Vigilo

Web3 Smart Contract Security Auditing Agent

From Latin vigilo — "I watch, I guard." An autonomous security legion inspired by the command structure of the Roman army, watching over your smart contracts to find vulnerabilities before attackers do.

What is Vigilo?

Vigilo is an autonomous security legion for smart contract auditing, inspired by the command structure of the Roman army. It runs inside OpenCode, deploying specialized agents in parallel to find vulnerabilities and generate validated PoCs.

The Legion

Proven in the Wild

Real vulnerabilities found by Vigilo in live audit contests.

All I did was specify the target project and submit the report. Vigilo did the rest.

Cantina — Ceiling Rounding Accumulation (High, Accepted)
View full report

Installation

OpenCode

For LLM Agents (Recommended)

Paste this into your LLM agent session:

Install and configure vigilo by following the instructions here:
https://raw.githubusercontent.com/PurpleAILAB/Vigilo/main/packages/opencode/docs/installation.md

Manual Install

bunx vigilo install

Claude Code

/plugin marketplace add PurpleAILAB/Vigilo
/plugin install vigilo@Vigilo

See the full Installation Guide for more options.

Uninstallation

1. Remove the plugin from your OpenCode config:

# Edit ~/.config/opencode/opencode.json and remove "vigilo" from the plugin array

2. Remove configuration files:

rm -f ~/.config/opencode/vigilo.json

3. Verify removal:

opencode --version

Features

• Automated Audit Workflow: Scope → Recon (Exploratores) → Deep Analysis (Centuriones) → PoC → Report
• Specialized Auditors: Reentrancy, Oracle, Access Control, Flashloan, Logic, DeFi, Token, Cross-Chain
• Multi-Language Support: Solidity, Vyper, Cairo, Rust
• Foundry Integration: forge build, forge test, forge coverage
• LSP Integration: Goto-definition, references, diagnostics
• Parallel Analysis: Multiple auditors running concurrently
• PoC Validation: Auto-generate and validate Foundry tests

Usage

cd my-solidity-project
opencode

# Start audit
/audit

# Generate PoC
/poc .vigilo/findings/high/H-01-reentrancy.md

Directory Structure

.vigilo/
├── recon/           # Explorator & Speculator outputs
├── findings/        # Vulnerability findings
│   ├── high/
│   └── medium/
├── poc/             # PoC validation logs
└── reports/         # Final reports

Platforms

Why OpenCode? More flexibility with model selection, better plugin extensibility, and cost-effective auditing with configurable models per auditor.

Benchmarking

Measure Vigilo's audit accuracy against verified security reports from Code4rena, Sherlock, and Cantina.

# Run full benchmark pipeline
bunx vigilo-bench sherlock_cork-protocol_2025_01 -w -v

Pipeline: checkout → audit → score → report

See packages/bench for full documentation.

Troubleshooting

bunx vigilo doctor
bunx vigilo doctor --verbose

Development

For contributors working on Vigilo itself.

Setup

git clone https://github.com/PurpleAILAB/Vigilo.git
cd vigilo/packages/opencode
bun install
bun link

Development Mode

1. Configure local plugin path in ~/.config/opencode/opencode.json:

{
  "plugin": [
    "D:/path/to/vigilo/packages/opencode"
  ]
}

2. Run watch mode:

bun run dev

3. Restart OpenCode to load changes.

Quick Commands

Restore Production Mode

bunx vigilo install

This resets the plugin path to vigilo@latest.

License

Business Source License 1.1

• Non-production use: Free
• Production use: Requires commercial license
• Change Date: 2029-01-21 (converts to Apache-2.0)

Commercial licensing: [email protected]