1 line
422 KiB
JSON
1 line
422 KiB
JSON
{"repo": "bradmoonuestc/finite-monkey-engine", "files": {"README.md": {"492c61c0263133162963b169e0a6cf2eb600469e": {"t": 1785674071.2676451, "n": 13523, "h": "a6d2bca1d452b281", "c": "# Finite Monkey Engine v3.0\n\nSecurity analysis pipeline for code auditing: **Planning → Reasoning → Validation**. \nResults are persisted to PostgreSQL and can be exported as reports.\n\n## v3.0 Updates\n\n- **Planning**: removes RAG / chunks / call graph / call tree. Keeps tree-sitter function parsing and uses Codex CLI to extract business flows (Gi/Fi). Tasks persisted as **Fi × checklist (rule_key)**.\n- **Reasoning**: switches the main scan execution to **Codex CLI** (input: `business_flow_code + prompt`). Output remains the original **multi-vulnerability JSON**, then split into `project_finding` (unchanged downstream logic).\n- **Validation**: Codex-based confirmation for `project_finding` and write-back to `validation_status` / `validation_record`.\n- **Workspace restriction**: Codex always runs with `--cd <project_root>` derived from `src/dataset/agent-v1-c4/datasets.json[project_id].path`.\n- **Design docs**: moved into `docs/`.\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (required for storing analysis results)\n- **AI API Keys** (supports OpenAI, Claude, DeepSeek, and other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Initialize database\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. Configure project dataset\n# Edit src/dataset/agent-v1-c4/datasets.json to add your project configuration\n\n# 6. Run analysis\npython src/main.py\n```\n\n## 📊 Usage Guide\n\n### Database Initialization\n\nInitialize PostgreSQL database using the provided SQL file:\n\n```bash\n# Connect to PostgreSQL database\npsql -U postgres -d postgres\n\n# Execute SQL file to create table structure\n\\i project_task.sql\n\n# Or use command line directly\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### Project Configuration\n\nConfigure your project in `src/dataset/agent-v1-c4/datasets.json`:\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //no need to set, disable in future\n \"functions\": [], //no need to set, disable in future\n \"exclude_in_planning\": \"false\", //no need to set to true, disable in future\n \"exclude_directory\": [] //no need to set, disable in future\n }\n}\n```\n\n### Running Analysis\n\n1. **Set Project ID**: Configure your project ID in `src/main.py`\n```python\nproject_id = 'your_project_id'\n```\n\n2. **Execute Analysis**:\n```bash\npython src/main.py\n```\n\n3. **View Results**: \n - Detailed analysis records in database\n - `output.xlsx` report file\n - Mermaid business flow diagrams (if enabled)\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex (Required for v3.0 planning/reasoning/validation)\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# Legacy model config (still used by some auxiliary flows)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"sk-xxxxxx\" # API key\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode: Common project checklist fine-grained\n# Available modes: PURE_SCAN (Pure scanning)\nSCAN_MODE_AVA=False # Advanced scan mode features\nCOMPLEXITY_ANALYSIS_ENABLED=True # Enable complexity analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Maximum threads for scanning phase\nMAX_THREADS_OF_CONFIRMATION=50 # Maximum threads for confirmation phase\nBUSINESS_FLOW_COUNT=4 # Business flow repeat count (hallucination triggers)\n\n# Advanced Feature Configuration\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # Folders to ignore\n\n# Checklist Configuration\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # Path to checklist file\nCHECKLIST_SHEET=Sheet1 # Checklist worksheet name\n\n# Run control (v3.0)\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true: stop after planning (before reasoning)\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### AI Model Configuration Details\n\nBased on actual configuration in `src/openai_api/model_config.json`:\n\n**WARNING** must set the model name based on your llm hub!\n**WARNING** must set the model name based on your llm hub!\n**WARNING** like in openrouter, sonnet 4 need to set to anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 Cost Optimized\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "2a6f2fa0dc8294c662cc11d376360ea1e4f0c55b": {"t": 1785764467.1961713, "n": 13523, "h": "a6d2bca1d452b281", "c": "# Finite Monkey Engine v3.0\n\nSecurity analysis pipeline for code auditing: **Planning → Reasoning → Validation**. \nResults are persisted to PostgreSQL and can be exported as reports.\n\n## v3.0 Updates\n\n- **Planning**: removes RAG / chunks / call graph / call tree. Keeps tree-sitter function parsing and uses Codex CLI to extract business flows (Gi/Fi). Tasks persisted as **Fi × checklist (rule_key)**.\n- **Reasoning**: switches the main scan execution to **Codex CLI** (input: `business_flow_code + prompt`). Output remains the original **multi-vulnerability JSON**, then split into `project_finding` (unchanged downstream logic).\n- **Validation**: Codex-based confirmation for `project_finding` and write-back to `validation_status` / `validation_record`.\n- **Workspace restriction**: Codex always runs with `--cd <project_root>` derived from `src/dataset/agent-v1-c4/datasets.json[project_id].path`.\n- **Design docs**: moved into `docs/`.\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (required for storing analysis results)\n- **AI API Keys** (supports OpenAI, Claude, DeepSeek, and other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Initialize database\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. Configure project dataset\n# Edit src/dataset/agent-v1-c4/datasets.json to add your project configuration\n\n# 6. Run analysis\npython src/main.py\n```\n\n## 📊 Usage Guide\n\n### Database Initialization\n\nInitialize PostgreSQL database using the provided SQL file:\n\n```bash\n# Connect to PostgreSQL database\npsql -U postgres -d postgres\n\n# Execute SQL file to create table structure\n\\i project_task.sql\n\n# Or use command line directly\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### Project Configuration\n\nConfigure your project in `src/dataset/agent-v1-c4/datasets.json`:\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //no need to set, disable in future\n \"functions\": [], //no need to set, disable in future\n \"exclude_in_planning\": \"false\", //no need to set to true, disable in future\n \"exclude_directory\": [] //no need to set, disable in future\n }\n}\n```\n\n### Running Analysis\n\n1. **Set Project ID**: Configure your project ID in `src/main.py`\n```python\nproject_id = 'your_project_id'\n```\n\n2. **Execute Analysis**:\n```bash\npython src/main.py\n```\n\n3. **View Results**: \n - Detailed analysis records in database\n - `output.xlsx` report file\n - Mermaid business flow diagrams (if enabled)\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex (Required for v3.0 planning/reasoning/validation)\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# Legacy model config (still used by some auxiliary flows)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"sk-xxxxxx\" # API key\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode: Common project checklist fine-grained\n# Available modes: PURE_SCAN (Pure scanning)\nSCAN_MODE_AVA=False # Advanced scan mode features\nCOMPLEXITY_ANALYSIS_ENABLED=True # Enable complexity analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Maximum threads for scanning phase\nMAX_THREADS_OF_CONFIRMATION=50 # Maximum threads for confirmation phase\nBUSINESS_FLOW_COUNT=4 # Business flow repeat count (hallucination triggers)\n\n# Advanced Feature Configuration\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # Folders to ignore\n\n# Checklist Configuration\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # Path to checklist file\nCHECKLIST_SHEET=Sheet1 # Checklist worksheet name\n\n# Run control (v3.0)\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true: stop after planning (before reasoning)\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### AI Model Configuration Details\n\nBased on actual configuration in `src/openai_api/model_config.json`:\n\n**WARNING** must set the model name based on your llm hub!\n**WARNING** must set the model name based on your llm hub!\n**WARNING** like in openrouter, sonnet 4 need to set to anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 Cost Optimized\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "455c1e0a4aa789e4b8e64e4091e36e92d12fa88b": {"t": 1785764469.213197, "n": 13533, "h": "806b0635ca37e3c2", "c": "# Finite Monkey Engine v3.0\n\nSecurity analysis pipeline for code auditing: **Planning → Reasoning → Validation**. \nResults are persisted to PostgreSQL and can be exported as reports.\n\n## v3.0 Updates (Concise)\n\n- **Planning**: removes RAG / chunks / call graph / call tree. Keeps tree-sitter function parsing and uses Codex CLI to extract business flows (Gi/Fi). Tasks persisted as **Fi × checklist (rule_key)**.\n- **Reasoning**: switches the main scan execution to **Codex CLI** (input: `business_flow_code + prompt`). Output remains the original **multi-vulnerability JSON**, then split into `project_finding` (unchanged downstream logic).\n- **Validation**: Codex-based confirmation for `project_finding` and write-back to `validation_status` / `validation_record`.\n- **Workspace restriction**: Codex always runs with `--cd <project_root>` derived from `src/dataset/agent-v1-c4/datasets.json[project_id].path`.\n- **Design docs**: moved into `docs/`.\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (required for storing analysis results)\n- **AI API Keys** (supports OpenAI, Claude, DeepSeek, and other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Initialize database\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. Configure project dataset\n# Edit src/dataset/agent-v1-c4/datasets.json to add your project configuration\n\n# 6. Run analysis\npython src/main.py\n```\n\n## 📊 Usage Guide\n\n### Database Initialization\n\nInitialize PostgreSQL database using the provided SQL file:\n\n```bash\n# Connect to PostgreSQL database\npsql -U postgres -d postgres\n\n# Execute SQL file to create table structure\n\\i project_task.sql\n\n# Or use command line directly\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### Project Configuration\n\nConfigure your project in `src/dataset/agent-v1-c4/datasets.json`:\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //no need to set, disable in future\n \"functions\": [], //no need to set, disable in future\n \"exclude_in_planning\": \"false\", //no need to set to true, disable in future\n \"exclude_directory\": [] //no need to set, disable in future\n }\n}\n```\n\n### Running Analysis\n\n1. **Set Project ID**: Configure your project ID in `src/main.py`\n```python\nproject_id = 'your_project_id'\n```\n\n2. **Execute Analysis**:\n```bash\npython src/main.py\n```\n\n3. **View Results**: \n - Detailed analysis records in database\n - `output.xlsx` report file\n - Mermaid business flow diagrams (if enabled)\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex (Required for v3.0 planning/reasoning/validation)\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# Legacy model config (still used by some auxiliary flows)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"sk-xxxxxx\" # API key\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode: Common project checklist fine-grained\n# Available modes: PURE_SCAN (Pure scanning)\nSCAN_MODE_AVA=False # Advanced scan mode features\nCOMPLEXITY_ANALYSIS_ENABLED=True # Enable complexity analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Maximum threads for scanning phase\nMAX_THREADS_OF_CONFIRMATION=50 # Maximum threads for confirmation phase\nBUSINESS_FLOW_COUNT=4 # Business flow repeat count (hallucination triggers)\n\n# Advanced Feature Configuration\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # Folders to ignore\n\n# Checklist Configuration\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # Path to checklist file\nCHECKLIST_SHEET=Sheet1 # Checklist worksheet name\n\n# Run control (v3.0)\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true: stop after planning (before reasoning)\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### AI Model Configuration Details\n\nBased on actual configuration in `src/openai_api/model_config.json`:\n\n**WARNING** must set the model name based on your llm hub!\n**WARNING** must set the model name based on your llm hub!\n**WARNING** like in openrouter, sonnet 4 need to set to anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 Cost Optimized\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "4f833f23960723af2ea91ab3d0a4d0029fba5985": {"t": 1785764470.7755158, "n": 12321, "h": "46a0768f743cd5fb", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (required for storing analysis results)\n- **AI API Keys** (supports OpenAI, Claude, DeepSeek, and other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Initialize database\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. Configure project dataset\n# Edit src/dataset/agent-v1-c4/datasets.json to add your project configuration\n\n# 6. Run analysis\npython src/main.py\n```\n\n## 📊 Usage Guide\n\n### Database Initialization\n\nInitialize PostgreSQL database using the provided SQL file:\n\n```bash\n# Connect to PostgreSQL database\npsql -U postgres -d postgres\n\n# Execute SQL file to create table structure\n\\i project_task.sql\n\n# Or use command line directly\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### Project Configuration\n\nConfigure your project in `src/dataset/agent-v1-c4/datasets.json`:\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //no need to set, disable in future\n \"functions\": [], //no need to set, disable in future\n \"exclude_in_planning\": \"false\", //no need to set to true, disable in future\n \"exclude_directory\": [] //no need to set, disable in future\n }\n}\n```\n\n### Running Analysis\n\n1. **Set Project ID**: Configure your project ID in `src/main.py`\n```python\nproject_id = 'your_project_id'\n```\n\n2. **Execute Analysis**:\n```bash\npython src/main.py\n```\n\n3. **View Results**: \n - Detailed analysis records in database\n - `output.xlsx` report file\n - Mermaid business flow diagrams (if enabled)\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"sk-xxxxxx\" # API key\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode: Common project checklist fine-grained\n# Available modes: PURE_SCAN (Pure scanning)\nSCAN_MODE_AVA=False # Advanced scan mode features\nCOMPLEXITY_ANALYSIS_ENABLED=True # Enable complexity analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Maximum threads for scanning phase\nMAX_THREADS_OF_CONFIRMATION=50 # Maximum threads for confirmation phase\nBUSINESS_FLOW_COUNT=4 # Business flow repeat count (hallucination triggers)\n\n# Advanced Feature Configuration\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # Folders to ignore\n\n# Checklist Configuration\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # Path to checklist file\nCHECKLIST_SHEET=Sheet1 # Checklist worksheet name\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### AI Model Configuration Details\n\nBased on actual configuration in `src/openai_api/model_config.json`:\n\n**WARNING** must set the model name based on your llm hub!\n**WARNING** must set the model name based on your llm hub!\n**WARNING** like in openrouter, sonnet 4 need to set to anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 Cost Optimized\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "ef6663ad468c5f890f92974839d2a57be5cf1668": {"t": 1785764472.0343032, "n": 12395, "h": "0d8a584ba1fc4aee", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (required for storing analysis results)\n- **AI API Keys** (supports OpenAI, Claude, DeepSeek, and other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Initialize database\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. Configure project dataset\n# Edit src/dataset/agent-v1-c4/datasets.json to add your project configuration\n\n# 6. Run analysis\npython src/main.py\n```\n\n## 📊 Usage Guide\n\n### Database Initialization\n\nInitialize PostgreSQL database using the provided SQL file:\n\n```bash\n# Connect to PostgreSQL database\npsql -U postgres -d postgres\n\n# Execute SQL file to create table structure\n\\i project_task.sql\n\n# Or use command line directly\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### Project Configuration\n\nConfigure your project in `src/dataset/agent-v1-c4/datasets.json`:\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //no need to set, disable in future\n \"functions\": [], //no need to set, disable in future\n \"exclude_in_planning\": \"false\", //no need to set to true, disable in future\n \"exclude_directory\": [] //no need to set, disable in future\n }\n}\n```\n\n### Running Analysis\n\n1. **Set Project ID**: Configure your project ID in `src/main.py`\n```python\nproject_id = 'your_project_id'\n```\n\n2. **Execute Analysis**:\n```bash\npython src/main.py\n```\n\n3. **View Results**: \n - Detailed analysis records in database\n - `output.xlsx` report file\n - Mermaid business flow diagrams (if enabled)\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"sk-xxxxxx\" # API key\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode: Common project checklist fine-grained\n# Available modes: PURE_SCAN (Pure scanning)\nSCAN_MODE_AVA=False # Advanced scan mode features\nCOMPLEXITY_ANALYSIS_ENABLED=True # Enable complexity analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Maximum threads for scanning phase\nMAX_THREADS_OF_CONFIRMATION=50 # Maximum threads for confirmation phase\nBUSINESS_FLOW_COUNT=4 # Business flow repeat count (hallucination triggers)\n\n# Advanced Feature Configuration\nENABLE_DIALOGUE_MODE=False # Whether to enable dialogue mode\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # Folders to ignore\n\n# Checklist Configuration\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # Path to checklist file\nCHECKLIST_SHEET=Sheet1 # Checklist worksheet name\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### AI Model Configuration Details\n\nBased on actual configuration in `src/openai_api/model_config.json`:\n\n**WARNING** must set the model name based on your llm hub!\n**WARNING** must set the model name based on your llm hub!\n**WARNING** like in openrouter, sonnet 4 need to set to anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 Cost Optimized\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "ab488e871cc028c12f30da4a83c994c790c719f4": {"t": 1785764473.2230296, "n": 9937, "h": "4a0dd2a2e9ec0d04", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Go** (.go) - Blockchain infrastructure, TEE projects~~\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "f40a5e3087be5596071d73468852686d66f46617": {"t": 1785764474.4153442, "n": 9939, "h": "b89746c87341108c", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Go** (.go) - Blockchain infrastructure, TEE projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Contact\n\n- **Email**: nerbonic@gmail.com\n- **Twitter**: [@xy9301](https://x.com/xy9301)\n- **Telegram**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "eb8f80ae30c2d2366018f1ce8c2480c7c421492e": {"t": 1785764475.9388103, "n": 10126, "h": "32e94423558019b3", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Go** (.go) - Blockchain infrastructure, TEE projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Support\n\n- **Documentation**: [https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **Issues**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **Email**: support@finite-monkey-engine.com\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "653e54de04437a254ed96610b0eac95b5657aaf9": {"t": 1785764477.287517, "n": 10990, "h": "02ab86b5f5b93545", "c": "# Finite Monkey Engine v2.0\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🚀 v2.0 Major Upgrades\n\n**Finite Monkey Engine v2.0** brings significant architectural upgrades and feature enhancements:\n\n### 🔥 Core Upgrades\n- **🎯 Precision Language Support**: Focus on 4 core languages (Solidity/Rust/C++/Move) for optimal analysis experience\n- **🧠 RAG Architecture Optimization**: New LanceDB merged 2-table architecture with 300% query efficiency improvement\n- **📊 Intelligent Context Understanding**: Multi-dimensional embedding technology, significantly enhanced code comprehension\n- **⚡ Performance Optimization**: Unified storage strategy, 50% memory reduction, improved concurrent processing\n- **🔍 Deep Business Analysis**: Enhanced business flow visualization and cross-contract dependency analysis\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform **focused on blockchain and system-level code security auditing**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for core programming language projects.