OpenViSTAI · Agents · Blockchain · Crypto
Submit a project
Menu
Agent Security & Sandboxing

Flounder

Flounder is an open-source TypeScript autonomous security-auditing agent that gives coding agents a sandboxed workflow for preparing targets, analyzing source and supporting material, mapping attack surfaces, constructing exploit paths, running local proof tests and reproducing confirmed findings.

Explore the practical guide ↓

Independent OpenViST project profile, based on linked sources.

Flounder — OpenViST project profile in Agent Security & Sandboxing.
OpenViST project illustration. See the linked sources for product details.
Understand the project

Practical overview

When it fits

Use Flounder when a security review needs agent-led source analysis combined with executable proof rather than a scanner or checklist alone. It is especially relevant when the target can be prepared from public or authorized material and local tests can exercise the suspected path.

Who it is for

  • Smart-contract and Solidity security reviewers
  • Bug-bounty researchers working with authorized targets
  • Teams investigating suspected vulnerabilities in source or on-chain evidence
  • Operators preparing execution-backed vulnerability reports

Documented uses

  • Prepare repositories, source trees, packages, deployed clues or prior runs for audit
  • Map an audit surface and investigate promising code regions
  • Construct exploit paths and run local proof tests
  • Verify suspected findings through execution and reproduce confirmed findings
  • Package reproduced bugs into Markdown reports
Before you choose

Requirements & limits

The repository is public and identified with an AGPL-3.0 license. The documented setup installs a Flounder skill through npx for Codex or Claude Code, or from a local checkout. No pricing or account requirement is specified.

  • Flounder is a workflow around coding agents, not a single-stack scanner or fixed checklist.
  • Execution-grounded findings require a passing local command that exercises the vulnerable path.
  • Discovery commands are network-sealed; confirmation grants egress only to explicit read, fork or fetch commands.
  • The default OCI execution boundary uses a copied workspace and documented restrictions intended to limit host exposure.
  • EVM and Solidity work is a strong fit where local forks and Foundry or Hardhat tests can demonstrate effects.

Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.

Source-based practical guide

Install the Flounder skill for an AI coding agent

Prepare Flounder for use with Codex or Claude Code.

Before you start

  • Node.js package execution through npx
  • Codex or Claude Code, or another supported skills-aware agent
  • Either the GitHub repository reference or a local Flounder checkout

Steps

  1. Install the skill from GitHub with the documented skills command, selecting Flounder for Codex and Claude Code.

  2. If working from a local checkout, install the checked-out skill instead.

  3. Ask the skills-aware agent to audit a repository with Flounder.

Expected outcome

The agent receives the Flounder skill and can trigger the documented audit workflow from a natural-language request.

Guide limitations

  • This recipe documents skill installation and invocation only; it does not establish that an audit will complete successfully.
  • The target should be public-source or authorized, and authorization remains the operator's responsibility.
Documentation 1 ↗
Evidence and transparency

Sources & review

Official repository ↗
Source record details
Source availability
Active
Sources checked
2 October 2026
Original website title
adshao/flounder · Official homepage title · retained in its source language
How we review sourcesSuggest a correction