AuditSentry

What it is

AuditSentry ships as a Claude Code plugin, not a standalone binary. The summary covers the 13 MCP servers / 23-agent architecture and the benchmark claim; what it omits is the install mechanism, the prerequisites, and the command surface — the things that actually determine whether an engineer can (or should) run it. The repo is MIT-licensed, attributed to "Iktok Security Labs — Zug, Switzerland," 2026, under the account iktok90-design. The marketplace listing is "pending"; /plugin install auditsentry does not work yet.

Preconditions / Affected

Prerequisites stated on the page: Node.js v18+, npm v9+, git, and make (Xcode CLT on macOS, apt install make on Linux). make build is mandatory — it compiles the MCP servers and installs tooling dependencies; the plugin will not function without it.

What to do

The install path drops the repo directly into your Claude Code skills directory, where it auto-loads on restart:

git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git ~/.claude/skills/auditsentry
cd ~/.claude/skills/auditsentry && make build

A no-commitment trial without touching your skills dir:

git clone https://github.com/iktok90-design/ai-smart-contract-auditor.git
cd ai-smart-contract-auditor
make build
make audit-demo   # runs against the bundled vulnerable contract

make test (Foundry + MCP + scripts), make bench (detection benchmark), and make docs are also exposed.

Caveats

Two things the page reveals that warrant caution before you run make build:

• Trust posture. This is an unvetted third-party project that you compile from source and load as an auto-invoking Claude Code plugin from ~/.claude/skills/. The dependency list (@noble/curves, @noble/hashes, handlebars, sharp, hex-encode-utils) is small but you are running an unaudited build on a machine with a live Claude Code session.
• Live and outbound commands. The command set includes /audit-live, /exploit-live, /replay-incident, /monitor, and outbound /notify-slack, /notify-discord, /tweet, /bounty-submit. Several interact with live chains or post externally — scope these before wiring in credentials.

The repo's own disclaimer states no automated tool guarantees full coverage and findings must be verified manually. The 150+ contest benchmark and the two testimonials are self-reported and unattributed to named firms.