\n\n### 🌍 Multi-Language Support\n\nBuilt on Tree-sitter parsing engine and function-level analysis architecture, **v2.0 focuses on 4 core languages** for optimal analysis experience:\n\n**✅ Currently Fully Supported Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with complete Tree-sitter support\n- **Rust** (.rs) - Solana ecosystem, Substrate, system-level programming\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - Blockchain core, node clients\n- **Move** (.move) - Aptos, Sui blockchain language\n\n**🔄 Planned Support (Future Versions):**\n- ~~**Cairo** (.cairo) - StarkNet smart contract language~~\n- ~~**Tact** (.tact) - TON blockchain smart contracts~~\n- ~~**FunC** (.fc/.func) - TON blockchain native language~~\n- ~~**FA** (.fr) - Functional smart contract language~~\n- ~~**Python** (.py) - Web3, DeFi backend projects~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects~~\n- ~~**Go** (.go) - Blockchain infrastructure, TEE projects~~\n- ~~**Java** (.java) - Enterprise blockchain applications~~\n\n> 💡 **v2.0 Design Philosophy**: Focus on core languages to provide deeply optimized analysis capabilities. Based on function-granularity code analysis architecture, theoretically extensible to any programming language. Future versions will gradually support more languages.\n\n## 🚀 v2.0 Key Features\n\n### 🧠 Enhanced AI-Powered Analysis\n- **Multi-Model Collaboration**: Claude-4 Sonnet, GPT-4 and other AI models working intelligently together\n- **RAG-Enhanced Understanding**: Multi-dimensional context-aware technology based on LanceDB\n- **Deep Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and tokenomics\n- **Intelligent Vulnerability Discovery**: AI-assisted complex vulnerability pattern recognition\n\n### 📊 Upgraded Business Flow Visualization\n- **Smart Chart Generation**: Automatic code analysis generating Mermaid business flow diagrams\n- **Multi-level Analysis Display**: Support for project-level, folder-level, and function-level visualization\n- **Cross-Contract Dependency Tracking**: Clear visualization of complex contract interaction relationships\n- **Real-time Interactive Charts**: Dynamic display of code structure and call chains\n\n### 🔍 Comprehensive Security Detection System\n- **Precision Vulnerability Detection**: Focus on core languages for more accurate vulnerability identification\n- **Cross-Contract Deep Analysis**: Multi-contract interaction analysis and complex dependency tracking\n- **Business Scenario Review**: Professional security analysis for different DeFi scenarios\n- **Intelligent False Positive Filtering**: AI-assisted reduction of false positives, improving analysis accuracy\n\n### ⚡ v2.0 Architecture Optimization\n- **LanceDB 2-Table Architecture**: Unified storage strategy with 300% query efficiency improvement\n- **Multi-dimensional Embedding**: Content, name, and natural language triple embedding technology\n- **Memory Management Optimization**: 50% memory reduction, supporting larger-scale projects\n- **Concurrent Processing Upgrade**: Optimized thread management, improved analysis speed\n\n### 🛠 Precision Language Architecture\n- **Core Language Focus**: Specialized framework for Solidity/Rust/C++/Move languages\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Tree-sitter Parsing**: Advanced parsing supporting core languages with high precision\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Support\n\n- **Documentation**: [https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **Issues**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **Email**: support@finite-monkey-engine.com\n\n---\n\n## 🆕 v2.0 Release Notes\n\n### Major Upgrades\n- **Core Language Specialization**: Focus on Solidity/Rust/C++/Move for optimal analysis experience\n- **RAG Architecture Revolution**: LanceDB merged 2-table architecture with 300% performance improvement\n- **Intelligent Embedding**: Multi-dimensional code understanding with significantly enhanced analysis precision\n- **Architecture Optimization**: 50% memory reduction, supporting larger-scale projects\n\n### Migration Guide\n- v2.0 is fully backward compatible, no configuration changes required\n- Unsupported language files will be automatically skipped without affecting system operation\n- Recommended to update configuration files for optimal performance experience\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - Making Code Security Analysis More Intelligent, Professional, and Efficient!** "}, "925e6e2c0025b8eb1826dc10a30ee90410e53724": {"t": 1785764478.5713952, "n": 8358, "h": "e5a9799264d688b0", "c": "# Finite Monkey Engine\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform that **supports not only smart contracts but can be extended to any programming language project**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for various types of code projects.\n\n### 🌍 Multi-Language Support\nBuilt on ANTLR4 parsing engine and function-level analysis architecture, currently supporting:\n\n**Blockchain Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with full ANTLR support\n- **Rust** (.rs) - Solana ecosystem, Substrate, etc.\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Cairo** (.cairo) - StarkNet smart contract language\n- **Tact** (.tact) - TON blockchain smart contracts\n- **FunC** (.fc/.func) - TON blockchain native language\n- **FA** (.fr) - Functional smart contract language\n\n**Traditional Programming Languages:**\n- **Python** (.py) - Web3, DeFi backend projects\n- **JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects\n- **Go** (.go) - Blockchain infrastructure, TEE projects\n- **Java** (.java) - Enterprise blockchain applications\n- **C/C++** (.c/.cpp/.cxx/.cc/.C) - Blockchain core, node clients\n\n> 💡 **Design Philosophy**: Function-granularity code analysis, theoretically extensible to any programming language\n\n## 🚀 Key Features\n\n### 🧠 AI-Powered Analysis\n- **Multi-Model Support**: Integrates Claude-4 Sonnet, GPT-4, DeepSeek and other mainstream AI models\n- **Context-Aware Detection**: RAG-enhanced intelligent code understanding\n- **Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and application architectures\n\n### 📊 Business Flow Visualization\n- **Automatic Generation**: Smart code analysis generating Mermaid diagrams\n- **Multi-level Analysis**: Support for project-level, folder-level, and function-level analysis\n- **Interactive Diagrams**: Clear visualization of code interactions and dependencies\n\n### 🔍 Comprehensive Security Detection\n- **Vulnerability Detection**: Covers common and complex security vulnerabilities\n- **Cross-File Analysis**: Multi-file interaction analysis and dependency tracking\n- **Targeted Business Scenarios**: Security analysis for specific business scenarios\n\n### 🛠 Language-Agnostic Architecture\n- **Universal Framework**: Function-level analysis framework applicable to any language\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Extensible Parsing**: ANTLR4-based parsing supporting multiple languages\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Support\n\n- **Documentation**: [https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **Issues**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **Email**: support@finite-monkey-engine.com\n\n---\n\n**🎉 Finite Monkey Engine - Making Smart Contract Security Analysis Intelligent and Accessible!** "}, "4c1de48e6accf8f9496408d6f53ecdded0a58517": {"t": 1785764479.9372103, "n": 8431, "h": "ef9f58477ed5607a", "c": "# Finite Monkey Engine\n\n**An AI-Powered Code Security Analysis Platform**\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced AI-driven code security analysis platform that **supports not only smart contracts but can be extended to any programming language project**. By integrating multiple AI models and advanced static analysis techniques, it provides comprehensive, intelligent security auditing solutions for various types of code projects.\n\n### 🌍 Multi-Language Support\nBuilt on ANTLR4 parsing engine and function-level analysis architecture, currently supporting:\n\n**Blockchain Languages:**\n- **Solidity** (.sol) - Ethereum smart contracts with full ANTLR support\n- **Rust** (.rs) - Solana ecosystem, Substrate, etc.\n- **Move** (.move) - Aptos, Sui blockchain language\n- **Cairo** (.cairo) - StarkNet smart contract language\n- **Tact** (.tact) - TON blockchain smart contracts\n- **FunC** (.fc/.func) - TON blockchain native language\n- **FA** (.fr) - Functional smart contract language\n\n**Traditional Programming Languages:**\n- **Python** (.py) - Web3, DeFi backend projects\n- **JavaScript/TypeScript** (.js/.ts) - Web3 frontend, Node.js projects\n- **Go** (.go) - Blockchain infrastructure, TEE projects\n- **Java** (.java) - Enterprise blockchain applications\n- **C/C++** (.c/.cpp/.cxx/.cc/.C) - Blockchain core, node clients\n\n> 💡 **Design Philosophy**: Function-granularity code analysis, theoretically extensible to any programming language\n\n## 🚀 Key Features\n\n### 🧠 AI-Powered Analysis\n- **Multi-Model Support**: Integrates Claude-4 Sonnet, GPT-4, DeepSeek and other mainstream AI models\n- **Context-Aware Detection**: RAG-enhanced intelligent code understanding\n- **Business Logic Analysis**: Deep understanding of DeFi protocols, governance mechanisms, and application architectures\n\n### 📊 Business Flow Visualization\n- **Automatic Generation**: Smart code analysis generating Mermaid diagrams\n- **Multi-level Analysis**: Support for project-level, folder-level, and function-level analysis\n- **Interactive Diagrams**: Clear visualization of code interactions and dependencies\n\n### 🔍 Comprehensive Security Detection\n- **Vulnerability Detection**: Covers common and complex security vulnerabilities\n- **Cross-File Analysis**: Multi-file interaction analysis and dependency tracking\n- **Targeted Business Scenarios**: Security analysis for specific business scenarios\n\n### 🛠 Language-Agnostic Architecture\n- **Universal Framework**: Function-level analysis framework applicable to any language\n- **Modular Design**: Planning, validation, context, and analysis modules\n- **Extensible Parsing**: ANTLR4-based parsing supporting multiple languages\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── code_summarizer/ # AI-powered code analysis and summarization\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n- **Python 3.10+**\n- **PostgreSQL 13+** (optional, SQLite also supported)\n- **AI API Keys** (OpenAI, Claude, or other compatible services)\n\n### Installation\n\n```bash\n# 1. Clone the repository\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. Install Python dependencies\npip install -r requirements.txt\n\n# 3. Configure environment variables\ncp env.example .env\n# Edit .env file with your API keys and database configuration\n\n# 4. Run analysis\npython src/main.py\n```\n\n## 🔧 Configuration\n\n### Quick Configuration\n\n1. **Copy environment template**:\n ```bash\n cp env.example .env\n ```\n\n2. **Edit `.env` file** with your API keys and preferences\n\n### Core Environment Variables\n\n```bash\n# Database Configuration (Required)\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI Model Configuration (Required)\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM proxy platform\nOPENAI_API_KEY=\"your_api_key_here\" # API key\nCLAUDE_MODEL=claude-sonnet-4-20250514 # Recommended Claude model\nVUL_MODEL=claude-sonnet-4-20250514 # Vulnerability detection model\n\n# Scan Mode Configuration\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # Recommended mode\nSWITCH_BUSINESS_CODE=False # Business flow analysis\nSWITCH_FILE_CODE=True # File-level analysis\nCROSS_CONTRACT_SCAN=True # Cross-contract/file analysis\n\n# Performance Tuning\nMAX_THREADS_OF_SCAN=10 # Scan threads\nMAX_THREADS_OF_CONFIRMATION=50 # Confirmation threads\nBUSINESS_FLOW_COUNT=8 # Business flow iterations\n```\n\n> 📝 **Complete Configuration**: See `env.example` file for all configurable options and detailed descriptions\n\n### Recommended Configuration Schemes\n\n#### 🚀 Quick Start (Small projects < 50 files)\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 Enterprise (Large projects > 100 files)\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 Cost Optimized\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🎯 Use Cases\n\n### Blockchain & Web3 Projects\n- **Smart Contract Security**: Solidity, Rust, Move contract analysis\n- **DeFi Protocol Analysis**: AMM, lending, governance mechanism review\n- **Cross-Chain Applications**: Bridge security, multi-chain deployment analysis\n- **NFT & Gaming**: Minting logic, marketplace integration security\n\n### Traditional Software Projects\n- **Web3 Backend**: Python/Node.js API security analysis\n- **Blockchain Infrastructure**: Go/C++ node and client security\n- **Enterprise Applications**: Java enterprise blockchain applications\n- **System-Level Code**: C/C++ core components and TEE projects\n\n### Multi-Language Project Analysis\n- **Polyglot Codebases**: Cross-language dependency analysis\n- **Microservice Architecture**: Multi-service security assessment\n- **Full-Stack Applications**: Frontend, backend, and contract integration security\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Support\n\n- **Documentation**: [https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **Issues**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **Email**: support@finite-monkey-engine.com\n\n---\n\n**🎉 Finite Monkey Engine - Making Smart Contract Security Analysis Intelligent and Accessible!** "}, "ee7c05337ae0b3fc96bdbc097e2bbfc062c95ffa": {"t": 1785764481.2073965, "n": 6290, "h": "8b6bd46717c1c5f1", "c": "# Finite Monkey Engine\n\n**An AI-Powered Smart Contract Security Analysis Platform**\n\n## 🎯 Overview\n\nFinite Monkey Engine is an advanced smart contract security analysis platform that leverages AI and cutting-edge analysis techniques to provide comprehensive vulnerability detection and business flow analysis for blockchain projects.\n\n## 🚀 Key Features\n\n### 🧠 AI-Powered Analysis\n- **Claude-4 Sonnet Integration**: Utilizes advanced language models for intelligent code understanding\n- **Multi-modal Analysis**: Combines static analysis with AI-driven semantic understanding\n- **Context-Aware Detection**: Smart vulnerability detection with business logic understanding\n\n### 📊 Business Flow Visualization\n- **Mermaid Diagram Generation**: Automatic generation of business flow diagrams\n- **Interactive Analysis**: Visual representation of contract interactions and dependencies\n- **Multi-level Granularity**: Project-level, folder-level, and function-level analysis\n\n### 🔍 Advanced Security Features\n- **Comprehensive Vulnerability Detection**: Detection of common and complex smart contract vulnerabilities\n- **Business Logic Analysis**: Understanding of DeFi protocols, governance mechanisms, and token economics\n- **Cross-Contract Analysis**: Multi-contract interaction analysis and dependency tracking\n\n### 🛠 Modular Architecture\n- **Planning Module**: Intelligent task planning and business flow extraction\n- **Validation Module**: Comprehensive vulnerability checking and validation\n- **Context Module**: Advanced context management with RAG and call tree analysis\n- **Code Summarizer**: Smart code analysis with reinforcement learning capabilities\n\n## 📁 Project Structure\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # Task planning and business flow analysis\n│ ├── validating/ # Vulnerability detection and validation\n│ ├── context/ # Context management and RAG processing\n│ ├── code_summarizer/ # AI-powered code analysis and summarization\n│ ├── reasoning/ # Analysis reasoning and dialogue management\n│ ├── dao/ # Data access objects and entity management\n│ ├── library/ # Parsing libraries and utilities\n│ ├── openai_api/ # AI API integrations\n│ └── prompt_factory/ # Prompt engineering and management\n├── knowledges/ # Domain knowledge base\n├── scripts/ # Utility scripts\n└── docs/ # Documentation\n```\n\n## 🚀 Quick Start\n\n### Prerequisites\n\n- Python 3.9+\n- Node.js 16+ (for certain analysis features)\n- OpenAI API key or compatible AI service\n\n### Installation\n\n1. **Clone the repository**\n ```bash\n git clone https://github.com/your-org/finite-monkey-engine.git\n cd finite-monkey-engine\n ```\n\n2. **Install dependencies**\n ```bash\n pip install -r requirements.txt\n ```\n\n3. **Configure environment**\n ```bash\n cp .env.example .env\n # Edit .env with your API keys and configuration\n ```\n\n4. **Run the analysis**\n ```bash\n python src/main.py\n ```\n\n## 🔧 Configuration\n\n### Analysis Modes\n\nThe platform supports multiple analysis modes:\n\n- **Business Flow Mode** (`SWITCH_BUSINESS_CODE=True`): Focus on business logic analysis\n- **File-Level Mode** (`SWITCH_FILE_CODE=True`): Comprehensive file-by-file analysis\n- **Fine-Grained Mode** (`SCAN_MODE=COMMON_PROJECT_FINE_GRAINED`): Detailed vulnerability scanning\n\n### Environment Variables\n\n```bash\n# Analysis Configuration\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\n\n# AI Configuration\nOPENAI_API_KEY=your_api_key_here\nOPENAI_BASE_URL=https://api.openai.com/v1\n\n# Output Configuration\nOUTPUT_DIR=./output\nMERMAID_OUTPUT_DIR=src/codebaseQA/mermaid_output\n```\n\n## 🎯 Use Cases\n\n### DeFi Protocol Analysis\n- **Liquidity Pool Security**: Analysis of AMM and lending protocols\n- **Governance Mechanism Review**: DAO governance and voting system analysis\n- **Token Economics Validation**: Tokenomics and distribution mechanism review\n\n### NFT Project Security\n- **Minting Logic Analysis**: NFT minting mechanism and access control review\n- **Marketplace Integration**: Secondary market integration security analysis\n- **Royalty Mechanism Review**: Creator royalty and fee distribution analysis\n\n### Cross-Chain Protocol Analysis\n- **Bridge Security Assessment**: Cross-chain bridge mechanism analysis\n- **Multi-Chain Deployment**: Consistent security across different chains\n- **Interoperability Review**: Protocol interaction and dependency analysis\n\n## 📊 Analysis Reports\n\nThe platform generates comprehensive analysis reports including:\n\n- **Security Vulnerability Report**: Detailed vulnerability findings with severity ratings\n- **Business Flow Diagrams**: Visual representation of contract interactions\n- **Gas Optimization Suggestions**: Performance improvement recommendations\n- **Best Practice Compliance**: Adherence to security standards and guidelines\n\n## 🧪 Testing\n\nRun the test suite:\n\n```bash\n# Unit tests\npython -m pytest tests/\n\n# Integration tests\npython -m pytest tests/integration/\n\n# Coverage report\npython -m pytest --cov=src tests/\n```\n\n## 🤝 Contributing\n\nWe welcome contributions! Please see our [Contributing Guidelines](CONTRIBUTING.md) for details.\n\n1. Fork the repository\n2. Create a feature branch (`git checkout -b feature/amazing-feature`)\n3. Commit your changes (`git commit -m 'Add amazing feature'`)\n4. Push to the branch (`git push origin feature/amazing-feature`)\n5. Open a Pull Request\n\n## 📄 License\n\nThis project is licensed under the Apache License 2.0 - see the [LICENSE](LICENSE) file for details.