<p align="center"><img src=".github/assets/solana-ai-kit-banner.png" alt="Solana AI Kit — Skill, MCP & config aggregator for Claude Code, Codex + any agentic setup" width="100%" /></p>

Solana AI Kit

Claude Code, set up to ship on Solana. Not programs alone — the whole lifecycle: validating the idea, building the program and the app around it, shipping it, and the launch and growth work that follows. One command installs 15 specialized agents, 54 workflow commands, skill packs pinned — and scanned — at a commit from the ecosystem's own repositories, 4 MCP servers for on-chain data, live docs and context compression, and a firewall that gates mainnet deploys, secret reads and destructive commands. Almost none of it loads until a task needs it.

curl -fsSL https://aikit.superteam.codes | bash

Run it from your project's root — it installs into the current directory. Everything this README links out to lives in docs/, which stays in this repository and is never copied into yours.

Browse every agent, command and skill pack at [ai.superteam.codes](https://ai.superteam.codes). Each page is also plain Markdown at the same path plus .md, for agents, indexed at /llms.txt.

What This Is

A complete .claude/ configuration that turns Claude into a Solana building partner across that whole lifecycle, not program code alone:

• 15 specialized agents for different tasks (architecture, Anchor, Pinocchio, DeFi, tokens, frontend, mobile, backend, DevOps, QA, docs, games, Unity, learning, research) — full table
• 54 workflow commands for building, testing, deploying, profiling, migrating, committing, and writing the PR, plus an agent workflow with a command per step from intake to merge: /crew chains the steps and stops at your gates, /parallel fans any task out to agents in file-owned lanes, and /adversarial puts a task's key claims to an adversary — full table, how it chains
• 4 MCP servers on by default for on-chain data (Helius), Solana docs (solana-dev), library docs (Context7) and context optimization (context-mode), plus opt-in browser automation (Playwright) and local-validator / mainnet-fork control (Surfpool)
• Four firewall tiers (Off / Relaxed / Medium / High, default Relaxed) gating file access, destructive commands, egress and context-mode's code executor — pick one with /firewall, see Firewall tiers
• The [safe-ai-skill](https://github.com/solanabr/safe-ai-skill) security firewall (core, installed with the kit): hooks that gate mainnet, value-moving and authority actions, in Bash and in MCP tools, hold transfers to spend caps, block secret reads, and pin installed skills and MCPs at session start — details
• Four standard plugins, two steps at the end of the install: memsearch for memory that outlives a session, and rust-analyzer-lsp, typescript-lsp, csharp-lsp so the agent reads your code through a compiler
• Pinned skill packs from Solana Foundation, Colosseum, Jupiter, Metaplex, MagicBlock, Helius, Alchemy, SendAI, Solana Mobile and more — four installed by default (three into ext/, plus Anthropic's own frontend-design and webapp-testing top-level), the rest on demand (skill-packs.md). One extension reports usage: solana-new's SKILL.md files open with a telemetry block that appends each skill run to ~/.superstack/telemetry.jsonl and, once its own setup script has written a Convex endpoint into ~/.superstack/config.json, POSTs the skill name, version, OS and timestamp there. The kit reads that pack's references and does not run those blocks; {"telemetryTier":"off"} in that config file turns both off
• Agent teams (opt-in, experimental) for multi-step workflows (architect → engineer → QA)
• Progressive skill loading that only loads context when needed (saves tokens)
• A small always-on CLAUDE.md carrying only the house rules and workflow a strong model would not infer; everything else is on demand

Installer (recommended)

The installer copies the kit into a project: .claude/ (agents, commands, skills, a settings.json with the permissions, sandbox and hooks, and a security.json naming the firewall tier those rules came from), CLAUDE.md, .mcp.json and .env, then installs the kit's security plugin, safe-ai-skill, with the claude CLI. It downloads the kit's latest release tag from GitHub into a temporary directory, which it deletes when done. It installs into the current directory, so go to your project's root first (replace your-project with its path):

cd your-project

curl -fsSL https://aikit.superteam.codes | bash

aikit.superteam.codes and aikit.superteam.codes/install.sh both redirect to install.sh on main.

Verify before you run it. Same installer, with a review step: download it, read it, then run the copy you read. To check it against a release's published SHA-256 instead, see verify a release installer.

curl -fsSL https://aikit.superteam.codes/install.sh -o /tmp/solana-ai-kit-install.sh

less /tmp/solana-ai-kit-install.sh

bash /tmp/solana-ai-kit-install.sh

When the installer finishes, start Claude Code in the project:

claude

Two things finish the install from inside Claude Code, and both are part of a standard setup rather than extras: [memsearch](#persistent-memory-memsearch), so the project's decisions survive the end of a session, and [the language server plugins](#code-intelligence-language-server-plugins), so the agent reads your code through a compiler instead of grep.

