@finchagentic/mcp 4.6.2 → 4.6.4

package/dist/signal-gate.js

@@ -0,0 +1,57 @@
+"use strict";
+// Insufficient-signal detector used by deep_research before saving to vault.
+// Mirrors convex/_signalGate.ts in the app - same logic, different runtime.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkSignal = checkSignal;
+const META_FAILURE_PHRASES = [
+    "search returned directory",
+    "directory pages",
+    "topic landing pages",
+    "landing pages from major",
+    "aggregator homepages",
+    "index pages",
+    "results provide no",
+    "no specific findings",
+    "no specific developments",
+    "no specific announcements",
+    "no specific stories",
+    "no concrete findings",
+    "no substantive findings",
+    "no specific breakthroughs",
+    "no specific data",
+    "rather than current stories",
+    "rather than specific",
+    "rather than individual articles",
+    "insufficient data to",
+    "search results were thin",
+];
+function checkSignal(content) {
+    const text = (content ?? "").trim();
+    if (text.length < 300) {
+        return { ok: false, reason: "output too short (<300 chars)", score: 0 };
+    }
+    const lower = text.toLowerCase();
+    for (const phrase of META_FAILURE_PHRASES) {
+        if (lower.includes(phrase)) {
+            return {
+                ok: false,
+                reason: `search returned only metadata pages - LLM flagged it ("${phrase}")`,
+                score: 0.2,
+            };
+        }
+    }
+    const numbers = (text.match(/\b\d{1,4}([.,]\d+)?\s*(%|USD|usd|m|M|k|K|bn|B|x|gwei|eth|ETH|btc|BTC)?\b/g) ?? []).length;
+    const links = (text.match(/https?:\/\//g) ?? []).length;
+    const quotes = (text.match(/"[^"]{10,}"/g) ?? []).length;
+    if (text.length < 800 && numbers < 3 && links < 1 && quotes < 1) {
+        return {
+            ok: false,
+            reason: "low concrete-data density (no numbers, links, or quoted findings)",
+            score: 0.3,
+        };
+    }
+    const lengthScore = Math.min(1, text.length / 2000);
+    const dataScore = Math.min(1, (numbers + links * 2 + quotes * 2) / 25);
+    const score = Math.max(0, Math.min(1, lengthScore * 0.4 + dataScore * 0.6));
+    return { ok: true, score };
+}

package/dist/token-decimals.js

@@ -0,0 +1,26 @@
+"use strict";
+// Canonical token decimals for the MCP server — ONE source of truth.
+// Mirrors app/convex/tokenDecimals.ts. Keep the two in sync when adding a token;
+// they are separate packages so the module itself cannot be shared.
+//
+// Previously duplicated across tools/defi.ts and tools/base-mcp.ts with a silent
+// `?? 18` fallback. Assuming 18 decimals for a 6-decimal token misreports the
+// amount by 10^12, so unknown tokens return undefined and callers must say so.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_DECIMALS = void 0;
+exports.decimalsFor = decimalsFor;
+exports.TOKEN_DECIMALS = {
+    ETH: 18,
+    WETH: 18,
+    DAI: 18,
+    FINCH: 18,
+    USDC: 6,
+    USDT: 6,
+    CBBTC: 8,
+};
+/** Decimals for a token symbol, or undefined if unknown. Never guesses. */
+function decimalsFor(symbol) {
+    if (!symbol)
+        return undefined;
+    return exports.TOKEN_DECIMALS[symbol.trim().toUpperCase()];
+}

package/dist/token-gate.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PREMIUM_TOOLS = void 0;
+exports.getTier = getTier;
+exports.tokenGateError = tokenGateError;
+const wallet_js_1 = require("./wallet.js");
+const config_js_1 = require("./config.js");
+const FINCH_TOKEN_CA = "0x4B524015D54a27d4472F5c59c570730D69499Ba3";
+const BALANCE_SELECTOR = "0x70a08231"; // balanceOf(address)
+const CACHE_TTL = 5 * 60 * 1000; // 5 min - avoid per-call RPC
+// 1 FINCH (18 decimals). Override via FINCH_MIN_BALANCE env var.