\n\n## 🙏 Acknowledgments\n\n- **ANTLR4**: For Solidity parsing capabilities\n- **Claude AI**: For advanced code understanding\n- **Mermaid**: For business flow visualization\n- **OpenAI**: For AI-powered analysis capabilities\n\n## 📞 Support\n\n- **Documentation**: [https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **Issues**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **Discussions**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **Email**: support@finite-monkey-engine.com\n\n---\n\n**🎉 Finite Monkey Engine - Making Smart Contract Security Analysis Intelligent and Accessible!** "}, "7838b8c4805c010d17f159b658652bf9cf47b027": {"t": 1785764482.9794276, "n": 12589, "h": "213edb75e7027d46", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🔄 Business Flow Analysis Methodology\n\nFiniteMonkey introduces an innovative **Mermaid-based Business Flow Extraction** approach that revolutionizes how smart contracts are analyzed:\n\n### 📊 Core Features\n\n#### 1. **Intelligent Mermaid Generation**\n- **AI-Powered Analysis**: Leverages Claude-4-Sonnet to generate comprehensive Mermaid diagrams from smart contract code\n- **Multi-Strategy Approach**: Automatically selects between incremental analysis (small projects) and folder-based analysis (large projects)\n- **Reinforcement Analysis**: Multiple rounds of analysis to ensure complete function coverage, especially getter/setter functions\n\n#### 2. **Business Flow Extraction**\n- **JSON-Based Parsing**: Extracts structured business flows from Mermaid sequence diagrams\n- **Semantic Understanding**: Identifies meaningful business processes beyond simple function calls\n- **Context-Aware Grouping**: Groups related functions into coherent business workflows\n\n#### 3. **Smart Context Expansion**\n- **Call Tree Integration**: Expands business flows using function call relationships\n- **RAG Enhancement**: Leverages Retrieval-Augmented Generation for deeper context understanding\n- **Duplicate Prevention**: Intelligent filtering to avoid redundant function analysis\n\n#### 4. **Advanced Task Creation**\n- **Business Flow Level**: Creates tasks at business flow granularity instead of individual functions\n- **Coverage Analysis**: Tracks which functions are covered by business flows vs. requiring individual analysis\n- **Hybrid Approach**: Combines business flow tasks with function-level tasks for comprehensive coverage\n\n### 🎯 Analysis Modes\n\n#### **Pure Mermaid Mode** (`SWITCH_BUSINESS_CODE=True`)\n- Generates Mermaid diagrams for complete project visualization\n- Extracts business flows from Mermaid files stored in `src/codebaseQA/mermaid_output/`\n- Creates business flow-based analysis tasks\n- Provides detailed coverage reporting\n- No fallback to function-level analysis for uncovered code\n\n#### **File-Level Mode** (`SWITCH_FILE_CODE=True`)\n- Analyzes entire files instead of individual functions or business flows\n- Suitable for high-level architectural analysis\n- Processes complete file contents for comprehensive understanding\n\n### 📈 Benefits\n\n- **Higher Efficiency**: Reduces redundant analysis by grouping related functions\n- **Better Context**: Business flows provide richer context than isolated functions\n- **Comprehensive Coverage**: Ensures all functions are analyzed either through business flows or individually\n- **Visual Understanding**: Mermaid diagrams provide clear visualization of contract interactions\n- **Scalable Analysis**: Handles both small contracts and large multi-contract projects\n\n### 🔧 Implementation\n\nThe methodology is implemented across multiple modules:\n- **Code Summarizer**: Generates enhanced Mermaid diagrams with reinforcement analysis\n- **Planning Module**: Extracts business flows and creates optimized analysis tasks\n- **Context Manager**: Provides intelligent context expansion using call trees and RAG\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 📋 Prerequisites\n\n### Python Environment\n- Python 3.11 (recommended, as Python 3.12 has package compatibility issues)\n- Use conda for environment management:\n```bash\nconda create -n py311 python=3.11\nconda activate py311\n```\n\n### PostgreSQL Database\n1. Install PostgreSQL:\n```bash\n# Install and start PostgreSQL (macOS)\nbrew install postgresql\nbrew services start postgresql\ninitdb /usr/local/var/postgres -E utf8\n\n# Connect to database\npsql postgres\n\n# Check databases\n\\l\n\n# Set password for database user\n\\password [your_username]\n\n# Exit connection\nexit\n```\n\n2. Install pgAdmin from [https://www.pgadmin.org/download/](https://www.pgadmin.org/download/) for database management\n - Host: 127.0.0.1\n - Port: 5432\n - Username: your database owner username\n - Password: as set above\n\n### AI API Configuration\nPurchase AI API access from [https://platform.closeai-asia.com/account/billing](https://platform.closeai-asia.com/account/billing)\nGet your API key from Developer Mode -> Key Management\n\n## 🛠️ Installation & Setup\n\n### 1. Get the Code\n```bash\ngit clone https://github.com/BradMoonUESTC/finite-monkey-engine.git\ncd finite-monkey-engine\npip install -r requirements.txt\n```\n\n### 2. Database Setup\nExecute the SQL file `src/db.sql` in pgAdmin to create the required tables. If you encounter ownership errors, modify `OWNER TO \"postgres\"` to use your actual database username.\n\n### 3. Sample Data (Optional)\nDownload the `concise_project_code` directory from [Google Drive](https://drive.google.com/drive/folders/1M3Fn3FOBX2EFAvBkXG4GVOT0ZlCmJgjQ) and place the files in `finite-monkey-engine/src/dataset/agent-v1-c4/`\n\n### 4. Environment Configuration\nCreate `src/.env` file with the following configuration:\n\n```env\n# =============================================================================\n# 数据库配置 / Database Configuration\n# =============================================================================\n\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:your_password@127.0.0.1:5432/your_database\n\n# =============================================================================\n# LLM API配置 / LLM API Configuration\n# =============================================================================\n\n# 所有LLM的基础URL（LLM中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform)\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# LLM中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=\"sk-your_openai_api_key_here\"\n\n# =============================================================================\n# 嵌入模型配置 / Embedding Model Configuration\n# =============================================================================\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\nEMBEDDING_API_BASE=\"api.openai-proxy.org\"\nEMBEDDING_API_KEY=\"sk-your_embedding_api_key_here\"\n\n# =============================================================================\n# JSON模型配置 / JSON Model Configuration\n# =============================================================================\n\nJSON_MODEL_API_BASE=\"api.openai-proxy.org\"\nJSON_MODEL_API_KEY=\"sk-your_json_model_api_key_here\"\nJSON_MODEL_ID=\"gpt-4o-mini\"\n\n# =============================================================================\n# 模型选择配置 / Model Selection Configuration\n# =============================================================================\n\n# 确认模型的选择\n# Confirmation model selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nCONFIRMATION_MODEL=\"OPENAI\"\n\n# OpenAI模型的选择\n# OpenAI model selection\nOPENAI_MODEL=\"gpt-4o-mini\"\n\n# Claude模型的选择\n# Claude model selection\nCLAUDE_MODEL=\"claude-3-5-sonnet-20241022\"\n\n# 漏洞扫描模型\n# Vulnerability scanning model\nVUL_MODEL=\"gpt-4o-mini\"\n\n# =============================================================================\n# 扫描模式配置 / Scan Mode Configuration\n# =============================================================================\n\n# 扫描模式设置\n# Scan mode setting\n# 可选值: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN \n# / CHECKLIST / CHECKLIST_PIPELINE / COMMON_PROJECT_FINE_GRAINED\nSCAN_MODE=\"PURE_SCAN\"\n\n# API服务提供商选择\n# API service provider selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# =============================================================================\n# 性能配置 / Performance Configuration\n# =============================================================================\n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=5\n\n# 业务流程重复数量\n# Business flow repeat count\nBUSINESS_FLOW_COUNT=5\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# 每轮询问次数\n# Number of requests per round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# =============================================================================\n# 功能开关配置 / Feature Switch Configuration\n# =============================================================================\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# 是否启用文件代码扫描\n# Whether to enable file code scanning\nSWITCH_FILE_CODE=False\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# 是否启用对话模式\n# Whether to enable dialogue mode\nENABLE_DIALOGUE_MODE=False\n\n# 是否启用跨合约扫描\n# Whether to enable cross-contract scanning\nCROSS_CONTRACT_SCAN=True\n\n# =============================================================================\n# 迭代配置 / Iteration Configuration\n# =============================================================================\n\n# 项目清单生成迭代轮数\n# Number of iterations for project types generation\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# 检查清单生成迭代轮数\n# Number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n# 规划阶段的长度阈值\n# Length threshold for planning phase\nTHRESHOLD_OF_PLANNING=150\n```\n\n### 5. Project Configuration\nEdit `src/dataset/agent-v1-c4/datasets.json` to configure your projects:\n\n```json\n{\n \"YourProjectName\": {\n \"path\": \"relative_path_to_your_project\",\n \"files\": [],\n \"functions\": [],\n \"exclude_in_planning\": \"true\",\n \"exclude_directory\": [\"access\", \"errors\", \"events\", \"lib\", \"storage\"]\n }\n}\n```\n\n**Planning Optimization Notes:**\n- `THRESHOLD_OF_PLANNING`: Functions shorter than this value will be treated as context rather than main scanning targets\n- `exclude_in_planning` and `exclude_directory`: Contracts in specified directories will be treated as context only\n\n## 🚀 Usage\n\n### Running with Sample Data\n1. Choose a project name from `src/dataset/agent-v1-c4/datasets.json`\n2. Edit `src/main.py` line 146 to set the `project_id`:\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n start_time = time.time()\n db_url_from = os.environ.get(\"DATABASE_URL\")\n engine = create_engine(db_url_from)\n \n dataset_base = \"./src/dataset/agent-v1-c4\"\n projects = load_dataset(dataset_base)\n project_id = 'YourProjectName' # Set your project name here\n project_path = ''\n project = Project(project_id, projects[project_id])\n```\n3. Run the scanner:\n```bash\npython src/main.py\n```\n\n### Running with New Projects\n1. Place your code in `finite-monkey-engine/src/dataset/agent-v1-c4/` (recommended to include only files that need auditing)\n2. Add project configuration to `src/dataset/agent-v1-c4/datasets.json`\n3. Update `project_id` in `src/main.py`\n4. Execute `python src/main.py`\n\n### Analyzing Results\nCheck the `project_tasks_amazing_prompt` database table for scan results. Each record requires manual analysis to determine if it represents a valid vulnerability.\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n2. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*"}, "bf0babba85aa8a23674fe544db537fa5d071def1": {"t": 1785764484.4722438, "n": 12540, "h": "b78839deae7664d0", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🔄 Business Flow Analysis Methodology\n\nFiniteMonkey introduces an innovative **Mermaid-based Business Flow Extraction** approach that revolutionizes how smart contracts are analyzed:\n\n### 📊 Core Features\n\n#### 1. **Intelligent Mermaid Generation**\n- **AI-Powered Analysis**: Leverages Claude-4-Sonnet to generate comprehensive Mermaid diagrams from smart contract code\n- **Multi-Strategy Approach**: Automatically selects between incremental analysis (small projects) and folder-based analysis (large projects)\n- **Reinforcement Analysis**: Multiple rounds of analysis to ensure complete function coverage, especially getter/setter functions\n\n#### 2. **Business Flow Extraction**\n- **JSON-Based Parsing**: Extracts structured business flows from Mermaid sequence diagrams\n- **Semantic Understanding**: Identifies meaningful business processes beyond simple function calls\n- **Context-Aware Grouping**: Groups related functions into coherent business workflows\n\n#### 3. **Smart Context Expansion**\n- **Call Tree Integration**: Expands business flows using function call relationships\n- **RAG Enhancement**: Leverages Retrieval-Augmented Generation for deeper context understanding\n- **Duplicate Prevention**: Intelligent filtering to avoid redundant function analysis\n\n#### 4. **Advanced Task Creation**\n- **Business Flow Level**: Creates tasks at business flow granularity instead of individual functions\n- **Coverage Analysis**: Tracks which functions are covered by business flows vs. requiring individual analysis\n- **Hybrid Approach**: Combines business flow tasks with function-level tasks for comprehensive coverage\n\n### 🎯 Analysis Modes\n\n#### **Pure Mermaid Mode** (`SWITCH_BUSINESS_CODE=True`)\n- Generates Mermaid diagrams for complete project visualization\n- Extracts business flows from Mermaid files stored in `src/codebaseQA/mermaid_output/`\n- Creates business flow-based analysis tasks\n- Provides detailed coverage reporting\n\n#### **Hybrid Mode**\n- Combines Mermaid-based business flow analysis with traditional function-level scanning\n- Optimizes analysis efficiency while maintaining comprehensive coverage\n- Intelligent fallback to function-level analysis for uncovered code\n\n### 📈 Benefits\n\n- **Higher Efficiency**: Reduces redundant analysis by grouping related functions\n- **Better Context**: Business flows provide richer context than isolated functions\n- **Comprehensive Coverage**: Ensures all functions are analyzed either through business flows or individually\n- **Visual Understanding**: Mermaid diagrams provide clear visualization of contract interactions\n- **Scalable Analysis**: Handles both small contracts and large multi-contract projects\n\n### 🔧 Implementation\n\nThe methodology is implemented across multiple modules:\n- **Code Summarizer**: Generates enhanced Mermaid diagrams with reinforcement analysis\n- **Planning Module**: Extracts business flows and creates optimized analysis tasks\n- **Context Manager**: Provides intelligent context expansion using call trees and RAG\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 📋 Prerequisites\n\n### Python Environment\n- Python 3.11 (recommended, as Python 3.12 has package compatibility issues)\n- Use conda for environment management:\n```bash\nconda create -n py311 python=3.11\nconda activate py311\n```\n\n### PostgreSQL Database\n1. Install PostgreSQL:\n```bash\n# Install and start PostgreSQL (macOS)\nbrew install postgresql\nbrew services start postgresql\ninitdb /usr/local/var/postgres -E utf8\n\n# Connect to database\npsql postgres\n\n# Check databases\n\\l\n\n# Set password for database user\n\\password [your_username]\n\n# Exit connection\nexit\n```\n\n2. Install pgAdmin from [https://www.pgadmin.org/download/](https://www.pgadmin.org/download/) for database management\n - Host: 127.0.0.1\n - Port: 5432\n - Username: your database owner username\n - Password: as set above\n\n### AI API Configuration\nPurchase AI API access from [https://platform.closeai-asia.com/account/billing](https://platform.closeai-asia.com/account/billing)\nGet your API key from Developer Mode -> Key Management\n\n## 🛠️ Installation & Setup\n\n### 1. Get the Code\n```bash\ngit clone https://github.com/BradMoonUESTC/finite-monkey-engine.git\ncd finite-monkey-engine\npip install -r requirements.txt\n```\n\n### 2. Database Setup\nExecute the SQL file `src/db.sql` in pgAdmin to create the required tables. If you encounter ownership errors, modify `OWNER TO \"postgres\"` to use your actual database username.\n\n### 3. Sample Data (Optional)\nDownload the `concise_project_code` directory from [Google Drive](https://drive.google.com/drive/folders/1M3Fn3FOBX2EFAvBkXG4GVOT0ZlCmJgjQ) and place the files in `finite-monkey-engine/src/dataset/agent-v1-c4/`\n\n### 4. Environment Configuration\nCreate `src/.env` file with the following configuration:\n\n```env\n# =============================================================================\n# 数据库配置 / Database Configuration\n# =============================================================================\n\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:your_password@127.0.0.1:5432/your_database\n\n# =============================================================================\n# LLM API配置 / LLM API Configuration\n# =============================================================================\n\n# 所有LLM的基础URL（LLM中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform)\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# LLM中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=\"sk-your_openai_api_key_here\"\n\n# =============================================================================\n# 嵌入模型配置 / Embedding Model Configuration\n# =============================================================================\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\nEMBEDDING_API_BASE=\"api.openai-proxy.org\"\nEMBEDDING_API_KEY=\"sk-your_embedding_api_key_here\"\n\n# =============================================================================\n# JSON模型配置 / JSON Model Configuration\n# =============================================================================\n\nJSON_MODEL_API_BASE=\"api.openai-proxy.org\"\nJSON_MODEL_API_KEY=\"sk-your_json_model_api_key_here\"\nJSON_MODEL_ID=\"gpt-4o-mini\"\n\n# =============================================================================\n# 模型选择配置 / Model Selection Configuration\n# =============================================================================\n\n# 确认模型的选择\n# Confirmation model selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nCONFIRMATION_MODEL=\"OPENAI\"\n\n# OpenAI模型的选择\n# OpenAI model selection\nOPENAI_MODEL=\"gpt-4o-mini\"\n\n# Claude模型的选择\n# Claude model selection\nCLAUDE_MODEL=\"claude-3-5-sonnet-20241022\"\n\n# 漏洞扫描模型\n# Vulnerability scanning model\nVUL_MODEL=\"gpt-4o-mini\"\n\n# =============================================================================\n# 扫描模式配置 / Scan Mode Configuration\n# =============================================================================\n\n# 扫描模式设置\n# Scan mode setting\n# 可选值: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN \n# / CHECKLIST / CHECKLIST_PIPELINE / COMMON_PROJECT_FINE_GRAINED\nSCAN_MODE=\"PURE_SCAN\"\n\n# API服务提供商选择\n# API service provider selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# =============================================================================\n# 性能配置 / Performance Configuration\n# =============================================================================\n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=5\n\n# 业务流程重复数量\n# Business flow repeat count\nBUSINESS_FLOW_COUNT=5\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# 每轮询问次数\n# Number of requests per round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# =============================================================================\n# 功能开关配置 / Feature Switch Configuration\n# =============================================================================\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# 是否启用文件代码扫描\n# Whether to enable file code scanning\nSWITCH_FILE_CODE=False\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# 是否启用对话模式\n# Whether to enable dialogue mode\nENABLE_DIALOGUE_MODE=False\n\n# 是否启用跨合约扫描\n# Whether to enable cross-contract scanning\nCROSS_CONTRACT_SCAN=True\n\n# =============================================================================\n# 迭代配置 / Iteration Configuration\n# =============================================================================\n\n# 项目清单生成迭代轮数\n# Number of iterations for project types generation\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# 检查清单生成迭代轮数\n# Number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n# 规划阶段的长度阈值\n# Length threshold for planning phase\nTHRESHOLD_OF_PLANNING=150\n```\n\n### 5. Project Configuration\nEdit `src/dataset/agent-v1-c4/datasets.json` to configure your projects:\n\n```json\n{\n \"YourProjectName\": {\n \"path\": \"relative_path_to_your_project\",\n \"files\": [],\n \"functions\": [],\n \"exclude_in_planning\": \"true\",\n \"exclude_directory\": [\"access\", \"errors\", \"events\", \"lib\", \"storage\"]\n }\n}\n```\n\n**Planning Optimization Notes:**\n- `THRESHOLD_OF_PLANNING`: Functions shorter than this value will be treated as context rather than main scanning targets\n- `exclude_in_planning` and `exclude_directory`: Contracts in specified directories will be treated as context only\n\n## 🚀 Usage\n\n### Running with Sample Data\n1. Choose a project name from `src/dataset/agent-v1-c4/datasets.json`\n2. Edit `src/main.py` line 146 to set the `project_id`:\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n start_time = time.time()\n db_url_from = os.environ.get(\"DATABASE_URL\")\n engine = create_engine(db_url_from)\n \n dataset_base = \"./src/dataset/agent-v1-c4\"\n projects = load_dataset(dataset_base)\n project_id = 'YourProjectName' # Set your project name here\n project_path = ''\n project = Project(project_id, projects[project_id])\n```\n3. Run the scanner:\n```bash\npython src/main.py\n```\n\n### Running with New Projects\n1. Place your code in `finite-monkey-engine/src/dataset/agent-v1-c4/` (recommended to include only files that need auditing)\n2. Add project configuration to `src/dataset/agent-v1-c4/datasets.json`\n3. Update `project_id` in `src/main.py`\n4. Execute `python src/main.py`\n\n### Analyzing Results\nCheck the `project_tasks_amazing_prompt` database table for scan results. Each record requires manual analysis to determine if it represents a valid vulnerability.