Soroban DevKit

The CLI toolkit for Stellar Soroban developers.

Build, inspect, analyze, simulate, and deploy Soroban contracts from one developer-focused CLI.

Get Started Open Web Playground View on GitHub

v2.5.0· Open Source· Rust· MIT

sdkt — soroban devkit

sdkt --version

sdkt 2.5.0

sdkt wasm inspect contract.wasm

WASM Inspection Report: contract.wasm ======================================== Size: 198 bytes SHA-256 Hash: 05befa136e7f0829a5051d97b032f355a… Version: 1 Custom Sections (1): - contractspecv0 Contract Spec Available: Yes Functions: 2 - fn transfer(1) -> 0 - fn mint(1) -> 0 Custom Types: 1 Events: 1

──────────────────────────

sdkt diff --old-wasm old.wasm --new-wasm new.wasm --upgrade-safety

Upgrade Safety ============== Compatible: NO Breaking: - Changed signature: mint() - Removed event: Transfer Non-breaking: - Added function: balance() - Added event: Mint

Features

Everything a Soroban dev needs, in one CLI

sdkt consolidates the fragmented developer lifecycle — contract inspection, XDR decoding, storage TTL analysis, static security analysis, WASM diffing, and multi-contract deployment orchestration — into a single CLI.

Contract Inspection

Read a contract's ABI, functions, events, and metadata from any compiled WASM, fully offline. sdkt wasm inspect

XDR Decoding

Decode base64 XDR to JSON for ScVal, transaction envelopes, and contract events. sdkt decode

Storage TTL & Rent Analysis

Check storage TTL / rent visibility and classify Instance, Persistent, and Temporary entries. sdkt storage analyze

Static Security Audit

Static analysis of contract source against AUTH-001/002/003 and MOVE-001 rules — no network, no secrets. sdkt audit

Upgrade Safety Diff

Diff two WASM files offline and get a breaking-change verdict before deploying. sdkt diff --upgrade-safety

Transaction Workflow

Build, validate, simulate, sign, and submit Soroban transactions — with fully offline ED25519 signing. sdkt tx sign

Build & Deploy

Compile workspace contracts into optimized WASMs and deploy with a --deny-breaking upgrade guard. sdkt deploy

Contract Health Reports

Unified read-only posture report covering WASM, storage, TTL, and a health verdict. sdkt health

Multi-Contract Projects

Workspace orchestration with topological deploy ordering, lock files, and reproducible dependency fetches. sdkt project deploy

Developer Workflow

From contract to chain, one flow

Every stage maps to real sdkt commands. Stages 01–04 run offline; only the deployed-contract reads and stage 05 need an RPC endpoint.

Inspect

sdkt wasm inspect <file>sdkt inspect <contract-id>

Analyze

sdkt audit <path.rs>sdkt storage analyze <contract-id>

Validate

sdkt diff --upgrade-safetysdkt tx simulate --envelope

Build

sdkt buildsdkt lock generate

Deploy

sdkt deploy --wasm --saltsdkt verify --contract

Terminal

Real commands, real output

Every command and output block below is taken from the sdkt CLI surface in this repository.

static security audit

sdkt audit contracts/token/src/lib.rs

Static Analysis Report: contracts/token/src/lib.rs Severity: 0 critical, 1 warning, 0 info (1 total) [warning] MOVE-001 [Token::transfer:e]: Local `e` in `Token::transfer` is used as a call argument 4 times — possible move-after-use

sdkt audit contracts/token/src/lib.rs --format json

{"findings":[{"rule_id":"MOVE-001", "severity":"warning","message":"…", "location":"Token::transfer:e"}], "summary":{"critical":0,"warning":1, "info":0,"total":1}}

build → sign → submit

# 1. create a local signing identity (offline)

sdkt identity generate alice

# 2. build an unsigned envelope (offline)

sdkt tx build \ --source <SOURCE_ACCOUNT> \ --sequence <SEQ> \ --contract <CONTRACT_ID> \ --function hello \ --output unsigned.xdr

