forge-guard 0.3.6

Pre-deployment smart contract auditing framework for Foundry
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

# forge-guard.toml — example configuration
#
# Copy this file to your project root and adjust the values. All fields are
# optional — every section can be omitted entirely and Forge Guard uses
# sensible defaults (shown in the comments).
#
# Docs: https://github.com/codetibo/forge-guard#configuration

# ── Project ──
chain = "ethereum"                        # Target chain: ethereum, base, arbitrum, ...
src_dirs = ["src"]                        # Solidity source directories
exclude = ["test", "mock"]                # Exclude patterns (gitignore-style)
strict = false                            # Strict mode — fail on any finding
offline = false                           # Offline mode — skip RPC calls
min_deployment_score = 70                 # Scoring threshold for deployment (0-100)
parallelism = 4                           # Max parallel workers

# ── Security Engine ──
[security]
enable_high = true                        # Enable HIGH severity checks
enable_medium = true                      # Enable MEDIUM severity checks
enable_low = true                         # Enable LOW severity checks
enable_info = false                       # Enable INFORMATIONAL checks
exploit_analysis = true                   # Enable exploit path analysis
gas_analysis = false                      # Enable gas analysis
max_findings_per_check = 50               # Max findings per check
# enabled_checks = ["FA-H-011", "FA-H-016"]   # Force-enable specific check IDs
# disabled_checks = ["FA-L-001"]               # Force-disable specific check IDs
# severity_overrides = { "FA-M-001" = "high" } # Override a check's severity

# ── Deployment Guard ──
[deployment]
min_score = 70                            # Minimum score to deploy (0-100)
block_on_high = true                      # Block on high findings
block_on_medium = false                   # Block on medium findings
block_on_critical = true                  # Block on critical findings
require_fuzzing = true                    # Require fuzzing to pass
require_invariants = true                 # Require invariants to pass
simulate_deployment = true                # Run deployment simulation
require_verification = false              # Require on-chain verification
auto_verify = false                       # Auto-verify after deployment
# explorer_api_key = null                 # Explorer API key (reads env var when null)

# ── Report Settings ──
[report]
include_snippets = true                   # Include code snippets
include_exploit_paths = true              # Include exploit demonstrations
include_recommendations = true            # Include fix recommendations
output_dir = "reports"                    # Report output directory

# ── Caching ──
[cache]
enabled = false                           # Enable caching (disable for CI)
directory = ".forge-guard-cache"          # Cache directory
max_size_mb = 500                         # Maximum cache size
ttl_seconds = 3600                        # Cache TTL (1 hour)

# ── Plugin Configuration ──
[plugins]
directories = [".forge-guard/plugins"]    # Plugin search paths
disabled = ["forge-guard-example"]        # Disable specific plugins
allow_external = false                    # Allow external plugin loading

# ── AI Auditors ──
[ai]
provider = "openai"                       # AI provider: openai, claude, ollama
model = "gpt-5"                           # Model identifier
temperature = 0.1                         # Sampling temperature (0.0-1.0)
max_tokens = 4000                         # Max tokens per response
min_confidence = 0.5                      # Minimum confidence (0.0-1.0)
full_audit = false                        # Run all auditors (security + gas + logic)

# ── Webhook Notifications (M15) ──
#
# Both Slack and Discord are optional and independent. Notifications are sent
# when a command runs with `--notify` (audit / deploy / deploy-safe) or via
# `forge-guard notify`. `min_severity` gates what triggers a send:
# informational, low, medium, high, or critical.
#
# Slack: create an Incoming Webhook at
#   https://api.slack.com/messaging/webhooks
# Discord: create a Webhook under Server Settings → Integrations → Webhooks.
#
# CLI override: `forge-guard notify --webhook <URL>` sends to any URL and
# auto-detects the platform from it.

[notifications.slack]
webhook = "https://hooks.slack.com/services/T000/B000/XXXX"  # Slack incoming webhook
min_severity = "high"                    # Notify when findings are at least this severe

[notifications.discord]
webhook = "https://discord.com/api/webhooks/123/abc"         # Discord webhook
min_severity = "critical"