\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n2. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*"}, "934b353609c0821375e6165a98d25beb3148c214": {"t": 1785764485.7857277, "n": 9529, "h": "658563da315750e7", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 📋 Prerequisites\n\n### Python Environment\n- Python 3.11 (recommended, as Python 3.12 has package compatibility issues)\n- Use conda for environment management:\n```bash\nconda create -n py311 python=3.11\nconda activate py311\n```\n\n### PostgreSQL Database\n1. Install PostgreSQL:\n```bash\n# Install and start PostgreSQL (macOS)\nbrew install postgresql\nbrew services start postgresql\ninitdb /usr/local/var/postgres -E utf8\n\n# Connect to database\npsql postgres\n\n# Check databases\n\\l\n\n# Set password for database user\n\\password [your_username]\n\n# Exit connection\nexit\n```\n\n2. Install pgAdmin from [https://www.pgadmin.org/download/](https://www.pgadmin.org/download/) for database management\n - Host: 127.0.0.1\n - Port: 5432\n - Username: your database owner username\n - Password: as set above\n\n### AI API Configuration\nPurchase AI API access from [https://platform.closeai-asia.com/account/billing](https://platform.closeai-asia.com/account/billing)\nGet your API key from Developer Mode -> Key Management\n\n## 🛠️ Installation & Setup\n\n### 1. Get the Code\n```bash\ngit clone https://github.com/BradMoonUESTC/finite-monkey-engine.git\ncd finite-monkey-engine\npip install -r requirements.txt\n```\n\n### 2. Database Setup\nExecute the SQL file `src/db.sql` in pgAdmin to create the required tables. If you encounter ownership errors, modify `OWNER TO \"postgres\"` to use your actual database username.\n\n### 3. Sample Data (Optional)\nDownload the `concise_project_code` directory from [Google Drive](https://drive.google.com/drive/folders/1M3Fn3FOBX2EFAvBkXG4GVOT0ZlCmJgjQ) and place the files in `finite-monkey-engine/src/dataset/agent-v1-c4/`\n\n### 4. Environment Configuration\nCreate `src/.env` file with the following configuration:\n\n```env\n# =============================================================================\n# 数据库配置 / Database Configuration\n# =============================================================================\n\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:your_password@127.0.0.1:5432/your_database\n\n# =============================================================================\n# LLM API配置 / LLM API Configuration\n# =============================================================================\n\n# 所有LLM的基础URL（LLM中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform)\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# LLM中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=\"sk-your_openai_api_key_here\"\n\n# =============================================================================\n# 嵌入模型配置 / Embedding Model Configuration\n# =============================================================================\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\nEMBEDDING_API_BASE=\"api.openai-proxy.org\"\nEMBEDDING_API_KEY=\"sk-your_embedding_api_key_here\"\n\n# =============================================================================\n# JSON模型配置 / JSON Model Configuration\n# =============================================================================\n\nJSON_MODEL_API_BASE=\"api.openai-proxy.org\"\nJSON_MODEL_API_KEY=\"sk-your_json_model_api_key_here\"\nJSON_MODEL_ID=\"gpt-4o-mini\"\n\n# =============================================================================\n# 模型选择配置 / Model Selection Configuration\n# =============================================================================\n\n# 确认模型的选择\n# Confirmation model selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nCONFIRMATION_MODEL=\"OPENAI\"\n\n# OpenAI模型的选择\n# OpenAI model selection\nOPENAI_MODEL=\"gpt-4o-mini\"\n\n# Claude模型的选择\n# Claude model selection\nCLAUDE_MODEL=\"claude-3-5-sonnet-20241022\"\n\n# 漏洞扫描模型\n# Vulnerability scanning model\nVUL_MODEL=\"gpt-4o-mini\"\n\n# =============================================================================\n# 扫描模式配置 / Scan Mode Configuration\n# =============================================================================\n\n# 扫描模式设置\n# Scan mode setting\n# 可选值: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN \n# / CHECKLIST / CHECKLIST_PIPELINE / COMMON_PROJECT_FINE_GRAINED\nSCAN_MODE=\"PURE_SCAN\"\n\n# API服务提供商选择\n# API service provider selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# =============================================================================\n# 性能配置 / Performance Configuration\n# =============================================================================\n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=5\n\n# 业务流程重复数量\n# Business flow repeat count\nBUSINESS_FLOW_COUNT=5\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# 每轮询问次数\n# Number of requests per round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# =============================================================================\n# 功能开关配置 / Feature Switch Configuration\n# =============================================================================\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# 是否启用文件代码扫描\n# Whether to enable file code scanning\nSWITCH_FILE_CODE=False\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# 是否启用对话模式\n# Whether to enable dialogue mode\nENABLE_DIALOGUE_MODE=False\n\n# 是否启用跨合约扫描\n# Whether to enable cross-contract scanning\nCROSS_CONTRACT_SCAN=True\n\n# =============================================================================\n# 迭代配置 / Iteration Configuration\n# =============================================================================\n\n# 项目清单生成迭代轮数\n# Number of iterations for project types generation\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# 检查清单生成迭代轮数\n# Number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n# 规划阶段的长度阈值\n# Length threshold for planning phase\nTHRESHOLD_OF_PLANNING=150\n```\n\n### 5. Project Configuration\nEdit `src/dataset/agent-v1-c4/datasets.json` to configure your projects:\n\n```json\n{\n \"YourProjectName\": {\n \"path\": \"relative_path_to_your_project\",\n \"files\": [],\n \"functions\": [],\n \"exclude_in_planning\": \"true\",\n \"exclude_directory\": [\"access\", \"errors\", \"events\", \"lib\", \"storage\"]\n }\n}\n```\n\n**Planning Optimization Notes:**\n- `THRESHOLD_OF_PLANNING`: Functions shorter than this value will be treated as context rather than main scanning targets\n- `exclude_in_planning` and `exclude_directory`: Contracts in specified directories will be treated as context only\n\n## 🚀 Usage\n\n### Running with Sample Data\n1. Choose a project name from `src/dataset/agent-v1-c4/datasets.json`\n2. Edit `src/main.py` line 146 to set the `project_id`:\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n start_time = time.time()\n db_url_from = os.environ.get(\"DATABASE_URL\")\n engine = create_engine(db_url_from)\n \n dataset_base = \"./src/dataset/agent-v1-c4\"\n projects = load_dataset(dataset_base)\n project_id = 'YourProjectName' # Set your project name here\n project_path = ''\n project = Project(project_id, projects[project_id])\n```\n3. Run the scanner:\n```bash\npython src/main.py\n```\n\n### Running with New Projects\n1. Place your code in `finite-monkey-engine/src/dataset/agent-v1-c4/` (recommended to include only files that need auditing)\n2. Add project configuration to `src/dataset/agent-v1-c4/datasets.json`\n3. Update `project_id` in `src/main.py`\n4. Execute `python src/main.py`\n\n### Analyzing Results\nCheck the `project_tasks_amazing_prompt` database table for scan results. Each record requires manual analysis to determine if it represents a valid vulnerability.\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n2. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*"}, "b3c7cb5644fcf915054100147676855387b8fd81": {"t": 1785764487.2910373, "n": 9527, "h": "37b1541bbe09f337", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 📋 Prerequisites\n\n### Python Environment\n- Python 3.11 (recommended, as Python 3.12 has package compatibility issues)\n- Use conda for environment management:\n```bash\nconda create -n py311 python=3.11\nconda activate py311\n```\n\n### PostgreSQL Database\n1. Install PostgreSQL:\n```bash\n# Install and start PostgreSQL (macOS)\nbrew install postgresql\nbrew services start postgresql\ninitdb /usr/local/var/postgres -E utf8\n\n# Connect to database\npsql postgres\n\n# Check databases\n\\l\n\n# Set password for database user\n\\password [your_username]\n\n# Exit connection\nexit\n```\n\n2. Install pgAdmin from [https://www.pgadmin.org/download/](https://www.pgadmin.org/download/) for database management\n - Host: 127.0.0.1\n - Port: 5432\n - Username: your database owner username\n - Password: as set above\n\n### AI API Configuration\nPurchase AI API access from [https://platform.closeai-asia.com/account/billing](https://platform.closeai-asia.com/account/billing)\nGet your API key from Developer Mode -> Key Management\n\n## 🛠️ Installation & Setup\n\n### 1. Get the Code\n```bash\ngit clone https://github.com/BradMoonUESTC/finite-monkey-engine.git\ncd finite-monkey-engine\npip install -r requirements.txt\n```\n\n### 2. Database Setup\nExecute the SQL file `src/db.sql` in pgAdmin to create the required tables. If you encounter ownership errors, modify `OWNER TO \"postgres\"` to use your actual database username.\n\n### 3. Sample Data (Optional)\nDownload the `concise_project_code` directory from [Google Drive](https://drive.google.com/drive/folders/1M3Fn3FOBX2EFAvBkXG4GVOT0ZlCmJgjQ) and place the files in `finite-monkey-engine/src/dataset/agent-v1-c4/`\n\n### 4. Environment Configuration\nCreate `src/.env` file with the following configuration:\n\n```env\n# =============================================================================\n# 数据库配置 / Database Configuration\n# =============================================================================\n\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:your_password@127.0.0.1:5432/your_database\n\n# =============================================================================\n# LLM API配置 / LLM API Configuration\n# =============================================================================\n\n# 所有LLM的基础URL（LLM中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform)\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# LLM中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=\"sk-your_openai_api_key_here\"\n\n# =============================================================================\n# 嵌入模型配置 / Embedding Model Configuration\n# =============================================================================\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\nEMBEDDING_API_BASE=\"api.openai-proxy.org\"\nEMBEDDING_API_KEY=\"sk-your_embedding_api_key_here\"\n\n# =============================================================================\n# JSON模型配置 / JSON Model Configuration\n# =============================================================================\n\nJSON_MODEL_API_BASE=\"api.openai-proxy.org\"\nJSON_MODEL_API_KEY=\"sk-your_json_model_api_key_here\"\nJSON_MODEL_ID=\"gpt-4o-mini\"\n\n# =============================================================================\n# 模型选择配置 / Model Selection Configuration\n# =============================================================================\n\n# 确认模型的选择\n# Confirmation model selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nCONFIRMATION_MODEL=\"OPENAI\"\n\n# OpenAI模型的选择\n# OpenAI model selection\nOPENAI_MODEL=\"gpt-4o-mini\"\n\n# Claude模型的选择\n# Claude model selection\nCLAUDE_MODEL=\"claude-3-5-sonnet-20241022\"\n\n# 漏洞扫描模型\n# Vulnerability scanning model\nVUL_MODEL=\"gpt-4o-mini\"\n\n# =============================================================================\n# 扫描模式配置 / Scan Mode Configuration\n# =============================================================================\n\n# 扫描模式设置\n# Scan mode setting\n# 可选值: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN \n# / CHECKLIST / CHECKLIST_PIPELINE / COMMON_PROJECT_FINE_GRAINED\nSCAN_MODE=\"PURE_SCAN\"\n\n# API服务提供商选择\n# API service provider selection\n# 可选值: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# =============================================================================\n# 性能配置 / Performance Configuration\n# =============================================================================\n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=5\n\n# 业务流程重复数量\n# Business flow repeat count\nBUSINESS_FLOW_COUNT=5\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# 每轮询问次数\n# Number of requests per round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# =============================================================================\n# 功能开关配置 / Feature Switch Configuration\n# =============================================================================\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=true\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=true\n\n# 是否启用文件代码扫描\n# Whether to enable file code scanning\nSWITCH_FILE_CODE=true\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=false\n\n# 是否启用对话模式\n# Whether to enable dialogue mode\nENABLE_DIALOGUE_MODE=false\n\n# 是否启用跨合约扫描\n# Whether to enable cross-contract scanning\nCROSS_CONTRACT_SCAN=true\n\n# =============================================================================\n# 迭代配置 / Iteration Configuration\n# =============================================================================\n\n# 项目清单生成迭代轮数\n# Number of iterations for project types generation\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# 检查清单生成迭代轮数\n# Number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n# 规划阶段的长度阈值\n# Length threshold for planning phase\nTHRESHOLD_OF_PLANNING=150\n```\n\n### 5. Project Configuration\nEdit `src/dataset/agent-v1-c4/datasets.json` to configure your projects:\n\n```json\n{\n \"YourProjectName\": {\n \"path\": \"relative_path_to_your_project\",\n \"files\": [],\n \"functions\": [],\n \"exclude_in_planning\": \"true\",\n \"exclude_directory\": [\"access\", \"errors\", \"events\", \"lib\", \"storage\"]\n }\n}\n```\n\n**Planning Optimization Notes:**\n- `THRESHOLD_OF_PLANNING`: Functions shorter than this value will be treated as context rather than main scanning targets\n- `exclude_in_planning` and `exclude_directory`: Contracts in specified directories will be treated as context only\n\n## 🚀 Usage\n\n### Running with Sample Data\n1. Choose a project name from `src/dataset/agent-v1-c4/datasets.json`\n2. Edit `src/main.py` line 146 to set the `project_id`:\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n start_time = time.time()\n db_url_from = os.environ.get(\"DATABASE_URL\")\n engine = create_engine(db_url_from)\n \n dataset_base = \"./src/dataset/agent-v1-c4\"\n projects = load_dataset(dataset_base)\n project_id = 'YourProjectName' # Set your project name here\n project_path = ''\n project = Project(project_id, projects[project_id])\n```\n3. Run the scanner:\n```bash\npython src/main.py\n```\n\n### Running with New Projects\n1. Place your code in `finite-monkey-engine/src/dataset/agent-v1-c4/` (recommended to include only files that need auditing)\n2. Add project configuration to `src/dataset/agent-v1-c4/datasets.json`\n3. Update `project_id` in `src/main.py`\n4. Execute `python src/main.py`\n\n### Analyzing Results\nCheck the `project_tasks_amazing_prompt` database table for scan results. Each record requires manual analysis to determine if it represents a valid vulnerability.\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n2. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*"}, "e04bcea22694a03d8a203fffae2937c24d72ee3c": {"t": 1785764489.4177668, "n": 7830, "h": "b9329c4dd74575ef", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 📋 Prerequisites\n\n### Python Environment\n- Python 3.11 (recommended, as Python 3.12 has package compatibility issues)\n- Use conda for environment management:\n```bash\nconda create -n py311 python=3.11\nconda activate py311\n```\n\n### PostgreSQL Database\n1. Install PostgreSQL:\n```bash\n# Install and start PostgreSQL (macOS)\nbrew install postgresql\nbrew services start postgresql\ninitdb /usr/local/var/postgres -E utf8\n\n# Connect to database\npsql postgres\n\n# Check databases\n\\l\n\n# Set password for database user\n\\password [your_username]\n\n# Exit connection\nexit\n```\n\n2. Install pgAdmin from [https://www.pgadmin.org/download/](https://www.pgadmin.org/download/) for database management\n - Host: 127.0.0.1\n - Port: 5432\n - Username: your database owner username\n - Password: as set above\n\n### AI API Configuration\nPurchase AI API access from [https://platform.closeai-asia.com/account/billing](https://platform.closeai-asia.com/account/billing)\nGet your API key from Developer Mode -> Key Management\n\n## 🛠️ Installation & Setup\n\n### 1. Get the Code\n```bash\ngit clone https://github.com/BradMoonUESTC/finite-monkey-engine.git\ncd finite-monkey-engine\npip install -r requirements.txt\n```\n\n### 2. Database Setup\nExecute the SQL file `src/db.sql` in pgAdmin to create the required tables. If you encounter ownership errors, modify `OWNER TO \"postgres\"` to use your actual database username.