# 3. validate the envelope offline

sdkt tx validate --envelope unsigned.xdr

# 4. simulate against the network (RPC)

sdkt tx simulate --envelope unsigned.xdr

# 5. sign with the local identity (offline)

sdkt tx sign --input unsigned.xdr \ --output signed.xdr --identity alice \ --network testnet

# 6. submit the signed envelope (RPC)

sdkt tx submit --envelope signed.xdr

Most commands accept --format json for scripting and CI integration. Commands that need an RPC endpoint accept --rpc-url, --network-passphrase, or a saved --network-profile.

Why Soroban DevKit

One CLI instead of a pile of scripts

Soroban developers work across multiple development workflows including contract inspection, XDR handling, storage and TTL analysis, static security review, transaction simulation and signing, and deployment.

In practice that means context-switching across several CLI tools and hand-written RPC scripts. Soroban DevKit brings the supported workflows into a unified CLI with consistent flags, consistent --format json output, and an offline-first default.

Offline-first. decode, diff, audit, wasm inspect, and tx sign need no RPC and no secrets leaving your machine.
Upgrade safety as a gate. Breaking-change verdicts you can run in CI before a contract upgrade ships.
Scriptable. JSON output on most commands, plus shell completions for bash, zsh, fish, powershell, and elvish.
Extensible. The audit engine loads third-party rules as sandboxed WASM plugins or native shared libraries.

Stellar / Soroban

Built for the Soroban ecosystem

Soroban DevKit is built specifically for the Stellar Soroban developer ecosystem. It speaks Stellar XDR natively, reads contract state through the Soroban RPC interface, and enriches account data via Horizon.

Networks are addressed by named profile or explicit endpoint, with a built-in testnet default and an explicit guard when targeting mainnet.

Soroban RPC. Contract inspection, storage and TTL reads, events, transaction simulate/submit, fee statistics, and on-chain WASM metadata.
Stellar XDR. ScVal, TransactionEnvelope, and ContractEvent decoding, plus typed envelope construction and ED25519 signing.
Horizon. Account balances and signers via sdkt account.
Network profiles. Save an RPC URL and passphrase once, reuse it from any RPC command.

Installation

Running in under five minutes

Pick an install method, verify, then run your first command.

curl · install.sh

# downloads the release binary for your OS/arch,
# verifies its SHA-256 checksum, installs to ~/.local/bin
curl -fsSL https://raw.githubusercontent.com/SaboLabs/soroban-devkit/main/install.sh | bash
# verify
sdkt --version

crates.io · cargo install sdkt-cli

# requires Rust 1.88.0+
cargo install sdkt-cli

# build from source
git clone https://github.com/SaboLabs/soroban-devkit
cd soroban-devkit
cargo install --path crates/sdkt-cli

Verify the install with sdkt --version, then explore the full command set with sdkt --help. Shell completions for bash, zsh, fish, powershell, and elvish are generated with sdkt completions. The crates.io package is named sdkt-cli; when its published version trails the GitHub release, use install.sh or build from source to get v2.5.0.

Open Source

Transparent by default

A public repository, MIT license, an 8-crate Rust workspace, documented milestones, and a CI pipeline that runs the full test suite on every change. No telemetry, no account, no SaaS dependency — the CLI is a standalone binary.

lang Rust (edition 2021, MSRV 1.88) ecosystem Stellar Soroban license MIT crates 8-crate workspace mode offline-first CLI install curl / cargo

Community & Contribution

Try sdkt. Break it. Tell us what you found.

Real developer usage and feedback is exactly what this project needs right now. Open an issue for a bug or a missing feature, submit feedback on the workflows, and contribute — docs, tests, and small fixes all count.

View the Repository Open an Issue CONTRIBUTING.md