# TypeScript SDK for autonomous Solidity security auditing — 7 breach scenarios, LangChain.js + Vercel AI SDK integration

> Source: <https://dev.to/rakhmad_auladalie_59d4de/typescript-sdk-for-autonomous-solidity-security-auditing-7-breach-scenarios-langchainjs--3bbp>
> Published: 2026-09-07 08:40:28+00:00

I've been working on an autonomous security auditing gateway for Solidity smart contracts. The TypeScript SDK just went live on npm — it runs 7 automated breach simulations against any Solidity source code in ~2ms, with no signup or API key required for the free tier.

Most Solidity security tools are either:

This SDK gives you a **programmatic, agent-native** audit that runs 7 breach scenarios via a single function call. No local toolchain. No signup. No API key for the free tier.

```
npm install nexus-gateway-sdk
```

| ID | Scenario | Question | 
|---|---|---|
| BS-001 | Unauthorized Minting | Can tokens be minted without authorization? | 
| BS-002 | Transfer Violation | Can transfers bypass balance/allowance checks? | 
| BS-003 | Fund Drain | Can funds be withdrawn without authorization? | 
| BS-004 | Emergency Freeze | Is there an emergency stop / pause mechanism? | 
| BS-005 | Ownership Renounce | Can ownership renunciation lock admin functions? | 
| BS-006 | Reentrancy Attack | Are external calls protected against reentrancy? | 
| BS-007 | Replay Attack | Is nonce-based replay protection implemented? | 

Each scenario returns a structured result: `risk_level`, `affected_functions`, `detected`, `mitigation`.

``` js
import { NexusClient } from "nexus-gateway-sdk";

const client = new NexusClient({ clientId: "my-app" });

const result = await client.dryRun({
  source_code: contractSource
});

// result.breach_simulation.overall_risk → "high" | "medium" | "low" | "critical"
// result.deployable → true | false
// result.breach_simulation.scenarios → array of 7 scenario objects
// result.digital_twin_v3_matrix → clause-to-code mapping
// result.urgency_signal → time-decay warning for M2M orchestrators
```

The SDK ships with native tool wrappers for AI agent frameworks:

``` js
// LangChain.js
import { createNexusTools } from "nexus-gateway-sdk";
const tools = createNexusTools({ clientId: "my-agent" });
// → Returns Tool[] compatible with LangChain.js agent executor

// Vercel AI SDK
import { createNexusVercelTools } from "nexus-gateway-sdk";
const tools = createNexusVercelTools({ clientId: "my-agent" });
// → Returns tools compatible with Vercel AI SDK generateText
```

This means any LangChain.js or Vercel AI agent can autonomously audit Solidity contracts as part of its toolset — no custom integration needed.

Beyond the 7 breach scenarios, the audit produces a **Digital Twin matrix** — a clause-to-code mapping that links contract functions to their breach conditions:

```
// Each function in the contract gets mapped:
{
  function_signature: "withdraw()",
  visibility: "external",
  modifiers: [],
  breach_conditions: ["BS-006: reentrancy via external call before state update"]
}
```

This is designed for M2M orchestration — agents can programmatically assess which functions are safe to call and which require additional guards.

The gateway passed **17/17 self-validation checks**:

**Interactive playground:** [https://rakhmadaa-gif.github.io/nexus-core-gateway/](https://rakhmadaa-gif.github.io/nexus-core-gateway/)

Paste any Solidity code → click "Run Security Audit" → instant results with 7 breach scenarios, risk badges, and recommendations.

Or via curl:

```
curl -X POST https://xibzsthfrbomefnvbicb.supabase.co/functions/v1/hello-world/gateway/dry-run \
  -H 'Content-Type: application/json' \
  -d '{"source_code": "pragma solidity ^0.8.20; contract Token { }"}'
```

`nexus-gateway-sdk@1.0.0` — 136 downloads
*This is part of the Nexus Gateway — an autonomous M2M legal-code gateway for Web3 compliance. ERC-8004 Agent #636 on Polygon Mainnet. The free tier (dry-run audit) is intentionally open for community use.*