+const MIN_BALANCE = BigInt(process.env.FINCH_MIN_BALANCE ?? "1000000000000000000");
+let _cache = null;
+async function erc20BalanceOf(address) {
+    const padded = address.toLowerCase().replace("0x", "").padStart(64, "0");
+    const res = await fetch(wallet_js_1.BASE_RPC, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            jsonrpc: "2.0", id: 1, method: "eth_call",
+            params: [{ to: FINCH_TOKEN_CA, data: BALANCE_SELECTOR + padded }, "latest"],
+        }),
+        signal: AbortSignal.timeout(8000),
+    });
+    const data = await res.json();
+    return BigInt(data.result ?? "0x0");
+}
+// Session token or API key → always holder (authenticated user)
+function hasAuthBypass() {
+    return !!((0, config_js_1.getSavedToken)() || process.env.FINCH_API_KEY);
+}
+async function getTier() {
+    if (hasAuthBypass())
+        return "holder";
+    if (_cache && Date.now() - _cache.at < CACHE_TTL)
+        return _cache.tier;
+    try {
+        const wallet = await (0, wallet_js_1.getOrCreateWallet)();
+        const balance = await erc20BalanceOf(wallet.address);
+        const tier = balance >= MIN_BALANCE ? "holder" : "basic";
+        _cache = { tier, at: Date.now() };
+        return tier;
+    }
+    catch {
+        // RPC unreachable - don't block, degrade gracefully
+        return "basic";
+    }
+}
+// Tools that require FINCH token to unlock
+exports.PREMIUM_TOOLS = new Set([
+    // Simulation
+    "miroshark_simulate", "miroshark_status", "miroshark_stop",
+    // AI analysis
+    "market_thesis", "trade_plan",
+    // Advanced memory
+    "memory_insight", "memory_extract", "memory_consolidate",
+    // Automations
+    "create_automation", "run_automation", "pause_automation", "delete_automation", "get_automation_runs",
+    // Autonomous monitors
+    "schedule_research",
+    // Persistent agents
+    "agent_spawn", "agent_recall", "agent_update",
+]);
+function tokenGateError(toolName) {
+    return {
+        content: [{
+                type: "text",
+                text: [
+                    "🔒 **Premium Tool**",
+                    "",
+                    `\`${toolName}\` requires a Finch account or FINCH token.`,
+                    "",
+                    "**Option 1 - Sign in (easiest):**",
+                    "1. Go to finchagentic.com and sign in",
+                    "2. Copy your session token from Settings",
+                    "3. Add to your MCP config: `FINCH_SESSION_TOKEN=…`",
+                    "",
+                    "**Option 2 - Hold FINCH token on Base:**",
+                    "1. Get FINCH  -  CA: `0x4B524015D54a27d4472F5c59c570730D69499Ba3`",
+                    "2. Hold at least 1 FINCH in your local wallet",
+                    "3. Access unlocks automatically",
+                    "",
+                    "Run `finch_status` to check your current tier.",
+                ].join("\n"),
+            }],
+        isError: true,
+    };
+}

package/dist/tool-filter.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterTools = filterTools;
+// Tool-subset filter. Each user keeps the full handler map (so any tool
+// can still be invoked by name if explicitly referenced), but the LIST
+// response sent to MCP clients is trimmed based on FINCH_TOOLS.
+//
+// Default = "core" - runtime essentials only (memory, vault, agents,
+// chronicle, status). Opt-in presets let token-conscious users cut LLM
+// context cost while keeping the full surface accessible by name:
+//
+//   FINCH_TOOLS=core         runtime essentials (memory, vault, agents)
+//   FINCH_TOOLS=defi         Base + market + DeFi execution
+//   FINCH_TOOLS=research     research + memory + vault
+//   FINCH_TOOLS=memory       memory + vault + agents only
+//   FINCH_TOOLS=memory,defi  comma-separated combination
+//   FINCH_TOOLS=all          every registered tool
+//
+// Unknown presets fall back to all to avoid silently hiding tools.
