Free tool
Is your codebase ready for an audit?
Most auditor time is spent on things that are not the audit: missing tests, stale dependencies, unclear invariants, no scope. Audit Prep measures those before the clock starts, so the review goes to the code that holds the money.
Single file, Node 18+, no dependencies, no network calls. MIT licensed.
Run it
curl -O https://dodu.se/downloads/dodu-audit-prep.mjs
node dodu-audit-prep.mjs /path/to/project
# or write the report and fail CI below a score
node dodu-audit-prep.mjs . --report audit-prep-report.md --min-score 75It reads the project, scores eight phases from 0 to 100, and prints a Markdown report with the three phases to fix first. It does not run your tests and does not execute project code.
The score
90-100
Audit ready
75-89
Almost ready
50-74
Needs work
below 50
Not ready
The score measures preparation for a review. It is not a security rating. A codebase can score 100 and still contain a Critical bug; that is what the audit is for.
What it checks
1. Test coverage
Test files per source file, coverage tooling, CI that runs the suite.
2. Test quality
Assertions, fuzz tests, invariant tests, revert and event assertions.
3. Documentation
README, NatSpec coverage, architecture docs, threat model or known issues.
4. Code hygiene
TODO/FIXME density, debug imports, floating pragmas, tx.origin.
5. Dependencies
Lockfiles, remappings, submodules, wildcard versions.
6. Best practices
SafeERC20, reentrancy guard or CEI, access control, initializer safety.
7. Deployment
Deploy scripts, .env.example, build config, deployment docs.
8. Project context
Scope, architecture, invariants, known issues, trust assumptions.
What the output looks like
# Audit readiness report
- Target: /src/my-protocol
- Project type: Foundry
- Files scanned: 214 (96 source, 38 test)
- Source lines: 18,402
- Score: 72/100 — Needs work
## Phases
| Phase | Score | What was found |
|------------------|------:|-------------------------------------------------|
| Test coverage | 70 | 38 test files for 96 source files; no coverage |
| Test quality | 60 | 214 assertions; no invariant tests |
| Documentation | 45 | README present; 12 NatSpec comments |
| Code hygiene | 80 | 3 TODOs; pragmas pinned; no tx.origin |
| Dependencies | 60 | foundry.lock present; no remappings.txt |
| Best practices | 85 | SafeERC20; reentrancy guard; access control |
| Deployment | 80 | deploy scripts; .env.example; Foundry config |
| Project context | 55 | scope described; no invariants; no trust notes |Use it as a Claude Code skill
The same check is available as a skill, so an agent can run it and explain the result while you work. Install it once:
mkdir -p ~/.claude/skills/audit-prep
curl -o ~/.claude/skills/audit-prep/SKILL.md \
https://dodu.se/downloads/dodu-audit-prep-SKILL.md
# then, in a project
/audit-prepReady for the real review?
Fixed fee, fixed date, one reviewer, fix verification included.