/plugin marketplace add zilliztech/memsearch
/plugin install memsearch
/plugin install rust-analyzer-lsp@claude-plugins-official
/plugin install typescript-lsp@claude-plugins-official
/plugin install csharp-lsp@claude-plugins-official

Take the LSP lines for the languages you actually write — Rust for programs, TypeScript for the client, C# for the Unity/PSG1 track — and install each language server first, since Claude Code offers the plugin once the binary is on your PATH. memsearch needs a restart.

Then /setup-mcp for the Helius API key. Everything past that point is genuinely optional: the opt-in MCP servers and the optional plugins.

Other ways to install

Codex, opencode and anything else that reads AGENTS.md and .agents/skills/ instead of Claude Code's files:

curl -fsSL https://aikit.superteam.codes | bash -s -- --agents

Already installed? /update inside Claude Code pulls the latest release (details, and the shell form). Working in a fork or clone of this repo? Its top-level CLAUDE.md is for maintaining the kit itself; /cleanup swaps in CLAUDE-solana.md.

Config is gitignored by default

To keep your project clean, the installer adds .claude/, .mcp.json, .gitmodules and .safe-ai-skill/ to .gitignore — the kit reads as ignorable infrastructure, not your app code (the ext/ skill packs are ignored too; bash .claude/bin/update.sh re-fetches the core packs and the project's extensions). An --agents install ignores .agents/, .mcp.json and .gitmodules the same way. Neither ignores the instruction file, CLAUDE.md or AGENTS.md, because Grok Build skips an instruction file that .gitignore lists, and /update takes it out of the block an older install wrote. CLAUDE.local.md, for private notes, stays ignored.

Want the config tracked in git (team setup, reproducible config)? Run /commit-claude-config — it un-ignores those files and commits them with the instruction file (or edit .gitignore by hand). If your project already commits .claude/ or its own .gitmodules, the new ignore lines are a no-op — git keeps tracking files it already tracks.

MCP setup

After installation, configure the MCP servers from inside Claude Code in your project:

/setup-mcp

This guides you through the Helius API key and offers the optional MCP servers — including the ones that sign transactions or reach a production database, with what each exposes before you attach it. Beyond the standard plugins above, Anthropic's marketplace has more worth adding and some that collide with the firewall: which ones, and what each costs per session.

We recommend [varlock](https://varlock.dev) for the keys themselves. The install also writes .env.schema, a varlock schema with every key's name, type, purpose and whether it is secret, but no values, so it is safe to commit and safe for the agent to read. varlock load validates .env against it, and varlock run --inject vars -- claude starts Claude Code with the values, which can come from 1Password or another secret manager instead of a plaintext .env. Nothing changes if you skip it: .env.example, .env and /setup-mcp work as before. Setup, what it does not hide from the agent, the preview credential proxy, and the safe-ai-skill policy line older installs need.

Persistent memory: memsearch

Of everything in the standard install, this is the one that changes how the kit feels day to day. A Solana project accumulates context that is expensive to rediscover: which program ID is live on which cluster, the account layout you settled on and the reason you rejected the other one, the approach that failed, the protocol quirk that cost you an afternoon. Without persistent memory every session starts cold — the agent re-derives it, re-asks you, or quietly re-makes a decision you already threw out.

memsearch gives it semantic recall over markdown you own, so the store can grow without the always-on context budget growing with it. That is the opposite trade from putting more in CLAUDE.md, which every session and every subagent pays for whether it is relevant or not. Markdown stays the source of truth, so your memory stays diffable, reviewable and portable.

Nothing leaves your machine: a local Milvus Lite store and an ONNX bge-m3 embedder on CPU, no key and no account. Setup costs a ~558 MB model download on first launch and one restart; per session it costs four hooks and ~400 tokens of skill descriptions, plus the recent-memory preview its SessionStart hook injects — the measured breakdown.

/plugin marketplace add zilliztech/memsearch
/plugin install memsearch

It is a plugin, not an MCP server. memsearch-mcp was never published to npm, so an .mcp.json entry for it silently never starts — /doctor flags that entry if an older install still carries one, and /update removes it. Its recall skill runs at Off and Relaxed, the default; at Medium and High its set-up line meets the bash -c deny and recall stops (why).

