Slither/Static-Analysis Gate Enforcer in CI

WHAT IT DOES

This tool connects to your EVM wallet and enforces security gates from Slither static analysis reports in CI/CD pipelines. It reads Slither JSON output and validates findings against configurable severity thresholds. The tool identifies violations at the specified severity level (High, Medium, Low, or All), providing a clear pass/fail status that can be used to gate contract deployments or pull request merges. It displays detailed findings with severity, name, description, and confidence level.

HOW TO USE

Connect your Web3 wallet using the Connect button. Paste your Slither report JSON in the Slither Report field. Select the severity threshold from the dropdown—High only, Medium and above, Low and above, or All severities. Click "Enforce Gates" to analyze the report against the threshold. Click "Load Sample Report" to populate fields with an example Slither output. Results appear in the Results card with a summary of total findings, violations, and gate status (PASS or FAIL), followed by a detailed list of violations with severity, name, description, and confidence.

TECHNICAL MECHANISM: SLITHER REPORT PARSING AND SEVERITY FILTERING

The tool parses Slither JSON reports by detecting the detectors array from various report structures (results.detectors, detectors, or top-level arrays). For each detector finding, it extracts the severity (or impact), name, description, and confidence level. The tool uses a severity order mapping (Low=1, Medium=2, High=3) to filter findings based on the configured threshold. Findings with severity below the threshold are ignored, while those at or above are counted as violations. The gate status is determined by the presence of any violations—PASS if none, FAIL otherwise. The tool supports custom report formats by attempting to locate detector arrays across common JSON structures.

WHAT IT CANNOT SEE

This tool cannot execute Slither analysis itself—it requires pre-generated Slither reports. It cannot enforce rules that require dynamic analysis or runtime context—the tool only processes static analysis results. It cannot interpret the business logic impact of reported issues—the tool treats all findings equally based on severity. It relies on external Slither reports and may not support all rule formats—the tool expects standard Slither JSON output. It cannot automatically fix or remediate identified issues—the tool only reports violations. It cannot guarantee that all vulnerabilities are detected by the analysis—the tool is only as good as the Slither analysis.

PLEASE NOTE

This is a read-only tool—it never signs transactions. All data is processed in-memory and never persists. The tool supports EVM chains only—Ethereum, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, and Fantom. Slither is a powerful static analysis tool—always run Slither on your contracts before deployment. The severity threshold should be configured based on your project's security requirements. A FAIL status indicates findings at the configured severity level—review and address these findings before proceeding.