+// Each preset's regex is checked against every tool name in ALL_TOOLS by
+// tools-registration.test.ts (see "every tool matches at least one preset")
+// - a tool that matches no preset's regex is invisible under every FINCH_TOOLS
+// setting except "all", which happened silently to 33/121 tools before that
+// test existed (rh_* order-management tools, all *_automation tools, packets,
+// playbooks, wallet balance/sign, miroshark, stock_* - a user on
+// FINCH_TOOLS=defi couldn't even see rh_order_cancel for an order placed
+// through that same preset). New tools MUST match a preset or the test fails
+// the build, instead of quietly vanishing like these did.
+const PRESETS = {
+    core: /^(memory_|vault_|code_session_save|list_projects|agent_|ask_finch|finch_status|finch_diagnostics|finch_shell_chat|get_wallet_address|get_wallet_balance|wallet_sign_message|chronicle_|packet_)/,
+    defi: /^(get_market_data|get_token_data|compare_tokens|market_overview|token_history|get_base_token_data|stock_fundamentals|stock_insider|stock_events|market_thesis|trade_plan|base_mcp_|rh_|base_|get_defi_yields|score_token|check_token|scan_market|get_wallet_balance|wallet_sign_message|create_automation|list_automations|pause_automation|delete_automation|get_automation_runs|run_automation|miroshark_|stake_|unstake_finch|claim_vested_rewards)/,
+    research: /^(memory_|vault_|code_session_save|list_projects|deep_research|research_compare|research_chain|web_search|web_scrape|schedule_research|list_monitors|cancel_monitor|ask_finch|stock_fundamentals|stock_insider|stock_events)/,
+    memory: /^(memory_|vault_|code_session_save|list_projects|agent_|chronicle_)/,
+    coder: /^(audit_contract|github_|code_session_save)/,
+};
+function filterTools(allTools) {
+    // Default is "core" - keeps LLM context cost low while everything
+    // is still callable by name. Power users opt back in via
+    // FINCH_TOOLS=all. Explicit empty env still means "all" for back-compat.
+    const raw = (process.env.FINCH_TOOLS ?? "core").trim().toLowerCase();
+    const env = raw === "" ? "core" : raw;
+    if (env === "all")
+        return allTools;
+    const presetKeys = env.split(",").map((s) => s.trim()).filter(Boolean);
+    const patterns = presetKeys
+        .map((k) => PRESETS[k])
+        .filter((p) => !!p);
+    if (patterns.length === 0) {
+        // Unknown preset(s) - surface full tool set rather than silently hide.
+        return allTools;
+    }
+    return allTools.filter((t) => patterns.some((p) => p.test(t.name)));
+}

package/dist/tools/_solidity-scan.js

@@ -0,0 +1,313 @@
+"use strict";
+// Static heuristic scanner for Solidity audit grounding.
+//
+// The LLM-only audit path was dangerous: a model could say "this contract
+// looks safe" without any structural basis, and a user might trust that
+// claim with real funds. This module runs a regex/pattern scan over the
+// source BEFORE the LLM call and forces the LLM to address each finding
+// (either confirm the risk or explain why it's a false positive). The
+// resulting report leads with "automated static checks", then "LLM review
+// over those findings", then a mandatory disclaimer.
+//
+// This is NOT a substitute for a professional audit. It catches obvious
+// antipatterns. Subtle vulnerabilities (reentrancy guarded by state ordering,
+// signature replay, oracle manipulation under non-obvious conditions) still
+// need human review or specialized tooling (Slither, Mythril, Echidna).
