solana-helius-rpc — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited solana-helius-rpc (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Helius is the dominant production RPC provider on Solana. Beyond standard JSON-RPC (getBalance, sendTransaction, etc.), Helius layers on a set of APIs that the base Agave validator does not expose: the DAS API (one unified query surface for NFTs, compressed NFTs, and SPL tokens), enhanced transaction parsing (human-readable swap/transfer/mint events), real-time webhooks (push deliveries when watched accounts move), and getPriorityFeeEstimate (the de-facto way to size compute-unit-price on mainnet). If you are building anything beyond a toy, you will almost certainly call at least two of these.
getPriorityFeeEstimate.getTokenAccountsByOwner).fetch).npm install helius-sdk@^2.2.2 — typed client, namespaces for webhooks, enhanced, tx, ws, etc. Built on @solana/kit (the v1.x line used @solana/web3.js).fetch against the JSON-RPC endpoint — no dependencies, works in Cloudflare Workers / Deno / Bun without polyfills.localhost.Sign in at https://dashboard.helius.dev, create a project, copy the API key. Mainnet and devnet share the same key — you switch by changing the endpoint hostname, not the key.
Mainnet: https://mainnet.helius-rpc.com/?api-key=YOUR_KEY
Devnet: https://devnet.helius-rpc.com/?api-key=YOUR_KEY
# Dedicated staked-connection endpoint (Pro+) for higher landing rate on sendTransaction:
Staked: https://staked.helius-rpc.com/?api-key=YOUR_KEYThe endpoint accepts every standard Solana JSON-RPC method plus Helius extensions. Drop it into @solana/web3.js new Connection(url) or @solana/kit createSolanaRpc(url) unchanged.
DAS unifies regular NFTs, compressed NFTs, and (with showFungible: true) SPL tokens behind one method family on the standard RPC endpoint. The most useful methods:
getAssetsByOwner — every asset a wallet owns, paginated.getAsset — one asset by mint or cNFT ID.getAssetsByGroup — every asset in a collection (groupKey: "collection").searchAssets — flexible filter (creator, royalty, jsonUri, etc.).Pagination is 1-indexed page numbers, max limit: 1000. Loop until items.length < limit. See scripts/get-assets.ts.
Create a webhook with the REST API or helius.webhooks.createWebhook(...). Key fields:
webhookURL — your HTTPS endpoint (must return 200 within 1s).webhookType — "enhanced" (Helius parses to a typed event) or "raw" (full Solana tx). enhancedDevnet / rawDevnet for devnet. Enhanced webhooks drop failed transactions; raw webhooks include both.accountAddresses — up to 100,000 addresses to watch.transactionTypes — filter to specific parsed types (SWAP, NFT_SALE, TRANSFER, ..., or ANY). Only meaningful for enhanced.authHeader — a secret string. Helius echoes this value back in the Authorization header of every webhook POST. Your handler must compare it before processing.The handler must:
Authorization header equals the authHeader you registered.200 within 1 second (Helius timeout). Do heavy work async — push onto a queue, then respond.signature.See scripts/webhook-handler.ts (Cloudflare Worker).
For backfill / one-shot parsing (not push), POST signatures to:
POST https://api-mainnet.helius-rpc.com/v0/transactions
Body: { "transactions": ["sig1", "sig2", ...] } // up to 100 per callSame shape as the enhanced-webhook payload — description, type, source, nativeTransfers, tokenTransfers, events, accountData, etc. Useful for catching up after webhook downtime.
getPriorityFeeEstimate returns a recommended `microLamports` value for ComputeBudgetProgram.setComputeUnitPrice. Call it with either:
accountKeys: [pubkey, ...] — the writable accounts your tx touches, ortransaction: <base58-or-base64 serialized tx> — Helius will extract accounts itself.Pass options.recommended: true for a single-number answer, or options.includeAllPriorityFeeLevels: true to get the full { min, low, medium, high, veryHigh, unsafeMax } histogram. See scripts/priority-fee.ts.
Each webhook delivery costs 1 credit regardless of whether your endpoint succeeds. DAS calls cost more credits than vanilla RPC. Check the live pricing page before relying on these numbers.
devnet.helius-rpc.com will give you a confusing "blockhash not found" because the blockhash you fetched is from the other cluster. Always read your endpoint string back to yourself.event.waitUntil() to defer work past the response.getAssetsByOwner caps at limit: 1000. A whale wallet with 10k NFTs returns only the first 1k unless you loop page: 1, 2, 3, .... Stop when items.length < limit.ComputeBudgetProgram.setComputeUnitPrice({ microLamports }). Multiplying by 1e6 is a common and very expensive mistake.getSignaturesForAddress + the enhanced transactions parser API (step 6) over your watched accounts since the last processed slot.webhookType: "raw" (or check transactionError field).See scripts/get-assets.ts, scripts/webhook-handler.ts, scripts/priority-fee.ts.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.