\n\n### 3. Sample Data (Optional)\nDownload the `concise_project_code` directory from [Google Drive](https://drive.google.com/drive/folders/1M3Fn3FOBX2EFAvBkXG4GVOT0ZlCmJgjQ) and place the files in `finite-monkey-engine/src/dataset/agent-v1-c4/`\n\n### 4. Environment Configuration\nCreate `src/.env` file with the following configuration:\n\n```env\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Base URL for all LLM requests (LLM proxy platform) used for API requests\nOPENAI_API_BASE=\"localhost:3010\"\n\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\nEMBEDDING_API_BASE=\"api.openai-proxy.org\"\nEMBEDDING_API_KEY=\"your-embedding-api-key\"\n\n# JSON model configuration\nJSON_MODEL_API_BASE=\"api.openai-proxy.org\"\nJSON_MODEL_API_KEY=\"your-json-model-api-key\"\n\n# API key for LLM proxy platform\nOPENAI_API_KEY=\"your-openai-api-key\"\n\n# Confirmation model selection, using DeepSeek model\nCONFIRMATION_MODEL=\"DEEPSEEK\"\n\n# OpenAI model selection, using GPT-4.1\nOPENAI_MODEL=\"gpt-4.1\"\n\n# Claude model selection, using Claude 4 Sonnet version\nCLAUDE_MODEL=claude-4-sonnet\n\n# Vulnerability scanning model\nVUL_MODEL=claude-4-sonnet\n\n# Scan mode settings\n# Available options: \n# - SPECIFIC_PROJECT (specific project checklist)\n# - OPTIMIZE (code suggestion mode)\n# - COMMON_PROJECT (common project checklist single query)\n# - PURE_SCAN (pure scanning)\n# - CHECKLIST (automatic checklist generation)\n# - CHECKLIST_PIPELINE (checklist generation + pipeline)\n# - COMMON_PROJECT_FINE_GRAINED (common project checklist individual queries, 10x cost increase)\nSCAN_MODE=PURE_SCAN\n\n# API service provider selection\n# Available options: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=50\n\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=10\n\n# Business flow repeat count (number of hallucinations triggered, higher number means more hallucinations, more output, longer time)\nBUSINESS_FLOW_COUNT=1\n\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# Number of requests per confirmation round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# JSON model ID\nJSON_MODEL_ID=\"gpt-4.1\"\n\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# Set the number of iterations for project types of a specific language generation\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# Set the number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n# Whether to enable dialogue mode\nENABLE_DIALOGUE_MODE=False\n\n# Whether to enable cross-contract scanning\nCROSS_CONTRACT_SCAN=True\n\n# Length threshold for planning phase\nTHRESHOLD_OF_PLANNING=50\n```\n\n### 5. Project Configuration\nEdit `src/dataset/agent-v1-c4/datasets.json` to configure your projects:\n\n```json\n{\n \"YourProjectName\": {\n \"path\": \"relative_path_to_your_project\",\n \"files\": [],\n \"functions\": [],\n \"exclude_in_planning\": \"true\",\n \"exclude_directory\": [\"access\", \"errors\", \"events\", \"lib\", \"storage\"]\n }\n}\n```\n\n**Planning Optimization Notes:**\n- `THRESHOLD_OF_PLANNING`: Functions shorter than this value will be treated as context rather than main scanning targets\n- `exclude_in_planning` and `exclude_directory`: Contracts in specified directories will be treated as context only\n\n## 🚀 Usage\n\n### Running with Sample Data\n1. Choose a project name from `src/dataset/agent-v1-c4/datasets.json`\n2. Edit `src/main.py` line 146 to set the `project_id`:\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n start_time = time.time()\n db_url_from = os.environ.get(\"DATABASE_URL\")\n engine = create_engine(db_url_from)\n \n dataset_base = \"./src/dataset/agent-v1-c4\"\n projects = load_dataset(dataset_base)\n project_id = 'YourProjectName' # Set your project name here\n project_path = ''\n project = Project(project_id, projects[project_id])\n```\n3. Run the scanner:\n```bash\npython src/main.py\n```\n\n### Running with New Projects\n1. Place your code in `finite-monkey-engine/src/dataset/agent-v1-c4/` (recommended to include only files that need auditing)\n2. Add project configuration to `src/dataset/agent-v1-c4/datasets.json`\n3. Update `project_id` in `src/main.py`\n4. Execute `python src/main.py`\n\n### Analyzing Results\nCheck the `project_tasks_amazing_prompt` database table for scan results. Each record requires manual analysis to determine if it represents a valid vulnerability.\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n2. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*"}, "b0f9e3ddc408f121de5ff28cc1bdbd7b01c14d89": {"t": 1785764490.8024435, "n": 6287, "h": "e51addf5c84cf8fa", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 🚀 Latest Updates\n\n**2024.11.19**: Released version 1.0 - Validated LLM-based auditing and productization feasibility\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added Func, Tact language support\n- 2024.07.23: Added Cairo, Move language support\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive rate (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Requirements\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Installation & Configuration\n\n1. Place project in `src/dataset/agent-v1-c4` directory\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database connection URL, using PostgreSQL database\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Base URL for all LLMs (LLM proxy platform), used for API requests\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\n\n# API key for LLM proxy platform\nOPENAI_API_KEY=your-api-key\n\n# Confirmation model selection, using DeepSeek model\nCONFIRMATION_MODEL=\"DEEPSEEK\"\n\n# OpenAI model selection, using GPT-4 Turbo\nOPENAI_MODEL=gpt-4-turbo\n\n# Claude model selection, using Claude 3.5 Sonnet version\nCLAUDE_MODEL=claude-3-5-sonnet-20241022\n\n# Scan mode settings\n# Available values: SPECIFIC_PROJECT (specific project checklist) / OPTIMIZE (code suggestion mode)\n# / COMMON_PROJECT (common project checklist single query) / PURE_SCAN (pure scanning)\n# / CHECKLIST (automatic checklist generation) / CHECKLIST_PIPELINE (checklist generation + pipeline)\n# / COMMON_PROJECT_FINE_GRAINED (common project checklist individual queries, 10x cost increase, currently best results)\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\n\n# API service provider selection\n# Available values: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# Maximum threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=50\n\n# Maximum threads for scanning phase\nMAX_THREADS_OF_SCAN=10\n\n# Business flow repeat count\nBUSINESS_FLOW_COUNT=10\n\n# Enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# Enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# Maximum confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# Requests per confirmation round\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# JSON model ID\nJSON_MODEL_ID=\"gpt-4-turbo\"\n\n# Enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# Set project type generation iteration rounds\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# Set checklist generation iteration rounds\nCHECKLIST_ITERATION_ROUNDS=3\n\n# Enable dialogue mode\nENABLE_DIALOGUE_MODE=True\n\n```\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n3. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for best results\n- Average scan time for medium-sized projects: 2-3 hours\n- Estimated cost for 10 iterations on medium projects: $20-30\n- Current false positive rate: 30-65% (depends on project size)\n\n## 🔍 Technical Notes\n1. Claude 3.5 Sonnet provides better scanning results while maintaining acceptable time costs\n2. Deceptive prompt theory can be adapted to any language with minor modifications\n3. ANTLR AST parsing recommended for better code slicing results\n4. Currently supports multiple languages with plans for expansion\n5. DeepSeek recommended for better confirmation results\n6. New dialogue mode support enables more flexible interaction\n7. Supports multi-round iteration for project types and checklist generation\n\n## 🛡️ Scanning Features\n\n- Excels at code understanding and logic vulnerability detection\n- Weaker at control flow vulnerability detection\n- Designed for real projects, not academic test cases\n\n## 💡 Implementation Tips\n\n- Progress automatically saved for each scan\n- Claude-3.5-Sonnet provides best performance for scanning compared to other models\n- DeepSeek provides best performance for confirmation compared to other models\n- 10 iterations for medium-sized projects takes about 4 hours\n- Results include detailed categorization\n- Supports fine-grained common project checklist with individual questioning mode\n- Configurable confirmation rounds and queries per round\n- Flexible thread control with separate settings for scanning and confirmation phases\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n\nWould you like me to explain or break down the code?"}, "8cdbfb946d0c76c83f3ea1b6d190c49d2e74930b": {"t": 1785764492.6310303, "n": 5659, "h": "d05c52c15b34934f", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 🚀 Latest Updates\n\n**2024.11.19**: Released version 1.0 - Validated LLM-based auditing and productization feasibility\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added Func, Tact language support\n- 2024.07.23: Added Cairo, Move language support\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive rate (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Requirements\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Installation & Configuration\n\n1. Place project in `src/dataset/agent-v1-c4` directory\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# 数据库连接URL，使用PostgreSQL数据库\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# 所有llm的基础URL（llm中转平台），用于API请求\nOPENAI_API_BASE=\"api.openai-proxy.org\"\n\n# 用于文本嵌入的模型名称\nEMBEDDING_MODEL=\"text-embedding-3-large\"\n\n# llm中转平台的API密钥\nOPENAI_API_KEY=your-api-key\n\n# 确认模型的选择，使用DeepSeek模型\nCONFIRMATION_MODEL=\"DEEPSEEK\"\n\n# OpenAI模型的选择，使用GPT-4 Turbo\nOPENAI_MODEL=gpt-4-turbo\n\n# Claude模型的选择，使用Claude 3.5 Sonnet版本\nCLAUDE_MODEL=claude-3-5-sonnet-20241022\n\n# 扫描模式设置\n# 可选值：SPECIFIC_PROJECT(特定项目CHECKLIST) / OPTIMIZE(代码建议模式) \n# / COMMON_PROJECT(通用项目CHECKLIST一次性提问) / PURE_SCAN(纯扫描) \n# / CHECKLIST(检查清单自动生成) / CHECKLIST_PIPELINE(检查清单自动生成+pipeline)\n# / COMMON_PROJECT_FINE_GRAINED(通用项目CHECKLIST逐个提问，成本会提升10倍，效果当前最好)\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\n\n# API服务提供商选择\n# 可选值：OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\"\n\n# 确认阶段的最大线程数\nMAX_THREADS_OF_CONFIRMATION=50\n\n# 扫描阶段的最大线程数\nMAX_THREADS_OF_SCAN=10\n\n# 业务流程重复数量\nBUSINESS_FLOW_COUNT=10\n\n# 是否启用函数代码扫描\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\nSWITCH_BUSINESS_CODE=True\n\n# 最大确认轮数\nMAX_CONFIRMATION_ROUNDS=2\n\n# 每轮询问次数\nREQUESTS_PER_CONFIRMATION_ROUND=3\n\n# JSON模型ID\nJSON_MODEL_ID=\"gpt-4-turbo\"\n\n# 是否启用网络搜索\nENABLE_INTERNET_SEARCH=False\n\n# 设置项目清单生成迭代轮数\nPROJECT_TYPE_ITERATION_ROUNDS=3\n\n# 设置检查清单生成迭代轮数\nCHECKLIST_ITERATION_ROUNDS=3\n\n# 是否启用对话模式\nENABLE_DIALOGUE_MODE=True\n\n```\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n3. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for best results\n- Average scan time for medium-sized projects: 2-3 hours\n- Estimated cost for 10 iterations on medium projects: $20-30\n- Current false positive rate: 30-65% (depends on project size)\n\n## 🔍 Technical Notes\n1. Claude 3.5 Sonnet provides better scanning results while maintaining acceptable time costs\n2. Deceptive prompt theory can be adapted to any language with minor modifications\n3. ANTLR AST parsing recommended for better code slicing results\n4. Currently supports multiple languages with plans for expansion\n5. DeepSeek recommended for better confirmation results\n6. New dialogue mode support enables more flexible interaction\n7. Supports multi-round iteration for project types and checklist generation\n\n## 🛡️ Scanning Features\n\n- Excels at code understanding and logic vulnerability detection\n- Weaker at control flow vulnerability detection\n- Designed for real projects, not academic test cases\n\n## 💡 Implementation Tips\n\n- Progress automatically saved for each scan\n- Claude-3.5-Sonnet provides best performance for scanning compared to other models\n- DeepSeek provides best performance for confirmation compared to other models\n- 10 iterations for medium-sized projects takes about 4 hours\n- Results include detailed categorization\n- Supports fine-grained common project checklist with individual questioning mode\n- Configurable confirmation rounds and queries per round\n- Flexible thread control with separate settings for scanning and confirmation phases\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n\nWould you like me to explain or break down the code?"}, "7e54a71dab0638ed008f14992459d20ecd938996": {"t": 1785764494.1917765, "n": 6212, "h": "80c38dc69a5dd3ee", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 🚀 Latest Updates\n\n**2024.11.19**: Released version 1.0 - Validated LLM-based auditing and productization feasibility\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added Func, Tact language support\n- 2024.07.23: Added Cairo, Move language support\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive rate (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Requirements\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Installation & Configuration\n\n1. Place project in `src/dataset/agent-v1-c4` directory\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# 所有llm的基础URL（llm中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform) used for API requests\nOPENAI_API_BASE=\"4.0.wokaai.com\"\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\n\n# llm中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=your-api-key（通常建议从openrouter和wokaai获取，一次性多个模型）\n\n# 确认模型的选择，使用DeepSeek模型\n# Confirmation model selection, using DeepSeek model\nCONFIRMATION_MODEL=\"DEEPSEEK\"\n\n# OpenAI模型的选择，使用GPT-4 Turbo\n# OpenAI model selection, using GPT-4 Turbo\nOPENAI_MODEL=gpt-4-turbo\n\n# Claude模型的选择，使用Claude 3.5 Sonnet版本\n# Claude model selection, using Claude 3.5 Sonnet version\nCLAUDE_MODEL=claude-3-5-sonnet-20241022\n\n# 扫描模式设置，当前为纯扫描模式\n# Scan mode setting, currently set to pure scan mode\n# 可选值：SPECIFIC_PROJECT(特定项目CHECKLIST) / OPTIMIZE(代码建议模式) / COMMON_PROJECT(通用项目CHECKLIST) / PURE_SCAN(纯扫描) \n# / CHECKLIST(检查清单自动生成) / CHECKLIST_PIPELINE(检查清单自动生成+pipeline)\n# Available options: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN \n# / CHECKLIST / CHECKLIST_PIPELINE \nSCAN_MODE=CHECKLIST_PIPELINE \n\n# API服务提供商选择\n# API service provider selection\n# 可选值：OPENAI / AZURE / CLAUDE / DEEPSEEK\n# Available options: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\" \n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=20\n\n# 业务流程重复数量（触发幻觉的数量，数字越大幻觉越多，输出越多，时间越长）\n# Business flow repeat count (number of hallucinations triggered, higher number means more hallucinations, more output, longer time)\nBUSINESS_FLOW_COUNT=10\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# JSON模型ID\n# JSON model ID\nJSON_MODEL_ID=\"gpt-4-turbo\"\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n# 设置检查清单生成迭代轮数\n# Set the number of iterations for checklist generation\nCHECKLIST_ITERATION_ROUNDS=3\n\n```\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n3. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for best results\n- Average scan time for medium-sized projects: 2-3 hours\n- Estimated cost for 10 iterations on medium projects: $20-30\n- Current false positive rate: 30-65% (depends on project size)\n\n## 🔍 Technical Notes\n\n1. claude 3.5 sonnet in scanning provides better results with acceptable time cost, GPT-3 not fully tested\n2. Deceptive prompt theory adaptable to any language with minor modifications\n3. ANTLR AST parsing recommended for better code slicing results\n4. Currently supports Solidity, plans to expand language support\n5. DeepSeek-R1 is recommended for better confirmation results\n## 🛡️ Scanning Features\n\n- Excels at code understanding and logic vulnerability detection\n- Weaker at control flow vulnerability detection\n- Designed for real projects, not academic test cases\n\n## 💡 Implementation Tips\n\n- Progress automatically saved per scan\n- claude-3.5-sonnet offers best performance in scanning compared to other models\n- deepseek-R1 offers best performance in confirmation compared to other models\n- 10 iterations for medium projects take about 4 hours\n- Results include detailed categorization\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n\nWould you like me to explain or break down the code?"}, "75a57a4ddb35116c537c12dd9c651d80584bffa7": {"t": 1785764495.5530972, "n": 6040, "h": "ff32905e55d03c40", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 🚀 Latest Updates\n\n**2024.11.19**: Released version 1.0 - Validated LLM-based auditing and productization feasibility\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added Func, Tact language support\n- 2024.07.23: Added Cairo, Move language support\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive rate (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Requirements\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Installation & Configuration\n\n1. Place project in `src/dataset/agent-v1-c4` directory\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# 数据库连接URL，使用PostgreSQL数据库\n# Database connection URL using PostgreSQL\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# 所有llm的基础URL（llm中转平台），用于API请求\n# Base URL for all LLM requests (LLM proxy platform) used for API requests\nOPENAI_API_BASE=\"4.0.wokaai.com\"\n\n# 用于文本嵌入的模型名称\n# Model name used for text embeddings\nEMBEDDING_MODEL=\"text-embedding-3-large\"\n\n# llm中转平台的API密钥\n# API key for LLM proxy platform\nOPENAI_API_KEY=your-api-key（通常建议从openrouter和wokaai获取，一次性多个模型）\n\n# 确认模型的选择，使用DeepSeek模型\n# Confirmation model selection, using DeepSeek model\nCONFIRMATION_MODEL=\"DEEPSEEK\"\n\n# OpenAI模型的选择，使用GPT-4 Turbo\n# OpenAI model selection, using GPT-4 Turbo\nOPENAI_MODEL=gpt-4-turbo\n\n# Claude模型的选择，使用Claude 3.5 Sonnet版本\n# Claude model selection, using Claude 3.5 Sonnet version\nCLAUDE_MODEL=claude-3-5-sonnet-20241022\n\n# 扫描模式设置，当前为纯扫描模式\n# Scan mode setting, currently set to pure scan mode\n# 可选值：SPECIFIC_PROJECT(特定项目CHECKLIST) / OPTIMIZE(代码建议模式) / COMMON_PROJECT(通用项目CHECKLIST) / PURE_SCAN(纯扫描) / CHECKLIST(检查清单自动生成)\n# Available options: SPECIFIC_PROJECT / OPTIMIZE / COMMON_PROJECT / PURE_SCAN / CHECKLIST\nSCAN_MODE=SPECIFIC_PROJECT \n\n# API服务提供商选择\n# API service provider selection\n# 可选值：OPENAI / AZURE / CLAUDE / DEEPSEEK\n# Available options: OPENAI / AZURE / CLAUDE / DEEPSEEK\nAZURE_OR_OPENAI=\"OPENAI\" \n\n# 确认阶段的最大线程数\n# Maximum number of threads for confirmation phase\nMAX_THREADS_OF_CONFIRMATION=10\n\n# 扫描阶段的最大线程数\n# Maximum number of threads for scanning phase\nMAX_THREADS_OF_SCAN=20\n\n# 业务流程重复数量（触发幻觉的数量，数字越大幻觉越多，输出越多，时间越长）\n# Business flow repeat count (number of hallucinations triggered, higher number means more hallucinations, more output, longer time)\nBUSINESS_FLOW_COUNT=10\n\n# 是否启用函数代码扫描\n# Whether to enable function code scanning\nSWITCH_FUNCTION_CODE=False\n\n# 是否启用业务代码扫描\n# Whether to enable business code scanning\nSWITCH_BUSINESS_CODE=True\n\n# 最大确认轮数\n# Maximum number of confirmation rounds\nMAX_CONFIRMATION_ROUNDS=2\n\n# JSON模型ID\n# JSON model ID\nJSON_MODEL_ID=\"gpt-4-turbo\"\n\n# 是否启用网络搜索\n# Whether to enable internet search\nENABLE_INTERNET_SEARCH=False\n\n```\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n3. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for best results\n- Average scan time for medium-sized projects: 2-3 hours\n- Estimated cost for 10 iterations on medium projects: $20-30\n- Current false positive rate: 30-65% (depends on project size)\n\n## 🔍 Technical Notes\n\n1. claude 3.5 sonnet in scanning provides better results with acceptable time cost, GPT-3 not fully tested\n2. Deceptive prompt theory adaptable to any language with minor modifications\n3. ANTLR AST parsing recommended for better code slicing results\n4. Currently supports Solidity, plans to expand language support\n5. DeepSeek-R1 is recommended for better confirmation results\n## 🛡️ Scanning Features\n\n- Excels at code understanding and logic vulnerability detection\n- Weaker at control flow vulnerability detection\n- Designed for real projects, not academic test cases\n\n## 💡 Implementation Tips\n\n- Progress automatically saved per scan\n- claude-3.5-sonnet offers best performance in scanning compared to other models\n- deepseek-R1 offers best performance in confirmation compared to other models\n- 10 iterations for medium projects take about 4 hours\n- Results include detailed categorization\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n\nWould you like me to explain or break down the code?"}, "6d03945c0244bf3b3c6ae69325f8f76a7f6a29bd": {"t": 1785764496.8999972, "n": 4596, "h": "ffa54c71d3efea88", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n</p>\n\nFiniteMonkey is an intelligent vulnerability mining engine based on large language models, requiring no pre-trained knowledge base or fine-tuning. Its core feature is using task-driven and prompt engineering approaches to guide models in vulnerability analysis through carefully designed prompts.