VeridionLabs/veridion

What it is

Veridion (VeridionLabs/veridion) is an MIT-licensed monorepo for scanning smart contracts, explaining findings with an AI layer, and recording audit results on Stellar Soroban. The README gives a local setup path and a short recipe for adding scanner rules. It does not describe what the shipped rules detect.

Preconditions

• Node.js 20 or later, pnpm 9 or later, and Docker with Docker Compose.
• PostgreSQL, which can run in Docker.
• Redis, which the quick start launches alongside Postgres. The summary does not mention it.

What to do

Run it locally:

git clone https://github.com/veridion/veridion.git
cd veridion
pnpm install
cp .env.example .env
docker compose up -d postgres redis
pnpm db:migrate
pnpm dev

The API listens on http://localhost:4000 and the web app on http://localhost:3000. docker compose up -d is also listed as a way to start the stack.

To add a detection rule:

1. Create plugins/my-plugin/src/index.ts.
2. Implement the IRulePlugin interface from @veridion/scanner-types.
3. Register the plugin in the registry in apps/api.

The "zero changes to scanner-core" claim holds, but step 3 still edits the API app. Rules live in plugins/, and the Soroban contracts (Rust) live in contracts/. The README points to ARCHITECTURE.md, a Plugins Guide, CONTRIBUTING.md and a good-first-issues list for detail.

Vulnerabilities in Veridion itself go to security@veridion.dev, per SECURITY.md.

Caveats

• The clone URL in the README (veridion/veridion) differs from the repository's actual path (VeridionLabs/veridion). Check which one resolves before scripting it.
• The page does not say which contract languages or chains the scanner parses, or which rules ship by default.
• It does not name the supported AI providers, only that the layer is provider-agnostic.
• It does not explain what is written on-chain, such as a hash or a full report, or how verification is read back.
• It gives no maturity signals such as releases, benchmarks or detection accuracy.