Chonky is a VS Code extension that transforms GitHub Copilot into a specialized smart contract security auditing agent.

VS Code Marketplace:

• tintinweb.chonky
• #> ext tintinweb.chonky

TLDR;

• Agent Augmented Auditing
• Automated Scoping
• Automated In-Depth Security Analysis
• Agentic Tooling for Deep Smart Contract Insights
• Extending Agent capabilities with General Purpose LLM Tooling
• Your Smart Contract Auditing Side-Kick!

Extends GitHub/Copilot Model Capabilities

Open Copilot Chat → switch to Agent mode → Ask the agent

// list availabler tools
List chonky available llm tools

Use Agent mode for day-to-day use. The agent will decide when to invoke any of Chonky's tools. Use the @chonky chat participant for specialized operations.

Generate comprehensive project scoping reports

Run comprehensive automated security analysis

**@chonky** #autoaudit Full security scan

Specialized chat modes for different audit phases

Explore all available features for your tier

Pre-prompt your action with our agentic security auditor template.

Sponsor and get Early Access to experimental future features 😊. Ping me if you run into any problems 🤗.

Ready-to-go Scoping/Auditing workflows, easy to extend and customize.

**@chonky** ...

Get access to our curated list of Solidity security primers to augment and automate your security auditing.

**@chonky** ...

• 🔧 Improved .chonky Directory Discovery
• 📁 Flexible File Placement Support

• ▸ Fixed discovery of files in .chonky root directory (e.g., .chonky/xxx.workflow.md)
• ▸ Simplified validation logic for better file placement flexibility
• ▸ Enhanced workspace resource detection

• 📁 Auto-Discovery of .chonky Workspace Folders
• 🎯 Repository Filtering with repositoryId
• 🔍 Pattern-Based Resource Discovery
• 📊 Enhanced Discovery Output

• ▸ Automatic workspace .chonky folder detection for project-specific security resources
• ▸ Repository filtering for targeted primer/workflow discovery
• ▸ Flexible file extension matching (*.primer.md, .workflow.md, tools/.yml)
• ▸ Repository information display in discovery results

• ▸ Better project-specific security resource management
• ▸ Enhanced filtering capabilities for large repositories
• ▸ More intuitive workspace-based resource organization

• 🎨 Enhanced Visual Code Annotation System
• 🎯 Accurate Line Targeting with Code Validation
• 🛡️ Advanced Security-Focused Decorations
• ✨ Custom Styling with Full Validation

• 🚀 Advanced Security Analysis Features
• 🛡️ Enhanced AI-Powered Vulnerability Detection
• ⚡ Improved Tier-Based Feature Access

• ▸ Security primer discovery and loading system
• ▸ Workflow repository with pre-built analysis templates
• ▸ Tool configuration repository access
• ▸ Interactive Solidity REPL (Chisel) integration
• ▸ Comprehensive differential analysis orchestrator
• ▸ AI-powered function similarity detection
• ▸ Advanced vulnerability database search
• ▸ MetaMask Snap security analysis
• ▸ Multi-language scoping (Go, Rust, Solidity)
• ▸ Etherscan and Sourcify integration
• ▸ Semgrep static analysis integration

• ▸ Faster contract analysis
• ▸ Improved tooltip experience
• ▸ Enhanced sponsorship integration

Available to everyone

Available earlier to sponsors

💡 Support development to get early access - Become a Sponsor

For security teams and researchers

🚀 Professional tools for advanced security research - Upgrade to Professional

1. Install the Extension: Search for "Chonky" in VS Code Extensions
2. Start Chatting: Use @chonky in any chat window (ask Mode)
3. Discover Tools: Switch to Copilot Agentic Mode, ask about Chonky's available tools in natural language
4. Scope Your Project: In Agentic or Scoping Mode, ask to scope the project

Chonky supports specialized chat modes for different agentic workflows:

• Scoping - Project scoping and analysis
• Audit - Security auditing workflows

• 🔒 Security Analysis: Access control, reentrancy, external calls, oracle analysis
• 🏗️ Contract Structure: Structure analysis, imports, inheritance, flattening
• 📊 Code Quality: Events, ERC compliance, functions, invariants
• 🌐 External Services: Etherscan, Sourcify, vulnerability databases
• 🛠️ Utilities: Surya graphs, Solhint, scoping, memory store

• Comprehensive vulnerability detection
• Automated pattern analysis
• AI-assisted code review
• Integration with external databases

• Project scoping and metrics
• Code quality assurance
• ERC standard compliance
• Continuous security monitoring

• Advanced vulnerability research
• Pattern similarity detection
• Multi-language analysis
• Custom primer development

1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X)
3. Search for "Chonky"
4. Click Install

1. Download the latest .vsix file from releases
2. Open VS Code
3. Run Extensions: Install from VSIX...
4. Select the downloaded file

We welcome contributions! Here's how you can help:

1. Report Bugs: Open an issue with detailed information
2. Feature Requests: Suggest new features or improvements
3. Documentation: Help improve our docs
4. Sponsorship: Support development through GitHub Sponsors

git clone https://github.com/tintinweb/vscode-chonky.git
cd chonky
npm install
npm run compile

Chonky is developed and maintained by passionate security researchers. Your support helps us:

• 🔬 Research new vulnerabilities
• 🛠️ Develop advanced tools
• 📚 Create educational content
• 🌍 Keep tools free for everyone

• 🔹 Base: Core features for everyone
• 🔸 Early Access (see Sponsor page): Early access to new features
• ⚡ Professional (contact me): Advanced research tools

Created by tintinweb - Security researcher and smart contract auditor with 7+ years in Blockchain security.

• GitHub Issues: Report bugs and request features
• Twitter: @tintinweb
• Website: Visit our website