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUDIT_DISCLAIMER = void 0;
+exports.staticScanSolidity = staticScanSolidity;
+exports.formatFindings = formatFindings;
+const PATTERNS = [
+    // ─── Critical ─────────────────────────────────────────────────────────────
+    {
+        id: "SOL-TX-ORIGIN",
+        severity: "critical",
+        title: "tx.origin used for authorization",
+        detail: "tx.origin returns the original EOA that started the call chain - vulnerable to phishing where a malicious contract relays calls. Use msg.sender for auth.",
+        regex: /\btx\.origin\b/,
+        reference: "https://docs.soliditylang.org/en/latest/security-considerations.html#tx-origin",
+    },
+    {
+        id: "SOL-DELEGATECALL",
+        severity: "critical",
+        title: "delegatecall to a non-immutable target",
+        detail: "delegatecall executes target code in caller's storage. If target is a state variable or function parameter it can be hijacked to overwrite storage or steal funds.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                if (/\.delegatecall\s*\(/i.test(l) && !/immutable|constant/.test(l)) {
+                    out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                }
+            });
+            return out;
+        },
+        reference: "https://docs.soliditylang.org/en/latest/security-considerations.html#use-the-checks-effects-interactions-pattern",
+    },
+    {
+        id: "SOL-SELFDESTRUCT",
+        severity: "critical",
+        title: "selfdestruct present",
+        detail: "selfdestruct (renamed `selfdestruct` in 0.8.x; deprecated post-Cancun) wipes contract code. Requires strict access control. Note: Cancun changed semantics - most uses should be removed entirely.",
+        regex: /\bselfdestruct\s*\(|suicide\s*\(/,
+    },
+    // ─── High ─────────────────────────────────────────────────────────────────
+    {
+        id: "SOL-REENTRANCY-PATTERN",
+        severity: "high",
+        title: "External call before state mutation (reentrancy risk)",
+        detail: "Heuristic detects `.call{value:` or `.transfer(` followed by storage writes in the next ~15 lines. Confirm Checks-Effects-Interactions ordering or ReentrancyGuard usage.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                if (/\.call\s*\{|\.transfer\s*\(|\.send\s*\(/.test(l) && !/^\s*\/\//.test(l)) {
+                    // Look ahead for storage write
+                    const slice = lines.slice(i + 1, Math.min(i + 16, lines.length)).join("\n");
+                    if (/^\s*[a-zA-Z_][a-zA-Z0-9_]*\s*=|^\s*[a-zA-Z_][a-zA-Z0-9_]*\[[^\]]*\]\s*=|\.push\s*\(|\.pop\s*\(|delete\s+/m.test(slice)) {
+                        out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                    }
+                }
+            });
+            return out;
+        },
+        reference: "https://swcregistry.io/docs/SWC-107",
+    },
+    {
+        id: "SOL-UNCHECKED-CALL",
+        severity: "high",
+        title: "Low-level call return value not checked",
+        detail: "`.call(...)` and `.delegatecall(...)` return (bool, bytes). Ignoring the bool means failures silently pass.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                if (/\.call\s*\{|\.call\s*\(|\.delegatecall\s*\(/.test(l)) {
+                    // Has assignment / require / boolean check?
+                    const hasCheck = /\(bool|=\s*(?:address|payable)?[a-zA-Z_]/i.test(l)
+                        || /require\s*\(/.test(l)
+                        || /\(\s*bool\s+/i.test(l);
+                    if (!hasCheck)
+                        out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                }
+            });
+            return out;
+        },
+        reference: "https://swcregistry.io/docs/SWC-104",
+    },
+    {
+        id: "SOL-FLOATING-PRAGMA",
+        severity: "medium",
+        title: "Floating pragma",
+        detail: "Using `^0.8.x` lets the contract compile with any minor version - different compilers can introduce subtle behavior changes. Pin to a specific version for production.",
+        regex: /pragma\s+solidity\s+\^/i,
+    },
+    {
+        id: "SOL-BLOCK-TIMESTAMP",
+        severity: "medium",
+        title: "block.timestamp used in conditional logic",
+        detail: "Miners can shift block.timestamp by ~15s. Acceptable for long timeouts; dangerous for randomness, short deadlines, or precise time-locks.",
+        regex: /\bblock\.timestamp\b|\bnow\b/,
+        reference: "https://swcregistry.io/docs/SWC-116",
+    },
+    {
+        id: "SOL-BLOCK-NUMBER-RAND",
+        severity: "high",
+        title: "block.number / blockhash used as randomness source",
