
2>/dev/null || echo "INVALID or missing .mcp.json"
# surfpool MCP requires the surfpool CLI binary on PATH (keyless, user-installed)
if grep -q '"surfpool"' .mcp.json 2>/dev/null; then
surfpool --version 2>/dev/null || echo "MISSING surfpool CLI"
fisolana-ai-kit ships two ways: the **plugin** (`/plugin install solana-ai-kit@solana-ai-kit`) and the **full install** (`install.sh` → project `.claude/`). Running both in one project double-loads commands, hooks, and MCP servers (e.g. `/deploy` and `/solana-ai-kit:deploy`, banner prints twice). Detect (names only, read-only):
# Plugin enabled at project scope? (user-scope lives in ~/.claude/settings.json) PLUGIN_ON=$(grep -lE '"solana-ai-kit@[^"]*"[[:space:]]*:[[:space:]]*true' \ .claude/settings.json "$HOME/.claude/settings.json" 2>/dev/null | head -1) # Full install present? [ -f .claude/VERSION ] && echo "FULL_INSTALL present" [ -n "$PLUGIN_ON" ] && echo "PLUGIN enabled (in: $PLUGIN_ON)"
Render exactly one summary table, then fix-its for non-✓ rows only:
## Doctor Report — <date> | # | Check | Status | Detail | |---|--------------------|--------|---------------------------------| | 1 | Core toolchain |
Production-ready Claude Code configuration for full-stack Solana development. Combines best practices from multiple sources into an agent-optimized, token-efficient config you can install and adapt to your specific project.
Repo: solanabr/solana-ai-kit
Infrastructure-first security audit — secrets, supply chain, CI/CD, LLM/skill security, OWASP, STRIDE. Complements /audit-solana (program-level)
Benchmark CU usage and compare against baseline for regression detection