\n\n## 🌟 Core Concepts\n\n- **Task-driven rather than problem-driven**\n- **Prompt-driven rather than code-driven**\n- **Focus on prompt design rather than model design**\n- **Leverage \"deception\" and hallucination as key mechanisms**\n\n## 🏆 Achievements\n\nAs of May 2024, this tool has helped discover over $60,000 worth of bug bounties.\n\n## 🚀 Latest Updates\n\n**2024.11.19**: Released version 1.0 - Validated LLM-based auditing and productization feasibility\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added Func, Tact language support\n- 2024.07.23: Added Cairo, Move language support\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive rate (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Requirements\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Installation & Configuration\n\n1. Place project in `src/dataset/agent-v1-c4` directory\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database connection\nDATABASE_URL=postgresql://user:password@localhost:5432/dbname\n\n# API settings\nOPENAI_API_BASE=\"api.example.com\"\nOPENAI_API_KEY=sk-your-api-key-here\n\n# Model settings\nVUL_MODEL_ID=gpt-4-turbo\nCLAUDE_MODEL=claude-3-5-sonnet-20240620\n\n# Azure configuration\nAZURE_API_KEY=\"your-azure-api-key\"\nAZURE_API_BASE=\"https://your-resource.openai.azure.com/\"\nAZURE_API_VERSION=\"2024-02-15-preview\"\nAZURE_DEPLOYMENT_NAME=\"your-deployment\"\n\n# API selection\nAZURE_OR_OPENAI=\"OPENAI\" # Options: OPENAI, AZURE, CLAUDE\n\n# Scan parameters\nBUSINESS_FLOW_COUNT=4\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Pseudo-Solidity (.fr) - For scanning Solidity pseudocode\n\n## 📊 Scan Results Guide\n\n1. If interrupted due to network/API issues, resume scanning using the same project_id in main.py\n3. Results include detailed annotations:\n - Focus on entries marked \"yes\" in result column\n - Filter \"dont need In-project other contract\" in category column\n - Check specific code in business_flow_code column\n - Find code location in name column\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for best results\n- Average scan time for medium-sized projects: 2-3 hours\n- Estimated cost for 10 iterations on medium projects: $20-30\n- Current false positive rate: 30-65% (depends on project size)\n\n## 🔍 Technical Notes\n\n1. claude 3.5 sonnet in scanning provides better results with acceptable time cost, GPT-3 not fully tested\n2. Deceptive prompt theory adaptable to any language with minor modifications\n3. ANTLR AST parsing recommended for better code slicing results\n4. Currently supports Solidity, plans to expand language support\n5. DeepSeek-R1 is recommended for better confirmation results\n## 🛡️ Scanning Features\n\n- Excels at code understanding and logic vulnerability detection\n- Weaker at control flow vulnerability detection\n- Designed for real projects, not academic test cases\n\n## 💡 Implementation Tips\n\n- Progress automatically saved per scan\n- claude-3.5-sonnet offers best performance in scanning compared to other models\n- deepseek-R1 offers best performance in confirmation compared to other models\n- 10 iterations for medium projects take about 4 hours\n- Results include detailed categorization\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nPull Requests welcome!\n\n---\n\n*Note: Project name inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n\nWould you like me to explain or break down the code?"}, "ecabb4ebd95eb652f38f76f9a5092469024e034c": {"t": 1785764498.3221598, "n": 5136, "h": "8d3bd214e5dec14a", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Place project under `src/dataset/agent-v1-c4`\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database Connection\nDATABASE_URL=postgresql://user:password@localhost:5432/dbname\n\n# API Settings\nOPENAI_API_BASE=\"api.example.com\"\nOPENAI_API_KEY=sk-your-api-key-here\n\n# Model Settings\nVUL_MODEL_ID=gpt-4-turbo\nCLAUDE_MODEL=claude-3-5-sonnet-20240620\n\n# Azure Configuration\nAZURE_API_KEY=\"your-azure-api-key\"\nAZURE_API_BASE=\"https://your-resource.openai.azure.com/\"\nAZURE_API_VERSION=\"2024-02-15-preview\"\nAZURE_DEPLOYMENT_NAME=\"your-deployment\"\n\n# API Choice\nAZURE_OR_OPENAI=\"OPENAI\" # Options: OPENAI, AZURE, CLAUDE\n\n# Scan Parameters\nBUSINESS_FLOW_COUNT=4\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n\n# Scan Focus Configuration\n# SCAN_FOCUS=[\n# \"Contract1\",\n# \"Contract2\",\n# \"Contract3\"\n# ]\n```\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Fake Solidity (.fr) - For scanning Solidity pseudocode\n\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: The name is inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "d2245affa3a14bd258547a541ac8f800cf87e0d3": {"t": 1785764499.563711, "n": 5137, "h": "ff44748728b539c5", "c": "# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"@image.jpeg\" width=\"500\">\n</p>\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Place project under `src/dataset/agent-v1-c4`\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database Connection\nDATABASE_URL=postgresql://user:password@localhost:5432/dbname\n\n# API Settings\nOPENAI_API_BASE=\"api.example.com\"\nOPENAI_API_KEY=sk-your-api-key-here\n\n# Model Settings\nVUL_MODEL_ID=gpt-4-turbo\nCLAUDE_MODEL=claude-3-5-sonnet-20240620\n\n# Azure Configuration\nAZURE_API_KEY=\"your-azure-api-key\"\nAZURE_API_BASE=\"https://your-resource.openai.azure.com/\"\nAZURE_API_VERSION=\"2024-02-15-preview\"\nAZURE_DEPLOYMENT_NAME=\"your-deployment\"\n\n# API Choice\nAZURE_OR_OPENAI=\"OPENAI\" # Options: OPENAI, AZURE, CLAUDE\n\n# Scan Parameters\nBUSINESS_FLOW_COUNT=4\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n\n# Scan Focus Configuration\n# SCAN_FOCUS=[\n# \"Contract1\",\n# \"Contract2\",\n# \"Contract3\"\n# ]\n```\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Fake Solidity (.fr) - For scanning Solidity pseudocode\n\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: The name is inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "79b3e2741735bcaceb6715ab2ac55a0f3a3bca63": {"t": 1785764500.857413, "n": 5075, "h": "c065122f753e94de", "c": "\n# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Place project under `src/dataset/agent-v1-c4`\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database Connection\nDATABASE_URL=postgresql://user:password@localhost:5432/dbname\n\n# API Settings\nOPENAI_API_BASE=\"api.example.com\"\nOPENAI_API_KEY=sk-your-api-key-here\n\n# Model Settings\nVUL_MODEL_ID=gpt-4-turbo\nCLAUDE_MODEL=claude-3-5-sonnet-20240620\n\n# Azure Configuration\nAZURE_API_KEY=\"your-azure-api-key\"\nAZURE_API_BASE=\"https://your-resource.openai.azure.com/\"\nAZURE_API_VERSION=\"2024-02-15-preview\"\nAZURE_DEPLOYMENT_NAME=\"your-deployment\"\n\n# API Choice\nAZURE_OR_OPENAI=\"OPENAI\" # Options: OPENAI, AZURE, CLAUDE\n\n# Scan Parameters\nBUSINESS_FLOW_COUNT=4\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n\n# Scan Focus Configuration\n# SCAN_FOCUS=[\n# \"Contract1\",\n# \"Contract2\",\n# \"Contract3\"\n# ]\n```\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Fake Solidity (.fr) - For scanning Solidity pseudocode\n\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nApache License 2.0\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: The name is inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "f4dda019f37a8cd009fae18814d9167045eeb870": {"t": 1785764503.1153102, "n": 5098, "h": "bdb2d2f06da63243", "c": "\n# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Place project under `src/dataset/agent-v1-c4`\n\n2. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n3. Create database using `src/db.sql`\n\n4. Configure `.env`:\n```env\n# Database Connection\nDATABASE_URL=postgresql://user:password@localhost:5432/dbname\n\n# API Settings\nOPENAI_API_BASE=\"api.example.com\"\nOPENAI_API_KEY=sk-your-api-key-here\n\n# Model Settings\nVUL_MODEL_ID=gpt-4-turbo\nCLAUDE_MODEL=claude-3-5-sonnet-20240620\n\n# Azure Configuration\nAZURE_API_KEY=\"your-azure-api-key\"\nAZURE_API_BASE=\"https://your-resource.openai.azure.com/\"\nAZURE_API_VERSION=\"2024-02-15-preview\"\nAZURE_DEPLOYMENT_NAME=\"your-deployment\"\n\n# API Choice\nAZURE_OR_OPENAI=\"OPENAI\" # Options: OPENAI, AZURE, CLAUDE\n\n# Scan Parameters\nBUSINESS_FLOW_COUNT=4\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n\n# Scan Focus Configuration\n# SCAN_FOCUS=[\n# \"Contract1\",\n# \"Contract2\",\n# \"Contract3\"\n# ]\n```\n## 🌈 Supported Languages\n\n- Solidity (.sol)\n- Rust (.rs)\n- Python (.py)\n- Move (.move)\n- Cairo (.cairo)\n- Tact (.tact)\n- Func (.fc)\n- Java (.java)\n- Fake Solidity (.fr) - For scanning Solidity pseudocode\n\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nGNU General Public License v3.0 (GPL-3.0)\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: The name is inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "3bef7c4386c8ec465a9f36fbc7e96fecf2b1bdbb": {"t": 1785764504.3597703, "n": 4529, "h": "2ba7ddb216989847", "c": "\n# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Configure test environment in `src/main.py`:\n```python\nswitch_production_or_test = 'test'\n```\n\n2. Place project under `src/dataset/agent-v1-c4`\n\n3. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n4. Create database using `src/db.sql`\n\n5. Configure `.env`:\n```env\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\nOPENAI_API_BASE=\"api.openai.com\"\nOPENAI_API_KEY=xxxxxx\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\nBUSINESS_FLOW_COUNT=10\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nGNU General Public License v3.0 (GPL-3.0)\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: The name is inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "4c4a78ec24cd2950a4c01f1d532977676ba32aac": {"t": 1785764505.9690566, "n": 4528, "h": "651234c5bd945e46", "c": "\n# FiniteMonkey\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMonkey is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-monkey-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Configure test environment in `src/main.py`:\n```python\nswitch_production_or_test = 'test'\n```\n\n2. Place project under `src/dataset/agent-v1-c4`\n\n3. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n4. Create database using `src/db.sql`\n\n5. Configure `.env`:\n```env\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\nOPENAI_API_BASE=\"api.openai.com\"\nOPENAI_API_KEY=xxxxxx\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\nBUSINESS_FLOW_COUNT=10\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nGNU General Public License v3.0 (GPL-3.0)\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: Originally inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "bec9b237d9e2853068aa4402c2b11d0677b2694a": {"t": 1785764507.3804283, "n": 4532, "h": "37622e153141b1e4", "c": "\n# FiniteMoney\n\n<p align=\"center\">\n <img src=\"https://img.shields.io/badge/license-GPL--3.0-blue.svg\">\n <img src=\"https://img.shields.io/badge/version-1.0-green.svg\">\n <img src=\"https://img.shields.io/badge/bounties-$60,000+-yellow.svg\">\n <img src=\"https://img.shields.io/github/forks/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n <img src=\"https://img.shields.io/github/stars/BradMoonUESTC/finite-monkey-engine?style=flat-square\">\n</p>\n\nFiniteMoney is an advanced vulnerability mining engine powered purely by GPT, requiring no prior knowledge base or fine-tuning. Its effectiveness significantly surpasses most current related research approaches.\n\n## 🌟 Core Philosophy\n\n- **Task-driven, not question-driven**\n- **Prompt-driven, not code-driven** \n- **Focus on prompt design, not model design**\n- **Leveraging \"deception\" and hallucination as key mechanics**\n\n## 🏆 Results\n\nAs of May 2024, this tool has helped identify vulnerabilities worth over $60,000 in bounties.\n\n<img width=\"1258\" alt=\"Bounty Results\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n## 🚀 Recent Updates\n\n**2024.11.19**: Version 1.0 released - Demonstrating feasibility of LLM-based auditing and productization\n\n**Earlier Updates:**\n- 2024.08.02: Project renamed to finite-money-prompt-engine\n- 2024.08.01: Added support for func, tact\n- 2024.07.23: Added support for cairo, move\n- 2024.07.01: Updated license\n- 2024.06.01: Added Python language support\n- 2024.05.18: Improved false positive reduction (~20%)\n- 2024.05.16: Added cross-contract vulnerability confirmation\n- 2024.04.29: Added basic Rust language support\n\n## 📋 Prerequisites\n\n- PostgreSQL database\n- OpenAI API access\n- Python environment\n\n## 🛠️ Setup & Configuration\n\n1. Configure test environment in `src/main.py`:\n```python\nswitch_production_or_test = 'test'\n```\n\n2. Place project under `src/dataset/agent-v1-c4`\n\n3. Configure project in `datasets.json`:\n```json\n{\n \"StEverVault2\": {\n \"path\": \"StEverVault\",\n \"files\": [],\n \"functions\": []\n }\n}\n```\n\n4. Create database using `src/db.sql`\n\n5. Configure `.env`:\n```env\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\nOPENAI_API_BASE=\"api.openai.com\"\nOPENAI_API_KEY=xxxxxx\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\nBUSINESS_FLOW_COUNT=10\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n## 📊 Scanning Results Guide\n\n1. Scans can be resumed if interrupted due to network/API issues by rerunning main.py with same project_id\n2. Strongly recommend using GPT-4-turbo - GPT-3.5 and GPT-4.0 have inferior reasoning capabilities\n3. Results are marked with detailed annotations and Chinese explanations:\n - Prioritize entries with `\"result\":\"yes\"` in result column\n - Filter for `\"dont need In-project other contract\"` in category column\n - Check business_flow_code column for specific code\n - Reference name column for code locations\n\n## 🎯 Important Notes\n\n- Best suited for logic vulnerability mining in real projects\n- Not recommended for academic vulnerability testing\n- GPT-4-turbo recommended for optimal results\n- Average scan time: 2-3 hours for medium projects\n- Cost estimate: $20-30 for medium projects with 10 iterations\n- Current false positive rate: 30-65% depending on project size\n\n## 🔍 Technical Notes\n\n1. GPT-4 provides better results, GPT-3 not thoroughly tested\n2. The tricky prompt theory can be adapted for any language with minor modifications\n3. ANTLR AST parsing support recommended for better code slicing results\n4. Currently supports Solidity with plans for expansion\n\n## 🗺️ Roadmap\n\n1. Code structure optimization\n2. Additional language support\n3. Documentation and code analysis\n4. Command line interface implementation\n\n## 🛡️ Scanning Characteristics\n\n- Excellent at code comprehension and logic vulnerability detection\n- Less effective for control flow vulnerability detection\n- Designed for real-world projects rather than academic test cases\n\n## 💡 Implementation Tips\n\n- Each scan preserves progress automatically\n- GPT-4-turbo provides optimal performance compared to other models\n- Medium projects with 10 iterations take approximately 2.5 hours\n- Results include detailed categorization and Chinese explanations\n\n## 📝 License\n\nGNU General Public License v3.0 (GPL-3.0)\n\n## 🤝 Contributing\n\nContributions welcome! Please feel free to submit pull requests.\n\n---\n\n*Note: Originally inspired by [Large Language Monkeys paper](https://arxiv.org/abs/2407.21787v1)*\n"}, "6ebee60dd645432e6f319a16bb0bcbdd4c190792": {"t": 1785764508.7418907, "n": 7002, "h": "7bba6fbc85942831", "c": "\n在2024.11.19, 第一个大版本完成了，这个版本经过多次打磨，正式被称为1.0版本，这个版本的能力预示着基于LLM审计的可行性和产品化的可行性！\nIn 2024.11.19, The first major version has been completed. After multiple rounds of refinement, it is officially designated as version 1.0. The capabilities demonstrated in this version indicate the feasibility of LLM-based auditing and its potential for productization!\n\n# Recently Updated\n2024.04.29:\n1. Add function to basiclly support rust language.\n\n2024.05.16:\n1. Add support for cross-contract vulnerability confirmation, reduce the false positive rate approximately 50%.\n2. upadte the structure of the db\n3. add CN explaination\n\n2024.05.18:\n1. Add prompt for check if result of vulnerability has assumations, reduce the false positive rate approximately 20%.\n\n2024.06.01:\n1. Add support for python language, dont ask me why, so annoying.\n \n2024.07.01\n1. Update the license\n\n2024.07.23\n1. Add support for cairo, move\n\n2024.08.01\n1. Add support for func, tact\n\n2024.08.02\nInspired by the paper https://arxiv.org/abs/2407.21787v1, the project was renamed to finite-money-prompt-engine on August 2, 2024.\n\n\n\n# TODO\n1. Optimize code structure\n2. Add more language support\n3. Write usage documentation and code analysis\n4. Add command line mode for easy use\n\n \n\n审计赏金成果：截止2024年5月，此工具已获得$60000+\n<img width=\"1258\" alt=\"image\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n\nAudit bounty results: As of May 2024, this tool has received $60,000+\n\n\n------\n1. 优化代码结构\n2. 增加更多语言支持\n3. 编写使用文档和代码解析\n4. 增加命令行模式，方便使用\n\n## Introduction\nThis is a vulnerability mining engine purely based on GPT, requiring no prior knowledge base, no fine-tuning, yet its effectiveness can overwhelmingly surpass most of the current related research. \n\nThe key lies in the design of prompts, which has shown excellent results. The core idea revolves around:\n\n- Being task-driven, not question-driven.\n- Driven by prompts, not by code.\n- Focused on prompt design, not model design.\n\nThe essence is encapsulated in one word: \"deception.\"\n\n### Note:\n- This is a type of code understanding logic vulnerability mining that fully stimulates the capabilities of gpt. The control flow type vulnerability detection ability is ineffective and is suitable for real actual projects.\n- Therefore, don’t run tests on meaningless academic vulnerabilities\n## GPT Engine Usage\n\n### Vulnerability Scanning\n\nHere's the translation into English:\n\n**Test Environment Setup**\n\n1. In the `src/main.py` file, set `switch_production_or_test` to `test` to configure the environment in test mode.\n \n2. Place the project under the directory `src/dataset/agent-v1-c4`. This structure is crucial for proper tool positioning and interaction with data.\n\n3. Refer to the configuration file `src/dataset/agent-v1-c4/datasets.json` to set up your project collection. For example:\n\n```json\n\"StEverVault2\":{\n \"path\":\"StEverVault\",\n \"files\":[\n ],\n \"functions\":[]\n}\n```\n\nWhere `StEverVault2` represents the custom name of the project, matching the `project_id` in `src/main.py`. `path` refers to the actual path of the project under `agent-v1-c4`. `files` specifies the contract files to be scanned; if not configured, it defaults to scanning all files. `functions` specifies the specific function names to be scanned; if not configured, it defaults to scanning all functions, in the format `[contract_name.function_name]`.\n\n4. Use `src/db.sql` to create the database; PostgreSQL needs to be installed beforehand.\n\n5. Set up the `.env` file by creating it and filling in the following details to configure your environment:\n\n```\n# Database connection information\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# OpenAI API\nOPENAI_API_BASE=\"apix.ai-gaochao.cn\"\nOPENAI_API_KEY=xxxxxx\n\n# Model IDs\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\n\n# Business flow scanning parameters\nBUSINESS_FLOW_COUNT=10\n\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\nWhere:\n- `DATABASE_URL` is the database connection information.\n- `OPENAI_API_BASE` is the GPT API connection information, usually `api.openai.com`.\n- `OPENAI_API_KEY` should be set to your actual OpenAI API key.\n- `BUSINESS_FLOW_MODEL_ID` and `VUL_MODEL_ID` are the IDs of the models used, recommended to use `gpt-4-turbo`.\n- `BUSINESS_FLOW_COUNT` is the number of randomizations used to create variability, typically 7-20, commonly 10.\n- `SWITCH_FUNCTION_CODE` and `SWITCH_BUSINESS_CODE` are the granularity settings during scanning, supporting function-level and business flow-level granularity.\n\n6. After configuring, run `main.py` to start the scanning process.\n## 介绍\n这是一个纯基于gpt的漏洞挖掘引擎，不需要任何前置知识库，不需要任何fine-tuning，但效果足可以碾压当前大部分相关研究的效果\n\n核心关键在于prompt的设计，效果非常好\n\n核心思路：\n- task driven, not question driven\n- 关键一个字在于“骗”\n- 利用幻觉，喜欢幻觉\n### 注\n- 这是一种充分激发gpt能力的代码理解型的逻辑漏洞挖掘，控制流类型的漏洞检测能力效果差，适用于真正的实际项目\n- 因此，不要拿那些无意义的学术型漏洞来跑测试\n\n## GPT Engine 使用说明\n\n测试环境设置如下：\n\n1. 