+        detail: "block.number is predictable; blockhash returns 0 for blocks older than 256. Use Chainlink VRF or commit-reveal for fair randomness.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                if (/\b(?:blockhash|block\.difficulty|block\.prevrandao)\s*\(/.test(l)
+                    && /\b(?:random|rand|seed|lottery)/i.test(l)) {
+                    out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                }
+            });
+            return out;
+        },
+    },
+    // ─── Medium ───────────────────────────────────────────────────────────────
+    {
+        id: "SOL-MISSING-ZERO-CHECK",
+        severity: "low",
+        title: "Address parameter without zero-address check (heuristic)",
+        detail: "Setter functions that store an address but don't `require(addr != address(0))` can permanently break the contract. Heuristic - verify whether your intent allows zero.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                // Match `function setX(address _x)` or similar
+                const fn = l.match(/function\s+set\w*\s*\(\s*address\s+/);
+                if (fn) {
+                    const body = lines.slice(i, Math.min(i + 12, lines.length)).join("\n");
+                    if (!/require\s*\([^)]*address\s*\(\s*0\s*\)|!=\s*address\s*\(\s*0\s*\)/.test(body)) {
+                        out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                    }
+                }
+            });
+            return out;
+        },
+    },
+    {
+        id: "SOL-PUBLIC-MUTATING",
+        severity: "low",
+        title: "Public function with no access modifier (heuristic)",
+        detail: "External functions that mutate state with no onlyOwner/AccessControl modifier may be unintentionally open. Verify intent.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                // function ... public ... { but no onlyOwner / require( msg.sender on next few lines
+                if (/function\s+\w+\s*\([^)]*\)\s+(?:public|external)\s/.test(l)
+                    && !/view|pure/.test(l)
+                    && !/onlyOwner|onlyRole|onlyAdmin|nonReentrant/.test(l)) {
+                    const body = lines.slice(i, Math.min(i + 4, lines.length)).join("\n");
+                    if (!/require\s*\(\s*msg\.sender|onlyOwner|onlyRole|AccessControl/.test(body)) {
+                        out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                    }
+                }
+            });
+            return out;
+        },
+    },
+    {
+        id: "SOL-UNBOUNDED-LOOP",
+        severity: "medium",
+        title: "Loop over array of unbounded length",
+        detail: "for/while loops over arrays that anyone can grow are gas-bomb vectors and DoS risks.",
+        customScan: (lines) => {
+            const out = [];
+            lines.forEach((l, i) => {
+                if (/for\s*\(.*<\s*[a-zA-Z_][a-zA-Z0-9_]*\.length/.test(l)
+                    && !/i\s*<\s*\d+/.test(l)) {
+                    out.push({ line: i + 1, matched: l.trim().slice(0, 200) });
+                }
+            });
+            return out;
+        },
+    },
+    // ─── Info ─────────────────────────────────────────────────────────────────
+    {
+        id: "SOL-NO-EVENTS",
+        severity: "info",
+        title: "State-mutating function may not emit events",
+        detail: "Critical state changes should emit events for off-chain indexers and auditability.",
+        customScan: (lines) => {
+            // Crude heuristic - only flag if zero `emit` statements in entire file
+            const hasEmit = lines.some((l) => /\bemit\s+\w+\s*\(/.test(l));
+            if (hasEmit)
+                return [];
+            // Find first state-changing fn for the report
+            for (let i = 0; i < lines.length; i++) {
+                if (/function\s+\w+\s*\([^)]*\)\s+(?:public|external)\s/.test(lines[i])
+                    && !/view|pure/.test(lines[i])) {
+                    return [{ line: i + 1, matched: lines[i].trim().slice(0, 200) }];
+                }
+            }
+            return [];
+        },
+    },
+    {
+        id: "SOL-NO-LICENSE",
+        severity: "info",
+        title: "Missing SPDX license identifier",
+        detail: "Solidity emits a warning when no SPDX comment is present. Required for clean compile in CI.",
+        customScan: (lines) => {
+            const hasLicense = lines.slice(0, 10).some((l) => /SPDX-License-Identifier:/.test(l));
+            return hasLicense ? [] : [{ line: 1, matched: lines[0]?.trim().slice(0, 200) ?? "(file start)" }];
+        },
+    },
+];
+/**
+ * Run all patterns over a Solidity source string. Returns flat list of
+ * findings sorted by severity (critical first).