Code intelligence: language server plugins

The other half of the standard install. Without a language server the agent navigates your code by reading files and matching text; with one it asks the compiler — go-to-definition, find-all-references, the real type of a value, the diagnostics your editor shows. On a Solana project that is three servers for three languages: Rust for the programs, TypeScript for the client and frontend, C# for the Unity/PSG1 track.

/plugin install rust-analyzer-lsp@claude-plugins-official
/plugin install typescript-lsp@claude-plugins-official
/plugin install csharp-lsp@claude-plugins-official

Install the language server itself first — rustup component add rust-analyzer, npm i -g typescript typescript-language-server, and a C# server such as csharp-ls — and Claude Code then offers the matching plugin once the binary is on your PATH. Install only the ones whose language you write.

These are the cheapest additions in the kit: no hook, nothing registered in the session listing, so the standing context cost is about zero and an idle one is free. Skip a language and you simply skip its plugin.

Security firewall: safe-ai-skill

safe-ai-skill is a core part of the kit. It is a Claude Code plugin whose hooks gate mainnet, value-moving and authority actions, hold transfers to per-transaction and daily spend caps, block reads of keypairs and .env, and pin installed skills and MCPs at session start. Its gates also cover MCP tools, such as Helius's heliusWrite transfers, which the kit's own hooks do not see. The kit's stbr marketplace lists it next to the kit plugin, pinned to a specific commit.

• Plugin install: solana-ai-kit@stbr depends on safe-ai-skill@stbr, so installing the kit installs it.
• Full install: .claude/settings.json enables safe-ai-skill@stbr, but Claude Code installs a plugin from an external source only when each user runs the install, so install.sh runs claude plugin install safe-ai-skill@stbr --scope project for you, registering the stbr marketplace first when needed. --no-safe-ai-skill skips it, and so does a missing claude CLI or a platform with no engine build; the closing message then prints the command. Someone who clones a project that commits the kit config runs that command once. When SOLANA_AI_KIT_UPSTREAM points at a fork, the fork's marketplace is the one registered as stbr on that machine. /doctor reports whether it is installed.
• `--agents` install (Codex, opencode): the hooks are Claude Code only. Vet add-ons with the CLI instead: npx @stbr/safe-ai-skill add skill|mcp <source>.

Its engine ships prebuilt for macOS and glibc Linux (x64, arm64) and fails closed elsewhere, such as native Windows, where it blocks every tool call (solanabr/safe-ai-skill#6). The installer skips it there. The plugin install cannot: Claude Code refuses to disable a plugin while an enabled plugin depends on it, so on Windows use the full install. To turn it off for yourself in a full install, set "safe-ai-skill@stbr": false under enabledPlugins in .claude/settings.local.json.

Project policy. The full install writes .safe-ai-skill/policy.yaml, which safe-ai-skill deep-merges over its default policy. It sets two keys. supply_chain.verify_skills_dirs: [".claude/skills"] makes the session-start check cover this project's skills and no longer sweep your personal ~/.claude/skills. secrets.allow_read_globs: ["**/.env.example", "**/.env.schema"] lets the agent read the varlock schema, which the default's **/.env.* deny would otherwise block. While safe-ai-skill is on it refuses .env and its variants to the file tools and to cat-style reads at every firewall tier, which is stricter than the tiers' own .env rules; making the project's .env follow the tier is solanabr/safe-ai-skill#16. install.sh writes the file, and /update adds it when missing and refreshes it while it is still an unedited copy the kit shipped. Once you edit it, it is yours and /update leaves it alone. The firewall denies the agent edits to it at every tier — unlike .claude/settings.json, which only High protects: this file is a third-party security tool's policy rather than part of the installation you customize. It is gitignored with the rest of the kit config; run /commit-claude-config so teammates who clone the repo get it too.

The policy leaves verify_ext_submodules at its default, true, so each ext/ pack is checked on its own. Setting it to false would scan all of ext/ as one skill, and one finding would quarantine every pack. The check's heuristics are plain substring matches, so a pack whose docs mention a keypair path (the core solana-dev pack does) can still be quarantined at session start. That needs an upstream fix (solanabr/safe-ai-skill#5).

Firewall tiers

One tier is in force per project. .claude/security.json names it; /firewall (or /firewall <tier>) switches it and rewrites the kit-owned rules in .claude/settings.json to match. The default is Relaxed. A switch takes effect in the next session: permission and sandbox rules are read once at session start, so the session you are in keeps the rules it started with, whether the change was a tightening or a loosening.

