RustAG
Get started

Quickstart

Two minutes from a built binary to a signed EvidenceBundle. RustAG ships as a single Rust binary you build from source — there is no published package yet.

Prerequisites

  • Rust 1.96+ — pinned in rust-toolchain.toml, so rustup selects the right toolchain automatically.
  • A mainnet RPC endpoint — the source the closure resolver fetches real state from. A free Alchemy or Infura key is strongly recommended. The built-in demo works without one.
  • Node 22+ / pnpm 10+ — only needed for the TypeScript SDK and Next.js dashboard. The CLI does not require them.

Build the CLI

bash
git clone https://github.com/ShahiTechnovation/RustAG && cd RustAGcargo build --release            # produces target/release/rustag # Add to PATHexport PATH="$PWD/target/release:$PATH"   # macOS/Linux$env:PATH = "$PWD\target\release;$env:PATH"  # Windows PowerShell rustag --version    # rustag 0.1.0rustag --help       # lists all subcommands

Run the built-in demo

The --demo flag runs a self-contained ownership-takeover payload — no RPC key, no network. It's the fastest way to see a complete signed EvidenceBundle end-to-end.

bash
rustag rehearse --demo # Output:#  ✓ Rehearsal complete · Grade A#  ✓ Semantic diff:#    - UpgradeAuthority: 7xKX...→ 3mPQ... (ROTATED)#  ✓ Alarms: 1 CRITICAL (upgrade-authority)#  ✓ Bundle written → groundtruth-bundle.json#  ✓ Closure written → groundtruth-closure.json#  ✓ Signed by: ephemeral key (pubkey printed above)
Ephemeral key
If no --signer is provided, an ephemeral Ed25519 keypair is generated and its pubkey printed. Pass --signer ./my-key.json to sign with your own key.

Rehearse a real proposal

Point RustAG at a live multisig VaultTransaction proposal address. It fetches, decodes, and rehearses the proposal against current mainnet state.

bash
export RUSTAG_MAINNET_RPC="https://mainnet.alchemy.com/?api-key=YOUR_KEY" rustag rehearse \  --proposal 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU \  --rpc $RUSTAG_MAINNET_RPC \  --out bundle.json \  --closure closure.json # Or rehearse a raw transaction directly:rustag rehearse --payload <BASE64_TX> --rpc $RUSTAG_MAINNET_RPC

Use --fail-on high to make the command exit non-zero if any alarm reaches HIGH or above — useful as a CI gate in your multisig approval workflow.

bash
rustag rehearse \  --proposal <PUBKEY> \  --rpc $RPC \  --fail-on high      # exit 1 if any HIGH/CRITICAL alarm fires

Verify the bundle offline

Anyone can re-verify an EvidenceBundle independently — no RPC call, no trust in the rehearser. The verifier re-derives the state roots from the closure and checks the Ed25519 signature.

bash
rustag verify bundle.json --closure closure.json # Output:#  ✓ Signature valid#  ✓ pre_state_root matches closure#  ✓ Grade A (deterministically re-executable)#  Signer: <PUBKEY>

Forensics mode

Re-execute any historical mainnet transaction by signature. In counterfactual mode, substitute the deployed program with a patched ELF to answer: "would this fix have stopped the attack?"

bash
# Re-execute a historical transactionrustag forensics <SIGNATURE> --rpc $RPC # Counterfactual: substitute a patched program ELFrustag forensics <SIGNATURE> \  --rpc $RPC \  --patch ./patched-program.so \  --patch-program <PROGRAM_ID> # Output: BLOCKED ✓  or  REPRODUCED ✗

Dashboard & API

bash
# Start the REST + RPC backendexport RUSTAG_MAINNET_RPC="https://mainnet.alchemy.com/?api-key=YOUR_KEY"rustag serve # Start the Next.js dashboard (separate terminal)pnpm installNEXT_PUBLIC_RUSTAG_API_URL=http://localhost:9000 pnpm --filter dashboard dev# open http://localhost:3000

The REST API exposes POST /api/rehearse (submit a payload, get a signed EvidenceBundle) and POST /api/verify (verify a bundle offline). See the SDK & API reference for the full contract.

Early-access limits

Early access
The CLI and REST API are the working Phase 1 deliverable. The multisig web UI integration (signer-review embed), Yellowstone gRPC real-time recording, hosted Evidence Registry, and per-flow pricing are Phases 2–5 and are not yet released. Everything described on this page works today — build from source and run locally.