Quickstart
Two minutes from a built binary to a signed EvidenceBundle. RustAG ships as a single Rust binary you build from source — there is no published package yet.
Prerequisites
- Rust 1.96+ — pinned in
rust-toolchain.toml, sorustupselects the right toolchain automatically. - A mainnet RPC endpoint — the source the closure resolver fetches real state from. A free Alchemy or Infura key is strongly recommended. The built-in demo works without one.
- Node 22+ / pnpm 10+ — only needed for the TypeScript SDK and Next.js dashboard. The CLI does not require them.
Build the CLI
git clone https://github.com/ShahiTechnovation/RustAG && cd RustAGcargo build --release # produces target/release/rustag # Add to PATHexport PATH="$PWD/target/release:$PATH" # macOS/Linux$env:PATH = "$PWD\target\release;$env:PATH" # Windows PowerShell rustag --version # rustag 0.1.0rustag --help # lists all subcommandsRun the built-in demo
The --demo flag runs a self-contained ownership-takeover payload — no RPC key, no network. It's the fastest way to see a complete signed EvidenceBundle end-to-end.
rustag rehearse --demo # Output:# ✓ Rehearsal complete · Grade A# ✓ Semantic diff:# - UpgradeAuthority: 7xKX...→ 3mPQ... (ROTATED)# ✓ Alarms: 1 CRITICAL (upgrade-authority)# ✓ Bundle written → groundtruth-bundle.json# ✓ Closure written → groundtruth-closure.json# ✓ Signed by: ephemeral key (pubkey printed above)--signer is provided, an ephemeral Ed25519 keypair is generated and its pubkey printed. Pass --signer ./my-key.json to sign with your own key.Rehearse a real proposal
Point RustAG at a live multisig VaultTransaction proposal address. It fetches, decodes, and rehearses the proposal against current mainnet state.
export RUSTAG_MAINNET_RPC="https://mainnet.alchemy.com/?api-key=YOUR_KEY" rustag rehearse \ --proposal 7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU \ --rpc $RUSTAG_MAINNET_RPC \ --out bundle.json \ --closure closure.json # Or rehearse a raw transaction directly:rustag rehearse --payload <BASE64_TX> --rpc $RUSTAG_MAINNET_RPCUse --fail-on high to make the command exit non-zero if any alarm reaches HIGH or above — useful as a CI gate in your multisig approval workflow.
rustag rehearse \ --proposal <PUBKEY> \ --rpc $RPC \ --fail-on high # exit 1 if any HIGH/CRITICAL alarm firesVerify the bundle offline
Anyone can re-verify an EvidenceBundle independently — no RPC call, no trust in the rehearser. The verifier re-derives the state roots from the closure and checks the Ed25519 signature.
rustag verify bundle.json --closure closure.json # Output:# ✓ Signature valid# ✓ pre_state_root matches closure# ✓ Grade A (deterministically re-executable)# Signer: <PUBKEY>Forensics mode
Re-execute any historical mainnet transaction by signature. In counterfactual mode, substitute the deployed program with a patched ELF to answer: "would this fix have stopped the attack?"
# Re-execute a historical transactionrustag forensics <SIGNATURE> --rpc $RPC # Counterfactual: substitute a patched program ELFrustag forensics <SIGNATURE> \ --rpc $RPC \ --patch ./patched-program.so \ --patch-program <PROGRAM_ID> # Output: BLOCKED ✓ or REPRODUCED ✗Dashboard & API
# Start the REST + RPC backendexport RUSTAG_MAINNET_RPC="https://mainnet.alchemy.com/?api-key=YOUR_KEY"rustag serve # Start the Next.js dashboard (separate terminal)pnpm installNEXT_PUBLIC_RUSTAG_API_URL=http://localhost:9000 pnpm --filter dashboard dev# open http://localhost:3000The REST API exposes POST /api/rehearse (submit a payload, get a signed EvidenceBundle) and POST /api/verify (verify a bundle offline). See the SDK & API reference for the full contract.