The hooks also gate context-mode's MCP tools at every tier, and Medium and High refuse its code executor and arbitrary-path reader outright — a local MCP server runs outside the OS sandbox, so the two stricter tiers cannot keep their read and egress promises while it is callable. Those two tiers also refuse Playwright's browser_run_code_unsafe and browser_network_request, and High alone refuses the opt-in Cloudflare server's execute and Playwright's browser_evaluate — keeping Cloudflare's read-only docs and search, and Playwright's browser_navigate, browser_snapshot, clicking and typing, at every tier. Details.

High is also the only tier that stops the agent editing the kit's own configuration — .claude/settings.json, .claude/security.json, .mcp.json and the user-scope equivalents under ~/.claude/. Off, Relaxed and Medium allow it, on the view that customizing your own installation is your call. The guard hooks are the exception and are denied at every tier, Off included: .claude/hooks/ holds the mainnet, secrets and on-chain gates as executable scripts, and /firewall already changes every tier knob without touching them, so customizing never means editing a guard. So below High you own your .claude/ configuration, not the guards. A nested claude started with a policy-weakening flag (--dangerously-skip-permissions, --settings, --permission-mode and the like), an organization's managed settings and safe-ai-skill's policy are also denied at every tier. Details.

Which gate stops what, how a tier is generated, and — at length — what the tiers do not do: docs/firewall.md. Short version: High and Medium are interactive-only, an allowlist is not something the kit can enforce, an MCP server runs outside the sandbox so only the hooks reach it (and at Medium and High context-mode's executor and Playwright's two arbitrary primitives are refused outright, at High Cloudflare's execute and Playwright's browser_evaluate too), what Relaxed leaves readable is readable by every process the agent runs, not only by the tool it is for — gh's host file included, which only Claude Code's Read and Grep tools are refused — at Off and Relaxed a skill's set-up line may run bash -c, and the tier is not immune to the agent. safe-ai-skill, when on, also refuses .env and its variants to the file tools and cat-style reads at every tier; grep, awk and inline interpreters pass it.

Full documentation

docs/ is the kit's full spec. It is not copied into your project.

QUICK-START.md is the two-minute version with usage examples per task. FIREWALL-SPEC.md is the verified spec behind the tiers.

License

MIT - See LICENSE

Disclaimer

No warranty, and no liability. This software is provided "as is", without warranty of any kind, express or implied, including without limitation the warranties of merchantability, fitness for a particular purpose and non-infringement. To the fullest extent permitted by applicable law, Superteam Brazil, its members and the contributors to this repository accept no liability for any claim, loss or damage — direct, indirect, incidental, special, consequential or exemplary, including loss of funds, keys, data, profits or goodwill — arising from or in connection with this software or its use, whether in contract, tort, negligence or otherwise, and whether or not advised of the possibility of such damage. You install and run it on your own systems, against your own keys, accounts and funds, and every action it helps you take remains your decision and your responsibility. Review what it does before you run it, especially anything that touches mainnet or moves value.

What this repository contains, and what it does not. This is a configuration layer and an index. It contains Superteam Brazil's own work — the agents, commands, skills, rules, hooks and settings written here — together with references to third-party projects. Those third-party projects are identified by their canonical repository URL and a recorded commit, and they are retrieved directly from their own publishers at install time, by the same public mechanisms any user would use unaided: git submodule, git clone, npx, or a first-party plugin marketplace. Third-party code is not rehosted, mirrored, bundled, modified or redistributed by this repository, and none of it is served from here. Removing a reference removes nothing but the reference.

Ownership, attribution and independence. Every referenced project remains the property of its own authors and is governed exclusively by the terms its authors attach to it, which travel with the project when it is retrieved. Nothing here asserts ownership of, or claims credit for, any third-party work, and no part of the wider stack is presented as this project's own. Inclusion is not endorsement in either direction: no affiliation with, sponsorship by, or approval from any referenced project, protocol, company or foundation is claimed or implied. Product names, trademarks and logos belong to their respective owners and appear only to identify the software they refer to, as nominative reference.

No charge. This repository is distributed free of charge. Nothing in it is sold, rented, licensed for a fee or placed behind a paywall, no payment is solicited or accepted for access to it, and no revenue is derived from the third-party projects it references.

Maintainer requests. If you maintain a project referenced here and would like the reference amended, attributed differently, or removed, open an issue in this repository and it will be actioned.