在 `src/main.py` 文件中，将 `switch_production_or_test` 设置为 `test`，以配置环境为测试模式。\n\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n # Your code for test environment\n```\n\n2. 将项目放置于 `src/dataset/agent-v1-c4` 目录下，这一结构对于工具正确定位和与数据交互至关重要。\n\n3. 参照 `src/dataset/agent-v1-c4/datasets.json` 配置文件来设置你的项目集。例如：\n\n```json\n\"StEverVault2\":{\n \"path\":\"StEverVault\",\n \"files\":[\n ],\n \"functions\":[]\n}\n```\n\n其中，`StEverVault2` 代表项目自定义名，它的名字与 `src/main.py` 中的 `project_id` 相同。`path` 指代的是 `agent-v1-c4` 下项目的具体实际路径。`files` 指代的是要具体扫描的合约文件，如果不配置，则默认扫描全部。`functions` 指代的是要具体扫描的函数名，如果不配置，则默认扫描全部函数，形式为【合约名.函数名】。\n\n4. 使用 `src/db.sql` 创建数据库，需要提前安装 PostgreSQL。\n\n5. 设置 `.env` 文件，通过创建 `.env` 文件并填写以下内容来配置你的环境：\n\n```\n# 数据库连接信息\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# OpenAI API\nOPENAI_API_BASE=\"apix.ai-gaochao.cn\"\nOPENAI_API_KEY=xxxxxx\n\n# 模型ID\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\n\n# 业务流扫描参数\nBUSINESS_FLOW_COUNT=10\n\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n其中：\n- `DATABASE_URL` 为数据库连接信息。\n- `OPENAI_API_BASE` 为 GPT API 连接信息，一般情况下为 `api.openai.com`。\n- `OPENAI_API_KEY` 设置为对应的 OpenAI API 密钥。\n- `BUSINESS_FLOW_MODEL_ID` 和 `VUL_MODEL_ID` 为所使用的模型 ID，建议使用 `gpt-4-turbo`。\n- `BUSINESS_FLOW_COUNT` 为利用幻觉造成随机性时设置的随机次数，一般为 7-20，常用 10。\n- `SWITCH_FUNCTION_CODE` 和 `SWITCH_BUSINESS_CODE` 为扫描时的粒度，支持函数粒度和业务流粒度。\n\n6. 配置完成后，运行 `main.py` 即可开始扫描过程。\n\n1. 扫描时可能会因为网络原因或api原因中断，对于此已经整理成随时保存，不修改project_id的情况下可以重新运行main.py，可以继续扫描\n2. 唯一建议gpt4-turbo，不要用3.5，不要用4o，4o和3.5的推理能力是一样的，拉的一批\n3. 一般扫描时间为2-3小时，取决于项目大小和随机次数，中型项目+10次随机大约2个半小时\n4. 中型项目+10次随机大约需要20-30美金成本\n5. 当前还是有误报，按项目大小，大约30-65%，小项目误报会少一些，且还有很多自定义的东西，后续会继续优化\n6. 结果做了很多标记和中文解释\n 1. 优先看result列中有【\"result\":\"yes\"】的（有时候是\"result\": \"yes\"，带个空格）\n 2. category列优先筛选出【dont need In-project other contract】 的\n 3. 具体的代码看business_flow_code列\n 4. 代码位置看name列\n# 注意\n1. gpt4效果会更好，gpt3尚未深入尝试\n2. 这个tricky prompt理论上经过轻微变种，可以有效的扫描任何语言，但是尽量需要antlr相应语言的ast解析做支持，因为如果有code slicing，效果会更好\n3. 目前只支持solidity，后续会支持更多语言\n\n# TODO\n刚刚release，还没写完，后续再补充\n"}, "638e69997afc0719fa3b4759814aa72a659e279d": {"t": 1785764510.3879652, "n": 6652, "h": "f99fb7d248552fbf", "c": "# Recently Updated\n2024.04.29:\n1. Add function to basiclly support rust language.\n\n2024.05.16:\n1. Add support for cross-contract vulnerability confirmation, reduce the false positive rate approximately 50%.\n2. upadte the structure of the db\n3. add CN explaination\n\n2024.05.18:\n1. Add prompt for check if result of vulnerability has assumations, reduce the false positive rate approximately 20%.\n\n2024.06.01:\n1. Add support for python language, dont ask me why, so annoying.\n \n2024.07.01\n1. Update the license\n\n2024.07.23\n1. Add support for cairo, move\n\n2024.08.01\n1. Add support for func, tact\n\n2024.08.02\nInspired by the paper https://arxiv.org/abs/2407.21787v1, the project was renamed to finite-money-prompt-engine on August 2, 2024.\n\n\n# TODO\n1. Optimize code structure\n2. Add more language support\n3. Write usage documentation and code analysis\n4. Add command line mode for easy use\n\n \n\n审计赏金成果：截止2024年5月，此工具已获得$60000+\n<img width=\"1258\" alt=\"image\" src=\"https://github.com/BradMoonUESTC/trickPrompt-engine/assets/63706549/b3812927-2aa9-47bf-a848-753c2fe05d98\">\n\n\nAudit bounty results: As of May 2024, this tool has received $60,000+\n\n\n------\n1. 优化代码结构\n2. 增加更多语言支持\n3. 编写使用文档和代码解析\n4. 增加命令行模式，方便使用\n\n## Introduction\nThis is a vulnerability mining engine purely based on GPT, requiring no prior knowledge base, no fine-tuning, yet its effectiveness can overwhelmingly surpass most of the current related research. \n\nThe key lies in the design of prompts, which has shown excellent results. The core idea revolves around:\n\n- Being task-driven, not question-driven.\n- Driven by prompts, not by code.\n- Focused on prompt design, not model design.\n\nThe essence is encapsulated in one word: \"deception.\"\n\n### Note:\n- This is a type of code understanding logic vulnerability mining that fully stimulates the capabilities of gpt. The control flow type vulnerability detection ability is ineffective and is suitable for real actual projects.\n- Therefore, don’t run tests on meaningless academic vulnerabilities\n## GPT Engine Usage\n\n### Vulnerability Scanning\n\nHere's the translation into English:\n\n**Test Environment Setup**\n\n1. In the `src/main.py` file, set `switch_production_or_test` to `test` to configure the environment in test mode.\n \n2. Place the project under the directory `src/dataset/agent-v1-c4`. This structure is crucial for proper tool positioning and interaction with data.\n\n3. Refer to the configuration file `src/dataset/agent-v1-c4/datasets.json` to set up your project collection. For example:\n\n```json\n\"StEverVault2\":{\n \"path\":\"StEverVault\",\n \"files\":[\n ],\n \"functions\":[]\n}\n```\n\nWhere `StEverVault2` represents the custom name of the project, matching the `project_id` in `src/main.py`. `path` refers to the actual path of the project under `agent-v1-c4`. `files` specifies the contract files to be scanned; if not configured, it defaults to scanning all files. `functions` specifies the specific function names to be scanned; if not configured, it defaults to scanning all functions, in the format `[contract_name.function_name]`.\n\n4. Use `src/db.sql` to create the database; PostgreSQL needs to be installed beforehand.\n\n5. Set up the `.env` file by creating it and filling in the following details to configure your environment:\n\n```\n# Database connection information\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# OpenAI API\nOPENAI_API_BASE=\"apix.ai-gaochao.cn\"\nOPENAI_API_KEY=xxxxxx\n\n# Model IDs\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\n\n# Business flow scanning parameters\nBUSINESS_FLOW_COUNT=10\n\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\nWhere:\n- `DATABASE_URL` is the database connection information.\n- `OPENAI_API_BASE` is the GPT API connection information, usually `api.openai.com`.\n- `OPENAI_API_KEY` should be set to your actual OpenAI API key.\n- `BUSINESS_FLOW_MODEL_ID` and `VUL_MODEL_ID` are the IDs of the models used, recommended to use `gpt-4-turbo`.\n- `BUSINESS_FLOW_COUNT` is the number of randomizations used to create variability, typically 7-20, commonly 10.\n- `SWITCH_FUNCTION_CODE` and `SWITCH_BUSINESS_CODE` are the granularity settings during scanning, supporting function-level and business flow-level granularity.\n\n6. After configuring, run `main.py` to start the scanning process.\n## 介绍\n这是一个纯基于gpt的漏洞挖掘引擎，不需要任何前置知识库，不需要任何fine-tuning，但效果足可以碾压当前大部分相关研究的效果\n\n核心关键在于prompt的设计，效果非常好\n\n核心思路：\n- task driven, not question driven\n- 关键一个字在于“骗”\n- 利用幻觉，喜欢幻觉\n### 注\n- 这是一种充分激发gpt能力的代码理解型的逻辑漏洞挖掘，控制流类型的漏洞检测能力效果差，适用于真正的实际项目\n- 因此，不要拿那些无意义的学术型漏洞来跑测试\n\n## GPT Engine 使用说明\n\n测试环境设置如下：\n\n1. 在 `src/main.py` 文件中，将 `switch_production_or_test` 设置为 `test`，以配置环境为测试模式。\n\n```python\nif __name__ == '__main__':\n switch_production_or_test = 'test' # prod / test\n if switch_production_or_test == 'test':\n # Your code for test environment\n```\n\n2. 将项目放置于 `src/dataset/agent-v1-c4` 目录下，这一结构对于工具正确定位和与数据交互至关重要。\n\n3. 参照 `src/dataset/agent-v1-c4/datasets.json` 配置文件来设置你的项目集。例如：\n\n```json\n\"StEverVault2\":{\n \"path\":\"StEverVault\",\n \"files\":[\n ],\n \"functions\":[]\n}\n```\n\n其中，`StEverVault2` 代表项目自定义名，它的名字与 `src/main.py` 中的 `project_id` 相同。`path` 指代的是 `agent-v1-c4` 下项目的具体实际路径。`files` 指代的是要具体扫描的合约文件，如果不配置，则默认扫描全部。`functions` 指代的是要具体扫描的函数名，如果不配置，则默认扫描全部函数，形式为【合约名.函数名】。\n\n4. 使用 `src/db.sql` 创建数据库，需要提前安装 PostgreSQL。\n\n5. 设置 `.env` 文件，通过创建 `.env` 文件并填写以下内容来配置你的环境：\n\n```\n# 数据库连接信息\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# OpenAI API\nOPENAI_API_BASE=\"apix.ai-gaochao.cn\"\nOPENAI_API_KEY=xxxxxx\n\n# 模型ID\nBUSINESS_FLOW_MODEL_ID=gpt-4-turbo\nVUL_MODEL_ID=gpt-4-turbo\n\n# 业务流扫描参数\nBUSINESS_FLOW_COUNT=10\n\nSWITCH_FUNCTION_CODE=False\nSWITCH_BUSINESS_CODE=True\n```\n\n其中：\n- `DATABASE_URL` 为数据库连接信息。\n- `OPENAI_API_BASE` 为 GPT API 连接信息，一般情况下为 `api.openai.com`。\n- `OPENAI_API_KEY` 设置为对应的 OpenAI API 密钥。\n- `BUSINESS_FLOW_MODEL_ID` 和 `VUL_MODEL_ID` 为所使用的模型 ID，建议使用 `gpt-4-turbo`。\n- `BUSINESS_FLOW_COUNT` 为利用幻觉造成随机性时设置的随机次数，一般为 7-20，常用 10。\n- `SWITCH_FUNCTION_CODE` 和 `SWITCH_BUSINESS_CODE` 为扫描时的粒度，支持函数粒度和业务流粒度。\n\n6. 配置完成后，运行 `main.py` 即可开始扫描过程。\n\n1. 扫描时可能会因为网络原因或api原因中断，对于此已经整理成随时保存，不修改project_id的情况下可以重新运行main.py，可以继续扫描\n2. 唯一建议gpt4-turbo，不要用3.5，不要用4o，4o和3.5的推理能力是一样的，拉的一批\n3. 一般扫描时间为2-3小时，取决于项目大小和随机次数，中型项目+10次随机大约2个半小时\n4. 中型项目+10次随机大约需要20-30美金成本\n5. 当前还是有误报，按项目大小，大约30-65%，小项目误报会少一些，且还有很多自定义的东西，后续会继续优化\n6. 结果做了很多标记和中文解释\n 1. 优先看result列中有【\"result\":\"yes\"】的（有时候是\"result\": \"yes\"，带个空格）\n 2. category列优先筛选出【dont need In-project other contract】 的\n 3. 具体的代码看business_flow_code列\n 4. 代码位置看name列\n# 注意\n1. gpt4效果会更好，gpt3尚未深入尝试\n2. 这个tricky prompt理论上经过轻微变种，可以有效的扫描任何语言，但是尽量需要antlr相应语言的ast解析做支持，因为如果有code slicing，效果会更好\n3. 目前只支持solidity，后续会支持更多语言\n\n# TODO\n刚刚release，还没写完，后续再补充\n"}}, "README_CN.md": {"492c61c0263133162963b169e0a6cf2eb600469e": {"t": 1785674072.1739764, "n": 10007, "h": "cfc7c0856e1dbbb3", "c": "# Finite Monkey Engine v3.0\n\n面向区块链代码审计的自动化扫描流水线：**Planning → Reasoning → Validation**（三段均可由 Codex CLI 驱动），结果落库到 PostgreSQL，并导出报告。\n\n## v3.0 更新要点\n\n- **Planning**：不再依赖 RAG / chunks / call graph / call tree。只保留 tree-sitter 的函数解析结果，并通过 Codex 抽取业务流（Gi/Fi）。最终落库任务为 **Fi × checklist(rule_key)**。\n- **Reasoning**：扫描阶段改为用 **Codex CLI** 执行（把 `business_flow_code + prompt` 输入进去），输出保持原有 **多漏洞 JSON**，并沿用原逻辑拆分写入 `project_finding`。\n- **Validation**：对 `project_finding` 进行 Codex 确认（误报/真实漏洞/成本/影响等），写回 `validation_status` 与 `validation_record`。\n- **工作目录约束**：Codex 执行严格 `--cd <project_root>`，其中 `project_root` 必须由 `src/dataset/agent-v1-c4/datasets.json[project_id].path` 决定（位于 `src/dataset/agent-v1-c4` 下）。\n- **方案文档**：已整理到 `docs/`（planning/coverage/validation/reasoning 的设计说明）。\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex（v3.0 reasoning/planning/validation 使用，必需）\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# 兼容旧模型配置（仍可能用于某些辅助流程）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"sk-xxxxxx\" # API密钥\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式：通用项目CHECKLIST逐个提问\n# 可选模式：PURE_SCAN（纯扫描）\nSCAN_MODE_AVA=False # 扫描模式高级功能\nCOMPLEXITY_ANALYSIS_ENABLED=True # 启用复杂度分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描阶段最大线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认阶段最大线程数\nBUSINESS_FLOW_COUNT=4 # 业务流程重复数量（触发幻觉的数量）\n\n# 高级功能配置\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # 忽略的文件夹\n\n# 检查清单配置\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # 检查清单文件路径\nCHECKLIST_SHEET=Sheet1 # 检查清单工作表名称\n\n# 运行控制（v3.0 常用）\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true 时：main.py 正常流程跑到 planning 后在 reasoning 前停止\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### AI模型配置详情\n\n基于 `src/openai_api/model_config.json` 的实际配置：\n\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 例如在openrouter中，sonnet 4需要设置为anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个文件）\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 企业级配置（大项目 > 100个文件）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 成本优化配置\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（必需，用于存储分析结果）\n- **AI API密钥**（支持OpenAI、Claude、DeepSeek等多种模型）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 初始化数据库\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. 配置项目数据集\n# 编辑 src/dataset/agent-v1-c4/datasets.json 添加你的项目配置\n\n# 6. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 数据库初始化\n\n使用提供的SQL文件初始化PostgreSQL数据库：\n\n```bash\n# 连接到PostgreSQL数据库\npsql -U postgres -d postgres\n\n# 执行SQL文件创建表结构\n\\i project_task.sql\n\n# 或者直接使用命令行\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //无需设置，未来版本将禁用\n \"functions\": [], //无需设置，未来版本将禁用\n \"exclude_in_planning\": \"false\", //无需设置为true，未来版本将禁用\n \"exclude_directory\": [] //无需设置，未来版本将禁用\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 中设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: \n - 数据库中的详细分析记录\n - `output.xlsx` 报告文件\n - Mermaid业务流程图（如果启用）\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "2a6f2fa0dc8294c662cc11d376360ea1e4f0c55b": {"t": 1785764466.9722242, "n": 10007, "h": "cfc7c0856e1dbbb3", "c": "# Finite Monkey Engine v3.0\n\n面向区块链代码审计的自动化扫描流水线：**Planning → Reasoning → Validation**（三段均可由 Codex CLI 驱动），结果落库到 PostgreSQL，并导出报告。\n\n## v3.0 更新要点\n\n- **Planning**：不再依赖 RAG / chunks / call graph / call tree。只保留 tree-sitter 的函数解析结果，并通过 Codex 抽取业务流（Gi/Fi）。最终落库任务为 **Fi × checklist(rule_key)**。\n- **Reasoning**：扫描阶段改为用 **Codex CLI** 执行（把 `business_flow_code + prompt` 输入进去），输出保持原有 **多漏洞 JSON**，并沿用原逻辑拆分写入 `project_finding`。\n- **Validation**：对 `project_finding` 进行 Codex 确认（误报/真实漏洞/成本/影响等），写回 `validation_status` 与 `validation_record`。\n- **工作目录约束**：Codex 执行严格 `--cd <project_root>`，其中 `project_root` 必须由 `src/dataset/agent-v1-c4/datasets.json[project_id].path` 决定（位于 `src/dataset/agent-v1-c4` 下）。\n- **方案文档**：已整理到 `docs/`（planning/coverage/validation/reasoning 的设计说明）。\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex（v3.0 reasoning/planning/validation 使用，必需）\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# 兼容旧模型配置（仍可能用于某些辅助流程）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"sk-xxxxxx\" # API密钥\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式：通用项目CHECKLIST逐个提问\n# 可选模式：PURE_SCAN（纯扫描）\nSCAN_MODE_AVA=False # 扫描模式高级功能\nCOMPLEXITY_ANALYSIS_ENABLED=True # 启用复杂度分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描阶段最大线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认阶段最大线程数\nBUSINESS_FLOW_COUNT=4 # 业务流程重复数量（触发幻觉的数量）\n\n# 高级功能配置\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # 忽略的文件夹\n\n# 检查清单配置\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # 检查清单文件路径\nCHECKLIST_SHEET=Sheet1 # 检查清单工作表名称\n\n# 运行控制（v3.0 常用）\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true 时：main.py 正常流程跑到 planning 后在 reasoning 前停止\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### AI模型配置详情\n\n基于 `src/openai_api/model_config.json` 的实际配置：\n\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 例如在openrouter中，sonnet 4需要设置为anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个文件）\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 企业级配置（大项目 > 100个文件）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 成本优化配置\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（必需，用于存储分析结果）\n- **AI API密钥**（支持OpenAI、Claude、DeepSeek等多种模型）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 初始化数据库\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. 配置项目数据集\n# 编辑 src/dataset/agent-v1-c4/datasets.json 添加你的项目配置\n\n# 6. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 数据库初始化\n\n使用提供的SQL文件初始化PostgreSQL数据库：\n\n```bash\n# 连接到PostgreSQL数据库\npsql -U postgres -d postgres\n\n# 执行SQL文件创建表结构\n\\i project_task.sql\n\n# 或者直接使用命令行\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //无需设置，未来版本将禁用\n \"functions\": [], //无需设置，未来版本将禁用\n \"exclude_in_planning\": \"false\", //无需设置为true，未来版本将禁用\n \"exclude_directory\": [] //无需设置，未来版本将禁用\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 中设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: \n - 数据库中的详细分析记录\n - `output.xlsx` 报告文件\n - Mermaid业务流程图（如果启用）\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "455c1e0a4aa789e4b8e64e4091e36e92d12fa88b": {"t": 1785764468.357766, "n": 10012, "h": "e34e9e2a31d64082", "c": "# Finite Monkey Engine v3.0\n\n面向区块链代码审计的自动化扫描流水线：**Planning → Reasoning → Validation**（三段均可由 Codex CLI 驱动），结果落库到 PostgreSQL，并导出报告。\n\n## v3.0 更新要点（简洁版）\n\n- **Planning**：不再依赖 RAG / chunks / call graph / call tree。只保留 tree-sitter 的函数解析结果，并通过 Codex 抽取业务流（Gi/Fi）。最终落库任务为 **Fi × checklist(rule_key)**。\n- **Reasoning**：扫描阶段改为用 **Codex CLI** 执行（把 `business_flow_code + prompt` 输入进去），输出保持原有 **多漏洞 JSON**，并沿用原逻辑拆分写入 `project_finding`。\n- **Validation**：对 `project_finding` 进行 Codex 确认（误报/真实漏洞/成本/影响等），写回 `validation_status` 与 `validation_record`。\n- **工作目录约束**：Codex 执行严格 `--cd <project_root>`，其中 `project_root` 必须由 `src/dataset/agent-v1-c4/datasets.json[project_id].path` 决定（位于 `src/dataset/agent-v1-c4` 下）。\n- **方案文档**：已整理到 `docs/`（planning/coverage/validation/reasoning 的设计说明）。\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# Codex（v3.0 reasoning/planning/validation 使用，必需）\nCODEX_MODEL=gpt-5.2\nCODEX_SANDBOX=read-only\nCODEX_ASK_FOR_APPROVAL=never\nCODEX_TIMEOUT_SEC=1800\n\n# 兼容旧模型配置（仍可能用于某些辅助流程）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"sk-xxxxxx\" # API密钥\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式：通用项目CHECKLIST逐个提问\n# 可选模式：PURE_SCAN（纯扫描）\nSCAN_MODE_AVA=False # 扫描模式高级功能\nCOMPLEXITY_ANALYSIS_ENABLED=True # 启用复杂度分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描阶段最大线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认阶段最大线程数\nBUSINESS_FLOW_COUNT=4 # 业务流程重复数量（触发幻觉的数量）\n\n# 高级功能配置\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # 忽略的文件夹\n\n# 检查清单配置\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # 检查清单文件路径\nCHECKLIST_SHEET=Sheet1 # 检查清单工作表名称\n\n# 运行控制（v3.0 常用）\nCMD=detect_vul # detect_vul / planning_only\nSTOP_AFTER_PLANNING=false # true 时：main.py 正常流程跑到 planning 后在 reasoning 前停止\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### AI模型配置详情\n\n基于 `src/openai_api/model_config.json` 的实际配置：\n\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 例如在openrouter中，sonnet 4需要设置为anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个文件）\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 企业级配置（大项目 > 100个文件）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 成本优化配置\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（必需，用于存储分析结果）\n- **AI API密钥**（支持OpenAI、Claude、DeepSeek等多种模型）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 初始化数据库\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. 配置项目数据集\n# 编辑 src/dataset/agent-v1-c4/datasets.json 添加你的项目配置\n\n# 6. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 数据库初始化\n\n使用提供的SQL文件初始化PostgreSQL数据库：\n\n```bash\n# 连接到PostgreSQL数据库\npsql -U postgres -d postgres\n\n# 执行SQL文件创建表结构\n\\i project_task.sql\n\n# 或者直接使用命令行\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //无需设置，未来版本将禁用\n \"functions\": [], //无需设置，未来版本将禁用\n \"exclude_in_planning\": \"false\", //无需设置为true，未来版本将禁用\n \"exclude_directory\": [] //无需设置，未来版本将禁用\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 中设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: \n - 数据库中的详细分析记录\n - `output.xlsx` 报告文件\n - Mermaid业务流程图（如果启用）\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "4f833f23960723af2ea91ab3d0a4d0029fba5985": {"t": 1785764469.6392982, "n": 8981, "h": "a366528c8714a7b6", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"sk-xxxxxx\" # API密钥\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式：通用项目CHECKLIST逐个提问\n# 可选模式：PURE_SCAN（纯扫描）\nSCAN_MODE_AVA=False # 扫描模式高级功能\nCOMPLEXITY_ANALYSIS_ENABLED=True # 启用复杂度分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描阶段最大线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认阶段最大线程数\nBUSINESS_FLOW_COUNT=4 # 业务流程重复数量（触发幻觉的数量）\n\n# 高级功能配置\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # 忽略的文件夹\n\n# 检查清单配置\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # 检查清单文件路径\nCHECKLIST_SHEET=Sheet1 # 检查清单工作表名称\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### AI模型配置详情\n\n基于 `src/openai_api/model_config.json` 的实际配置：\n\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 例如在openrouter中，sonnet 4需要设置为anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个文件）\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 企业级配置（大项目 > 100个文件）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 成本优化配置\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（必需，用于存储分析结果）\n- **AI API密钥**（支持OpenAI、Claude、DeepSeek等多种模型）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 初始化数据库\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. 配置项目数据集\n# 编辑 src/dataset/agent-v1-c4/datasets.json 添加你的项目配置\n\n# 6. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 数据库初始化\n\n使用提供的SQL文件初始化PostgreSQL数据库：\n\n```bash\n# 连接到PostgreSQL数据库\npsql -U postgres -d postgres\n\n# 执行SQL文件创建表结构\n\\i project_task.sql\n\n# 或者直接使用命令行\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //无需设置，未来版本将禁用\n \"functions\": [], //无需设置，未来版本将禁用\n \"exclude_in_planning\": \"false\", //无需设置为true，未来版本将禁用\n \"exclude_directory\": [] //无需设置，未来版本将禁用\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 中设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: \n - 数据库中的详细分析记录\n - `output.xlsx` 报告文件\n - Mermaid业务流程图（如果启用）\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "ef6663ad468c5f890f92974839d2a57be5cf1668": {"t": 1785764471.443521, "n": 9032, "h": "4d96f302fc4fe802", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"sk-xxxxxx\" # API密钥\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式：通用项目CHECKLIST逐个提问\n# 可选模式：PURE_SCAN（纯扫描）\nSCAN_MODE_AVA=False # 扫描模式高级功能\nCOMPLEXITY_ANALYSIS_ENABLED=True # 启用复杂度分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描阶段最大线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认阶段最大线程数\nBUSINESS_FLOW_COUNT=4 # 业务流程重复数量（触发幻觉的数量）\n\n# 高级功能配置\nENABLE_DIALOGUE_MODE=False # 是否启用对话模式\nIGNORE_FOLDERS=node_modules,build,dist,test,tests,.git # 忽略的文件夹\n\n# 检查清单配置\nCHECKLIST_PATH=src/knowledges/checklist.xlsx # 检查清单文件路径\nCHECKLIST_SHEET=Sheet1 # 检查清单工作表名称\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### AI模型配置详情\n\n基于 `src/openai_api/model_config.json` 的实际配置：\n\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 必须根据你的LLM平台设置正确的模型名称！\n**重要警告** 例如在openrouter中，sonnet 4需要设置为anthropic/sonnet-4\n\n```json\n{\n \"openai_general\": \"gpt-4.1\",\n \"code_assumptions_analysis\": \"claude-sonnet-4-20250514\",\n \"vulnerability_detection\": \"claude-sonnet-4-20250514\",\n \"initial_vulnerability_validation\": \"deepseek-reasoner\",\n \"vulnerability_findings_json_extraction\": \"gpt-4o-mini\",\n \"additional_context_determination\": \"deepseek-reasoner\",\n \"comprehensive_vulnerability_analysis\": \"deepseek-reasoner\",\n \"final_vulnerability_extraction\": \"gpt-4o-mini\",\n \"structured_json_extraction\": \"gpt-4.1\",\n \"embedding_model\": \"text-embedding-3-large\"\n}\n```\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个文件）\n```bash\nSCAN_MODE=PURE_SCAN\nCOMPLEXITY_ANALYSIS_ENABLED=False\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=2\n```\n\n#### 🏢 企业级配置（大项目 > 100个文件）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nCOMPLEXITY_ANALYSIS_ENABLED=True\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=30\nBUSINESS_FLOW_COUNT=4\n```\n\n#### 💰 成本优化配置\n```bash\nSCAN_MODE=PURE_SCAN\nBUSINESS_FLOW_COUNT=1\nMAX_THREADS_OF_SCAN=3\nMAX_THREADS_OF_CONFIRMATION=10\nCOMPLEXITY_ANALYSIS_ENABLED=False\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（必需，用于存储分析结果）\n- **AI API密钥**（支持OpenAI、Claude、DeepSeek等多种模型）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 初始化数据库\npsql -U postgres -d postgres -f project_task.sql\n\n# 5. 配置项目数据集\n# 编辑 src/dataset/agent-v1-c4/datasets.json 添加你的项目配置\n\n# 6. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 数据库初始化\n\n使用提供的SQL文件初始化PostgreSQL数据库：\n\n```bash\n# 连接到PostgreSQL数据库\npsql -U postgres -d postgres\n\n# 执行SQL文件创建表结构\n\\i project_task.sql\n\n# 或者直接使用命令行\npsql -U postgres -d postgres -f project_task.sql\n```\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"your_project_folder_name\",\n \"files\": [], //无需设置，未来版本将禁用\n \"functions\": [], //无需设置，未来版本将禁用\n \"exclude_in_planning\": \"false\", //无需设置为true，未来版本将禁用\n \"exclude_directory\": [] //无需设置，未来版本将禁用\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 中设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: \n - 数据库中的详细分析记录\n - `output.xlsx` 报告文件\n - Mermaid业务流程图（如果启用）\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "f40a5e3087be5596071d73468852686d66f46617": {"t": 1785764472.810555, "n": 7738, "h": "0b2222d58c717541", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 联系我们\n\n- **邮箱**: nerbonic@gmail.com\n- **推特**: [@xy9301](https://x.com/xy9301)\n- **交流群**: [https://t.me/+4-s4jDfy-ig1M2Y1](https://t.me/+4-s4jDfy-ig1M2Y1)\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "eb8f80ae30c2d2366018f1ce8c2480c7c421492e": {"t": 1785764474.1416514, "n": 7794, "h": "dab7921a715786d5", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 技术支持\n\n- **问题反馈**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **功能讨论**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **技术交流**: 加入我们的技术交流群\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "35ba3f696eee4d3a3fb287483ab47d756891d65a": {"t": 1785764475.5300224, "n": 8466, "h": "cfb4ef1cae14fb62", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 技术支持\n\n- **问题反馈**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **功能讨论**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **技术交流**: 加入我们的技术交流群\n\n## 🚀 v2.0版本重大架构升级\n\n**Finite Monkey Engine v2.0** 带来了全栈式架构重构，四大核心系统全面升级：\n\n### 🌳 1. Tree-sitter底层解析引擎重构\n**完全替代传统解析方案，代码分析精度提升300%**\n\n- **🔧 全新解析架构**：基于Tree-sitter的统一解析引擎\n - 支持Solidity、Rust、C++、Move四种核心语言\n - 语法树精确解析，消除传统正则表达式的不准确性\n - 函数级粒度分析，支持复杂嵌套结构\n\n- **📊 Call Tree & Call Graph革新**：\n - **准确率提升90%**：基于AST的精确函数调用关系分析\n - **深度追踪**：支持跨文件、跨合约的调用链分析 \n - **实时构建**：动态生成调用图，支持增量更新\n - **可视化增强**：自动生成Mermaid调用关系图\n\n### 📋 2. 智能Planning复杂度评估系统\n**避免无效扫描，降低分析成本60%**\n\n- **🎯 多维度复杂度评估**：\n - **代码复杂度**：基于圈复杂度、函数深度的智能评估\n - **风险优先级**：根据函数敏感性、外部调用频率排序\n - **资源消耗预估**：预测分析所需时间和AI Token消耗\n - **批次优化**：智能分组，提升并行处理效率\n\n- **💡 成本优化策略**：\n - **过滤无效任务**：自动跳过简单getter/setter函数\n - **智能采样**：对相似功能函数进行代表性分析\n - **增量分析**：仅分析变更部分，避免重复扫描\n - **优先级队列**：高风险函数优先处理\n\n### 🔍 3. 四维RAG查询策略架构\n**检索精度提升400%，上下文理解更全面**\n\n- **📚 多维度信息检索**：\n - **🎯 函数维度**：基于函数签名、功能语义的精确检索\n - **🔗 调用关系维度**：上游调用者、下游被调用函数的关联分析\n - **📄 代码块维度**：语义相关代码片段的上下文检索\n - **🏗️ 架构维度**：跨合约、跨模块的架构级依赖分析\n\n- **🧠 智能查询优化**：\n - **语义理解增强**：多向量embedding，提升检索相关性\n - **上下文累积**：跨轮次信息聚合，避免重复查询\n - **动态权重调整**：根据分析阶段调整不同维度权重\n - **增量信息融合**：新信息与历史上下文的智能融合\n\n### 🛡️ 4. 漏洞验证引擎全面重构\n**检测准确率提升80%，支持中英文双语分析**\n\n- **🎯 智能分析流程**：\n - **谨慎性原则**：优先选择`need_more_info`，避免误判\n - **多轮迭代验证**：最多10轮深度分析，直到明确结论\n - **上下文累积**：历史分析信息智能传承\n - **实时反馈机制**：透明化分析过程，支持调试追踪\n\n- **🌐 多语言Prompt体系**：\n - **中文分析场景**：针对中文开发团队优化的分析逻辑\n - **英文分析场景**：符合国际标准的漏洞描述和分类\n - **智能语言切换**：根据项目特征自动选择最优语言模式\n - **双语对照验证**：关键漏洞的双语交叉验证机制\n\n---\n\n## 📊 v2.0性能提升总览\n\n| 核心指标 | v1.0 | v2.0 | 提升幅度 |\n|---------|------|------|---------|\n| 代码解析准确率 | 75% | 95% | **+27%** |\n| Call Graph准确性 | 60% | 94% | **+57%** |\n| 无效扫描过滤率 | 20% | 80% | **+300%** |\n| RAG检索相关性 | 65% | 92% | **+42%** |\n| 漏洞检测准确率 | 72% | 91% | **+26%** |\n| 分析成本(Token) | 100% | 40% | **-60%** |\n\n## 🔄 v2.0迁移指南\n\n### 兼容性说明\n- ✅ **完全向后兼容**：现有配置和数据无需修改\n- ✅ **平滑升级**：支持增量迁移，零停机部署\n- ✅ **智能识别**：自动识别项目类型，应用最优分析策略\n\n### 推荐配置优化\n```yaml\n# v2.0推荐配置\ntree_sitter:\n enabled: true\n languages: [\"solidity\", \"rust\", \"cpp\", \"move\"]\n \nplanning:\n complexity_threshold: \"medium\"\n cost_optimization: true\n parallel_workers: 4\n\nrag:\n query_dimensions: [\"function\", \"call_relation\", \"code_block\", \"architecture\"]\n context_accumulation: true\n \nvalidation:\n max_iterations: 10\n language_mode: \"auto\" # auto/zh/en\n```\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "653e54de04437a254ed96610b0eac95b5657aaf9": {"t": 1785764476.995811, "n": 6501, "h": "7c7a6d5707c5ca93", "c": "# Finite Monkey Engine v2.0\n\n**基于AI的智能代码安全分析平台**\n\n## 🚀 v2.0 版本升级亮点\n\n**Finite Monkey Engine v2.0** 带来了重大架构升级和功能增强：\n\n### 🔥 核心升级\n- **🎯 精准语言支持**：使用tree-sitter整个函数解析和上下文系统，专注4种核心语言（Solidity/Rust/C++/Move），提供最优分析体验\n- **🧠 RAG架构优化**：全新LanceDB合并式2表架构，查询效率提升300%\n- **📊 智能上下文理解**：多维度embedding技术，代码理解能力显著增强\n- **⚡ 性能优化**：统一存储策略，减少50%内存占用，提升并发处理能力\n- **🔍 深度业务分析**：增强的业务流可视化和跨合约依赖分析\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**专注于区块链和系统级代码安全审计**。通过集成多种AI模型和先进的静态分析技术，为核心编程语言项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n\n平台基于Tree-sitter解析引擎和函数级分析架构，**v2.0版本专注于4种核心语言**，提供最优的分析体验：\n\n**✅ 当前全面支持的语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整Tree-sitter支持\n- **Rust** (.rs) - Solana生态，Substrate，系统级编程\n- **C/C++** (.c/.cpp/.cxx/.cc/.C/.h/.hpp/.hxx) - 区块链底层、节点客户端\n- **Move** (.move) - Aptos, Sui区块链语言\n\n**🔄 计划支持的语言（后续版本）:**\n- ~~**Cairo** (.cairo) - StarkNet智能合约语言~~\n- ~~**Tact** (.tact) - TON区块链智能合约~~\n- ~~**FunC** (.fc/.func) - TON区块链原生语言~~\n- ~~**FA** (.fr) - 函数式智能合约语言~~\n- ~~**Python** (.py) - Web3、DeFi后端项目~~\n- ~~**JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目~~\n- ~~**Go** (.go) - 区块链基础设施、TEE项目~~\n- ~~**Java** (.java) - 企业级区块链应用~~\n\n> 💡 **v2.0设计理念**: 专注核心语言，提供深度优化的分析能力。基于函数粒度的代码分析架构，理论上可扩展到任何编程语言，后续版本将逐步支持更多语言。\n\n### 💎 v2.0核心优势\n- 🧠 **多AI模型支持**: 集成Claude-4 Sonnet、GPT-4、DeepSeek等主流AI模型\n- 🚀 **RAG架构升级**: 全新LanceDB合并式2表架构，查询效率提升300%\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图，支持跨合约依赖分析\n- 🔍 **深度安全分析**: 专注4种核心语言，提供最优分析精度\n- ⚡ **高效并发处理**: 优化内存管理，支持大规模项目并行分析\n- 🎯 **智能上下文理解**: 多维度embedding技术，代码理解能力显著增强\n- 🌐 **精简高效架构**: 专注核心语言，减少50%维护复杂度\n\n## 🚀 v2.0主要特性\n\n### 🧠 增强AI驱动分析\n- **多模型协同**: Claude-4 Sonnet、GPT-4等AI模型智能协作\n- **RAG增强理解**: 基于LanceDB的多维度上下文感知技术\n- **业务逻辑深度分析**: 深度理解DeFi协议、治理机制和代币经济学\n- **智能漏洞发现**: AI辅助的复杂漏洞模式识别\n\n### 📊 升级版业务流可视化\n- **智能图表生成**: 自动分析代码生成Mermaid业务流程图\n- **多层次分析展示**: 支持项目级、文件夹级、函数级可视化\n- **跨合约依赖跟踪**: 清晰展示复杂的合约交互关系\n- **实时交互式图表**: 动态展示代码结构和调用链\n\n### 🔍 全面安全检测体系\n- **精准漏洞检测**: 专注核心语言，提供更精准的漏洞识别\n- **跨合约深度分析**: 多合约交互分析和复杂依赖关系跟踪\n- **业务场景审查**: 针对不同DeFi场景的专业安全分析\n- **智能误报过滤**: AI辅助减少误报，提升分析准确性\n\n### ⚡ v2.0架构优化\n- **LanceDB 2表架构**: 统一存储策略，查询效率提升300%\n- **多维度Embedding**: 内容、名称、自然语言三重embedding技术\n- **内存优化管理**: 减少50%内存占用，支持更大规模项目\n- **并发处理升级**: 优化线程管理，提升分析速度\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 技术支持\n\n- **问题反馈**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **功能讨论**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **技术交流**: 加入我们的技术交流群\n\n## 🆕 v2.0版本说明\n\n### 重大升级\n- **核心语言专精**: 专注Solidity/Rust/C++/Move四种核心语言，提供最优分析体验\n- **RAG架构革新**: LanceDB合并式2表架构，性能提升300%\n- **智能embedding**: 多维度代码理解，分析精度显著提升\n- **架构优化**: 内存占用减少50%，支持更大规模项目\n\n### 迁移指南\n- v2.0完全向后兼容，无需修改现有配置\n- 不支持的语言文件会自动跳过，不影响系统运行\n- 建议更新配置文件以获得最佳性能体验\n\n---\n\n**🎉 Finite Monkey Engine v2.0 - 让代码安全分析更智能、更专业、更高效！**"}, "925e6e2c0025b8eb1826dc10a30ee90410e53724": {"t": 1785764478.5558653, "n": 5365, "h": "33337b11547f7856", "c": "# Finite Monkey Engine\n\n**基于AI的智能代码安全分析平台**\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**不仅支持智能合约，更可扩展到任何编程语言项目**。通过集成多种AI模型和先进的静态分析技术，为各类代码项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n平台基于ANTLR4解析引擎和函数级分析架构，目前已支持：\n\n**区块链语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整ANTLR支持\n- **Rust** (.rs) - Solana生态，Substrate等\n- **Move** (.move) - Aptos, Sui区块链语言\n- **Cairo** (.cairo) - StarkNet智能合约语言\n- **Tact** (.tact) - TON区块链智能合约\n- **FunC** (.fc/.func) - TON区块链原生语言\n- **FA** (.fr) - 函数式智能合约语言\n\n**传统编程语言:**\n- **Python** (.py) - 支持Web3、DeFi后端项目\n- **JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目 \n- **Go** (.go) - 区块链基础设施、TEE项目\n- **Java** (.java) - 企业级区块链应用\n- **C/C++** (.c/.cpp/.cxx/.cc/.C) - 区块链底层、节点客户端\n\n> 💡 **设计理念**: 基于函数粒度的代码分析，理论上可扩展到任何编程语言\n\n### 核心优势\n- 🧠 **多AI模型支持**: 集成Claude、GPT-4、DeepSeek等主流AI模型\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图\n- 🔍 **深度安全分析**: 覆盖智能合约、Web3、传统软件项目\n- ⚡ **高效并发处理**: 支持多线程并发分析\n- 🎯 **智能上下文理解**: RAG技术增强的代码理解能力\n- 🌐 **语言无关架构**: 通用的函数级分析框架\n\n## 🚀 主要特性\n\n### AI驱动的智能分析\n- **多模型支持**: Claude-4 Sonnet、GPT-4等主流AI模型\n- **上下文感知**: 基于RAG技术的智能代码理解\n- **业务逻辑分析**: 深度理解DeFi协议、治理机制和代币经济学\n\n### 可视化业务流程图\n- **自动生成**: 智能分析代码生成Mermaid图表\n- **多层次展示**: 支持项目级、文件夹级、函数级分析\n- **交互式图表**: 清晰展示合约交互和依赖关系\n\n### 全面安全检测\n- **漏洞检测**: 覆盖常见和复杂的智能合约漏洞\n- **跨合约分析**: 多合约交互分析和依赖关系跟踪\n- **业务逻辑审查**: 针对性的业务场景安全分析\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 技术支持\n\n- **问题反馈**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **功能讨论**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **技术交流**: 加入我们的技术交流群\n\n---\n\n**🎉 让智能合约安全分析变得更智能、更高效！**"}, "4c1de48e6accf8f9496408d6f53ecdded0a58517": {"t": 1785764479.919991, "n": 5408, "h": "ae1a88ca90af2389", "c": "# Finite Monkey Engine\n\n**基于AI的智能代码安全分析平台**\n\n## 🎯 项目简介\n\nFinite Monkey Engine 是一个先进的AI驱动代码安全分析平台，**不仅支持智能合约，更可扩展到任何编程语言项目**。通过集成多种AI模型和先进的静态分析技术，为各类代码项目提供全面、智能的安全审计解决方案。\n\n### 🌍 多语言支持\n平台基于ANTLR4解析引擎和函数级分析架构，目前已支持：\n\n**区块链语言:**\n- **Solidity** (.sol) - 以太坊智能合约，完整ANTLR支持\n- **Rust** (.rs) - Solana生态，Substrate等\n- **Move** (.move) - Aptos, Sui区块链语言\n- **Cairo** (.cairo) - StarkNet智能合约语言\n- **Tact** (.tact) - TON区块链智能合约\n- **FunC** (.fc/.func) - TON区块链原生语言\n- **FA** (.fr) - 函数式智能合约语言\n\n**传统编程语言:**\n- **Python** (.py) - 支持Web3、DeFi后端项目\n- **JavaScript/TypeScript** (.js/.ts) - Web3前端、Node.js项目 \n- **Go** (.go) - 区块链基础设施、TEE项目\n- **Java** (.java) - 企业级区块链应用\n- **C/C++** (.c/.cpp/.cxx/.cc/.C) - 区块链底层、节点客户端\n\n> 💡 **设计理念**: 基于函数粒度的代码分析，理论上可扩展到任何编程语言\n\n### 核心优势\n- 🧠 **多AI模型支持**: 集成Claude、GPT-4、DeepSeek等主流AI模型\n- 📊 **业务流可视化**: 自动生成Mermaid业务流程图\n- 🔍 **深度安全分析**: 覆盖智能合约、Web3、传统软件项目\n- ⚡ **高效并发处理**: 支持多线程并发分析\n- 🎯 **智能上下文理解**: RAG技术增强的代码理解能力\n- 🌐 **语言无关架构**: 通用的函数级分析框架\n\n## 🚀 主要特性\n\n### AI驱动的智能分析\n- **多模型支持**: Claude-4 Sonnet、GPT-4等主流AI模型\n- **上下文感知**: 基于RAG技术的智能代码理解\n- **业务逻辑分析**: 深度理解DeFi协议、治理机制和代币经济学\n\n### 可视化业务流程图\n- **自动生成**: 智能分析代码生成Mermaid图表\n- **多层次展示**: 支持项目级、文件夹级、函数级分析\n- **交互式图表**: 清晰展示合约交互和依赖关系\n\n### 全面安全检测\n- **漏洞检测**: 覆盖常见和复杂的智能合约漏洞\n- **跨合约分析**: 多合约交互分析和依赖关系跟踪\n- **业务逻辑审查**: 针对性的业务场景安全分析\n\n## 📁 项目架构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── main.py # 主入口文件\n│ ├── planning/ # 智能任务规划模块\n│ ├── validating/ # 漏洞检测验证模块\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── code_summarizer/ # 智能代码分析模块\n│ ├── reasoning/ # 推理分析模块\n│ ├── dao/ # 数据访问层\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程管理\n├── knowledges/ # 领域知识库\n├── docker-compose.yml # Docker部署配置\n└── requirements.txt # 依赖包列表\n```\n\n## ⚙️ 环境配置\n\n### 快速配置\n\n1. **复制环境变量模板**：\n ```bash\n cp env.example .env\n ```\n\n2. **编辑 `.env` 文件**，配置你的API密钥和首选项\n\n### 核心环境变量\n\n```bash\n# 数据库配置（必需）\nDATABASE_URL=postgresql://postgres:1234@127.0.0.1:5432/postgres\n\n# AI模型配置（必需）\nOPENAI_API_BASE=\"api.openai-proxy.org\" # LLM代理平台\nOPENAI_API_KEY=\"your_api_key_here\" # API密钥\nCLAUDE_MODEL=claude-sonnet-4-20250514 # 推荐Claude模型\nVUL_MODEL=claude-sonnet-4-20250514 # 漏洞检测模型\n\n# 扫描模式配置\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED # 推荐模式\nSWITCH_BUSINESS_CODE=False # 业务流分析\nSWITCH_FILE_CODE=True # 文件级分析\nCROSS_CONTRACT_SCAN=True # 跨合约/文件分析\n\n# 性能调优\nMAX_THREADS_OF_SCAN=10 # 扫描线程数\nMAX_THREADS_OF_CONFIRMATION=50 # 确认线程数\nBUSINESS_FLOW_COUNT=8 # 业务流重复数\n```\n\n> 📝 **完整配置**: 查看 `env.example` 文件了解所有可配置选项和详细说明\n\n### 推荐配置方案\n\n#### 🚀 快速开始配置（小项目 < 50个合约）\n```bash\nSCAN_MODE=SPECIFIC_PROJECT\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=False\nMAX_THREADS_OF_SCAN=3\n```\n\n#### 🏢 企业级配置（大项目 > 100个合约）\n```bash\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nHUGE_PROJECT=True\nMAX_THREADS_OF_SCAN=8\nCROSS_CONTRACT_SCAN=True\n```\n\n#### 💰 成本优化配置\n```bash\nVUL_MODEL=gpt-4-mini\nCONFIRMATION_MODEL=gpt-4-mini\nMAX_THREADS_OF_SCAN=3\nBUSINESS_FLOW_COUNT=1\n```\n\n## 🚀 快速开始\n\n### 环境要求\n- **Python 3.10+**\n- **PostgreSQL 13+**（可选，也可使用SQLite）\n- **AI API密钥**（OpenAI、Claude或其他兼容服务）\n\n### 安装步骤\n\n```bash\n# 1. 克隆项目\ngit clone https://github.com/your-org/finite-monkey-engine.git\ncd finite-monkey-engine\n\n# 2. 安装Python依赖\npip install -r requirements.txt\n\n# 3. 配置环境变量\ncp env.example .env\n# 编辑 .env 文件，填入你的API密钥和数据库配置\n\n# 4. 运行分析\npython src/main.py\n```\n\n## 📊 使用指南\n\n### 项目配置\n\n在 `src/dataset/agent-v1-c4/datasets.json` 中配置你的项目：\n\n```json\n{\n \"your_project_id\": {\n \"path\": \"/path/to/your/contracts\",\n \"white_files\": [\"Contract1.sol\", \"Contract2.sol\"],\n \"white_functions\": [\"criticalFunction1\", \"criticalFunction2\"]\n }\n}\n```\n\n### 运行分析\n\n1. **修改项目ID**: 在 `src/main.py` 第237行设置你的项目ID\n```python\nproject_id = 'your_project_id'\n```\n\n2. **执行分析**:\n```bash\npython src/main.py\n```\n\n3. **查看结果**: 分析完成后会生成 `output.xlsx` 报告\n\n### 输出文件说明\n\n- **Excel报告**: 详细的漏洞发现和分析结果\n- **Mermaid图表**: `src/codebaseQA/mermaid_output/` 目录下的业务流程图\n- **数据库记录**: 完整的分析过程和结果存储\n\n## 🎯 最佳实践建议\n\n### 性能优化\n1. **大项目处理**: 设置 `HUGE_PROJECT=True` 和适当的线程数\n2. **API成本控制**: 使用 `gpt-4-mini` 进行初步分析\n3. **内存管理**: 大项目建议设置 `SWITCH_FILE_CODE=False`\n\n### 准确性提升\n1. **业务流分析**: 保持 `SWITCH_BUSINESS_CODE=True` 获得更好的上下文理解\n2. **多轮确认**: 设置适当的 `MAX_CONFIRMATION_ROUNDS`\n3. **专业模型**: 重要项目使用 Claude-4 Sonnet 或 GPT-4\n\n### 安全建议\n1. **API密钥安全**: 使用环境变量，不要硬编码\n2. **网络访问**: 生产环境建议关闭 `ENABLE_INTERNET_SEARCH`\n3. **数据备份**: 定期备份分析数据库\n\n## 🔧 故障排除\n\n### 常见问题\n\n**Q: API调用失败**\n```bash\n# 检查API密钥和网络连接\nexport OPENAI_API_KEY=your_key\ncurl -H \"Authorization: Bearer $OPENAI_API_KEY\" https://api.openai.com/v1/models\n```\n\n**Q: 内存不足**\n```bash\n# 调整配置减少内存使用\nHUGE_PROJECT=True\nSWITCH_FILE_CODE=False\nMAX_THREADS_OF_SCAN=3\n```\n\n**Q: 分析速度慢**\n```bash\n# 增加并发线程（注意API限制）\nMAX_THREADS_OF_SCAN=8\nMAX_THREADS_OF_CONFIRMATION=5\n```\n\n## 🤝 贡献指南\n\n1. Fork 项目\n2. 创建功能分支 (`git checkout -b feature/新功能`)\n3. 提交更改 (`git commit -m '添加新功能'`)\n4. 推送到分支 (`git push origin feature/新功能`)\n5. 创建 Pull Request\n\n## 📄 许可证\n\nApache License 2.0 - 查看 [LICENSE](LICENSE) 文件了解详情\n\n## 📞 技术支持\n\n- **问题反馈**: [GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **功能讨论**: [GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **技术交流**: 加入我们的技术交流群\n\n---\n\n**🎉 让智能合约安全分析变得更智能、更高效！**"}, "ee7c05337ae0b3fc96bdbc097e2bbfc062c95ffa": {"t": 1785764481.2117333, "n": 3320, "h": "569e2c5e69d91130", "c": "# Finite Monkey Engine\n\n**基于AI的智能合约安全分析平台**\n\n## 🎯 概述\n\nFinite Monkey Engine是一个先进的智能合约安全分析平台，利用AI和前沿分析技术为区块链项目提供全面的漏洞检测和业务流分析。\n\n## 🚀 核心功能\n\n### 🧠 AI驱动分析\n- **Claude-4 Sonnet集成**：利用先进的语言模型进行智能代码理解\n- **多模态分析**：结合静态分析和AI驱动的语义理解\n- **上下文感知检测**：具备业务逻辑理解的智能漏洞检测\n\n### 📊 业务流可视化\n- **Mermaid图表自动生成**：自动生成业务流程图\n- **交互式分析**：合约交互和依赖关系的可视化表示\n- **多层次粒度**：项目级、文件夹级和函数级分析\n\n### 🔍 高级安全功能\n- **全面漏洞检测**：检测常见和复杂的智能合约漏洞\n- **业务逻辑分析**：理解DeFi协议、治理机制和代币经济学\n- **跨合约分析**：多合约交互分析和依赖关系跟踪\n\n### 🛠 模块化架构\n- **规划模块**：智能任务规划和业务流提取\n- **验证模块**：全面的漏洞检查和验证\n- **上下文模块**：具备RAG和调用树分析的高级上下文管理\n- **代码总结器**：具备强化学习能力的智能代码分析\n\n## 📁 项目结构\n\n```\nfinite-monkey-engine/\n├── src/\n│ ├── planning/ # 任务规划和业务流分析\n│ ├── validating/ # 漏洞检测和验证\n│ ├── context/ # 上下文管理和RAG处理\n│ ├── code_summarizer/ # AI驱动的代码分析和总结\n│ ├── reasoning/ # 分析推理和对话管理\n│ ├── dao/ # 数据访问对象和实体管理\n│ ├── library/ # 解析库和工具\n│ ├── openai_api/ # AI API集成\n│ └── prompt_factory/ # 提示工程和管理\n├── knowledges/ # 领域知识库\n├── scripts/ # 实用脚本\n└── docs/ # 文档\n```\n\n## 🚀 快速开始\n\n### 前置要求\n\n- Python 3.9+\n- Node.js 16+ (用于某些分析功能)\n- OpenAI API密钥或兼容的AI服务\n\n### 安装\n\n1. **克隆代码库**\n ```bash\n git clone https://github.com/your-org/finite-monkey-engine.git\n cd finite-monkey-engine\n ```\n\n2. **安装依赖**\n ```bash\n pip install -r requirements.txt\n ```\n\n3. **配置环境**\n ```bash\n cp .env.example .env\n # 编辑.env文件，配置您的API密钥和设置\n ```\n\n4. **运行分析**\n ```bash\n python src/main.py\n ```\n\n## 🔧 配置\n\n### 分析模式\n\n平台支持多种分析模式：\n\n- **业务流模式** (`SWITCH_BUSINESS_CODE=True`)：专注于业务逻辑分析\n- **文件级模式** (`SWITCH_FILE_CODE=True`)：全面的逐文件分析\n- **细粒度模式** (`SCAN_MODE=COMMON_PROJECT_FINE_GRAINED`)：详细的漏洞扫描\n\n### 环境变量\n\n```bash\n# 分析配置\nSWITCH_BUSINESS_CODE=True\nSWITCH_FILE_CODE=False\nSCAN_MODE=COMMON_PROJECT_FINE_GRAINED\n\n# AI配置\nOPENAI_API_KEY=your_api_key_here\nOPENAI_BASE_URL=https://api.openai.com/v1\n\n# 输出配置\nOUTPUT_DIR=./output\nMERMAID_OUTPUT_DIR=src/codebaseQA/mermaid_output\n```\n\n## 🎯 使用场景\n\n### DeFi协议分析\n- **流动性池安全**：AMM和借贷协议分析\n- **治理机制审查**：DAO治理和投票系统分析\n- **代币经济学验证**：代币经济学和分配机制审查\n\n### NFT项目安全\n- **铸造逻辑分析**：NFT铸造机制和访问控制审查\n- **市场集成**：二级市场集成安全分析\n- **版税机制审查**：创作者版税和费用分配分析\n\n### 跨链协议分析\n- **桥接安全评估**：跨链桥接机制分析\n- **多链部署**：不同链上的一致性安全\n- **互操作性审查**：协议交互和依赖关系分析\n\n## 📊 分析报告\n\n平台生成全面的分析报告，包括：\n\n- **安全漏洞报告**：详细的漏洞发现和严重性评级\n- **业务流图表**：合约交互的可视化表示\n- **Gas优化建议**：性能改进建议\n- **最佳实践合规性**：安全标准和指南的遵循情况\n\n## 🧪 测试\n\n运行测试套件：\n\n```bash\n# 单元测试\npython -m pytest tests/\n\n# 集成测试\npython -m pytest tests/integration/\n\n# 覆盖率报告\npython -m pytest --cov=src tests/\n```\n\n## 🤝 贡献\n\n我们欢迎贡献！请查看我们的[贡献指南](CONTRIBUTING.md)了解详情。\n\n1. Fork代码库\n2. 创建功能分支 (`git checkout -b feature/amazing-feature`)\n3. 提交您的更改 (`git commit -m 'Add amazing feature'`)\n4. 推送到分支 (`git push origin feature/amazing-feature`)\n5. 开启Pull Request\n\n## 📄 许可证\n\n此项目基于Apache License 2.0许可证 - 请查看[LICENSE](LICENSE)文件了解详情。\n\n## 🙏 致谢\n\n- **ANTLR4**：提供Solidity解析能力\n- **Claude AI**：提供高级代码理解\n- **Mermaid**：提供业务流可视化\n- **OpenAI**：提供AI驱动的分析能力\n\n## 📞 支持\n\n- **文档**：[https://finite-monkey-engine.readthedocs.io](https://finite-monkey-engine.readthedocs.io)\n- **问题**：[GitHub Issues](https://github.com/your-org/finite-monkey-engine/issues)\n- **讨论**：[GitHub Discussions](https://github.com/your-org/finite-monkey-engine/discussions)\n- **邮件**：support@finite-monkey-engine.com\n\n---\n\n**🎉 Finite Monkey Engine - 让智能合约安全分析变得智能和可访问！**"}}}} |