Silas Code Inspector is a multi-language static security scanner designed to find vulnerabilities in TON blockchain smart contracts (Tact & FunC), as well as Go, Docker, and Web codebases. Over 90 security patterns, adaptive learning, JSON/SARIF export, and ready for CI/CD.

• ⚡ 90+ patterns for TON – 45 for Tact, 45 for FunC (replay, race condition, cell depth, impure, etc.)
• 🧠 Adaptive learning – pattern weights adjust via feedback (.silas-state.json)
• 📦 Go dependency CVE scanner – Check your go.mod against known CVEs
• 🐳 Docker & Web scanners – hardcoded secrets, XSS, CSRF, root user, CVE check
• 🌈 Colored terminal output + JSON / SARIF export (GitHub Code Scanning)
• 🧹 Comment filtering and only meaningful receive analysed – low noise
• 📊 Summary mode (--summary) for quick overview
• 🔌 CLI-first, ready for CI/CD and future APIs
• ⚙️ GitHub Actions – automatically scans your code on every push and PR

• Go 1.22+ installed
• Git

go install github.com/silasdev78/silas-code-inspector/cmd/silas@latest

git clone https://github.com/silasdev78/silas-code-inspector.git
cd silas-code-inspector
make build
./silas --help

silas contract.tact

silas ./my-ton-project/

silas --lang func wallet.fc

# JSON for further processing
silas --output json ./src > report.json

# SARIF for GitHub Code Scanning
silas --output sarif ./src > results.sarif

# Summary (only counts per severity and pattern)
silas --summary ./contracts/

silas --learner ./contracts/

Weights are stored in .silas-state.json and updated based on your manual feedback.

✗ contract.tact: 9 issues found.
  • Missing seqno check
    Severity: CRITICAL | Line: 4
    Code: receive(msg: Message) {
    Fix: Add require(self.seqno == msg.seqno) inside receive().

  • Unprotected selfdestruct
    Severity: CRITICAL | Line: 7
    Code: selfdestruct();
    Fix: Wrap selfdestruct in a require with owner check.
...

---

This repository includes a workflow (.github/workflows/silas.yml) that:

• Builds the scanner
• Runs it on the entire codebase (SARIF output)
• Uploads the results to GitHub Code Scanning

To enable it, simply fork the repo and push to main. The action runs automatically on every push and pull request.

silas-code-inspector/
├── cmd/silas/               # Cobra CLI entry point
├── internal/
│   ├── domain/              # Issue, Pattern, Severity models
│   ├── engine/              # Scanner factory + per‑language scanners
│   │   ├── tact/
│   │   ├── func/
│   │   ├── golang/
│   │   ├── docker/
│   │   ├── web/
│   │   └── gomod/
│   ├── knowledge/           # Pattern databases (45 Tact + 45 FunC + Go + Docker + Web + CVE)
│   ├── report/              # JSON, SARIF, text formatters
│   └── learner/             # Adaptive learning engine
├── .github/workflows/       # GitHub Actions
├── Makefile
└── go.mod

---

Contributions are welcome! Here's how you can help:

1. Fork the repository.
2. Create a feature branch (git checkout -b feat/my-feature).
3. Commit your changes (git commit -m 'feat: add something').
4. Push to your fork (git push origin feat/my-feature).
5. Open a Pull Request.

Please write tests for new scanners and keep the code idiomatic.
Check the good first issue tags for easy tasks.

This project is licensed under the MIT License – see the LICENSE file for details.
You are free to use, modify, and distribute this software, even commercially.

• Phase 1: TON scanner + CLI
• Phase 2: Go, Docker, Web scanners
• Phase 3: CVE feed, SARIF, adaptive learner, CI/CD
• Phase 3.5: FunC support (45 patterns), comment filtering, summary mode
• Phase 4: Telegram bot + TON payments (Pro)
• Phase 5: AST‑based analysis for race conditions & reentrancy
• Phase 6: Solidity / Rust (Solana) support
• Phase 7: LSP server for IDE integration

Built with ❤️ by silasdev78