+ */
+function staticScanSolidity(source) {
+    const lines = source.split(/\r?\n/);
+    const findings = [];
+    for (const p of PATTERNS) {
+        if (p.regex) {
+            lines.forEach((line, idx) => {
+                const trimmed = line.trim();
+                // Skip pure comment lines
+                if (/^(\/\/|\*|\/\*)/.test(trimmed))
+                    return;
+                if (p.regex.test(line)) {
+                    findings.push({
+                        id: p.id, severity: p.severity, title: p.title, detail: p.detail,
+                        lineHint: idx + 1, matched: line.trim().slice(0, 200),
+                        reference: p.reference,
+                    });
+                }
+            });
+        }
+        else if (p.customScan) {
+            const hits = p.customScan(lines);
+            for (const h of hits) {
+                findings.push({
+                    id: p.id, severity: p.severity, title: p.title, detail: p.detail,
+                    lineHint: h.line, matched: h.matched,
+                    reference: p.reference,
+                });
+            }
+        }
+    }
+    // Dedup: same id + same line = one entry
+    const seen = new Set();
+    const deduped = findings.filter((f) => {
+        const k = `${f.id}:${f.lineHint ?? "0"}`;
+        if (seen.has(k))
+            return false;
+        seen.add(k);
+        return true;
+    });
+    const sevRank = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+    return deduped.sort((a, b) => sevRank[a.severity] - sevRank[b.severity]);
+}
+/**
+ * Format findings as a markdown block to inject into the LLM prompt or
+ * into the final report.
+ */
+function formatFindings(findings) {
+    if (findings.length === 0) {
+        return "_No common antipatterns detected by static scan. This does not mean the contract is safe - subtle issues still need human review._";
+    }
+    const byCat = { critical: [], high: [], medium: [], low: [], info: [] };
+    for (const f of findings)
+        byCat[f.severity].push(f);
+    const sections = [];
+    const labels = {
+        critical: "🚨 CRITICAL", high: "🔴 HIGH", medium: "🟡 MEDIUM", low: "🔵 LOW", info: "ℹ️ INFO",
+    };
+    for (const sev of ["critical", "high", "medium", "low", "info"]) {
+        if (byCat[sev].length === 0)
+            continue;
+        sections.push(`### ${labels[sev]} (${byCat[sev].length})`);
+        for (const f of byCat[sev]) {
+            sections.push([
+                `- **${f.title}** \`${f.id}\``,
+                f.lineHint ? `  - Line ${f.lineHint}: \`${f.matched}\`` : "",
+                `  - ${f.detail}`,
+                f.reference ? `  - Reference: ${f.reference}` : "",
+            ].filter(Boolean).join("\n"));
+        }
+        sections.push("");
+    }
+    return sections.join("\n");
+}
+/**
+ * Mandatory disclaimer appended to every audit report. Sets expectations
+ * so users don't treat the output as a professional audit.
+ */
+exports.AUDIT_DISCLAIMER = `
+---
+
+## ⚠️ Scope of this audit
+
+This report combines:
+1. **Automated static scan** - regex/pattern heuristics flagging common antipatterns (tx.origin, reentrancy patterns, unchecked low-level calls, etc.)
+2. **LLM review over those findings + the contract source** - model-generated analysis, not a formal proof
+
+This is **NOT** a substitute for:
+- A professional security audit (CertiK, Trail of Bits, OpenZeppelin, Spearbit, etc.)
+- Formal verification (Certora, Halmos)
+- Specialized tooling (Slither, Mythril, Echidna, Manticore)
+- Manual review by an experienced Solidity engineer
+
+**Do not deploy contracts holding user funds based on this report alone.** Treat findings as a starting point for human review.
+`;