UTXO X-RAY

Agents write the contracts.
The gate decides what ships.

utxray interrogates a Cardano smart contract across five layers — toolchain, contract, schemas, behavior, chain — and returns every verdict as structured JSON. It never designs, never implements. It judges.

$ curl -sSfL https://utxray.paopao.studio/install.sh | bash
34 commands 24 fully offline exit code gates the merge verified on Preview
Copy & go

The product is a prompt away.

You don't operate utxray — your agent does. These cards are messages you send to your agent; the agent does everything they describe.

  1. 1Copy the prompt that matches your job
  2. 2Paste it into your agent's chat — Claude Code, Cursor, anything with a shell
  3. 3Done. The agent reads skill.md, installs the CLI, and runs the gate itself

Set up the gate

Set up utxray as the quality gate for my Aiken project.

Read https://utxray.paopao.studio/skill.md and follow it:
1. install the CLI (https://utxray.paopao.studio/install.sh)
2. run the full gate — build, test, schema validate,
   trace, tx evaluate — and fix anything that fails
3. wire the gate into CI so a red verdict blocks merge

Treat a failing gate as a hard stop. Never claim the
contract works until every check returns "pass".

Install as a Claude Code skill

Install utxray as a skill in this project:

mkdir -p .claude/skills/utxray
curl -sSfL https://utxray.paopao.studio/skill.md \
  -o .claude/skills/utxray/SKILL.md

Use it whenever we build, debug, or deploy
Aiken contracts.

Debug a failing transaction

My Cardano transaction is failing. Use utxray:

1. utxray diagnose --tx tx.cbor
2. run every suggested_command it returns
3. re-run utxray tx evaluate until "pass"
4. save a replay bundle of the original failure
The scan

Five layers deep.
One question each.

A contract that "looks right" and a contract that is proven right are different things when the code moves real money. The beam goes top to bottom; a contract ships only when every layer answers pass.

L0 · TOOLCHAIN

Can anything here be trusted to run?

aiken on PATH, network config parsed, Blockfrost reachable — checked before any other verdict is allowed to exist.

env
L1 · CONTRACT

Does the contract hold together on its own?

The Aiken toolchain — compile, type-check, unit tests — wrapped into structured verdicts instead of console prose.

buildtypechecktesttrace
L2 · SCHEMAS

Do on-chain and off-chain speak the same types?

Every datum and redeemer checked against the CIP-0057 blueprint — the classic Cardano failure mode, caught before it costs anything.

schema validateredeemer-indexscript-data-hashcbor decode / diff
L3 · BEHAVIOR

Does it do what the spec says — and refuse what it must?

Every transition executed with real transaction contexts — including the negative paths that are required to fail. The checks an author never writes against their own blind spots.

tracetest-sequencetx build / evaluate
L4 · CHAIN

Does it survive contact with the real network?

Real transactions on Preview testnet, UTxO state diffed before and after — then frozen into a replay bundle you can re-run byte-for-byte, forever.

tx submitutxo diffreplay bundle / run
{ "all_pass": true }

Only then does the contract ship. The verdict is machine-readable, the exit code is binary, and an agent cannot talk its way past it — in its own loop, or in your CI.

On failure

A red verdict is a work order.

Cardano's native errors are famously opaque — ScriptFailure, and good luck. utxray classifies every failure into an error code with the exact commands to run next, so the agent's fix loop closes without a human translating.

  • Status semantics agents can trust. status: "error" means the tool itself broke. A validator returning false is status: "ok" with result: "fail" — a verdict, not a crash. The gate never confuses the two.
  • Error codes, not stack traces. diagnose maps node noise to a stable taxonomy an agent can branch on.
  • Next moves included. Every diagnosis carries suggested_commands — the difference between a wall and a work order.
The handoff

No documentation site.
On purpose.

The reader of record here is an agent, and agents don't browse — they fetch. Everything they need lives at stable plain-text URLs. The human's entire job is one paste.

/llms.txtentry point — what an agent reads first
/skill.mdthe full lifecycle: prerequisites → verify loop → Preview deploy
/manifest.mdevery command, with test-coverage status
/install.shone-liner install, macOS & Linux
These files are copied from the repository at build time — the site can never drift from the tool. You review verdicts, not code: a green gate comes with JSON evidence you can audit.
The instrument panel

34 commands. Zero stubs.

Aiken
  • build
  • typecheck
  • test
  • trace
Schemas & data
  • schema validate
  • cbor decode
  • cbor diff
  • script-data-hash
  • redeemer-index
  • datum resolve chain
Transactions
  • tx build
  • tx evaluate chain
  • tx simulate
  • tx sign
  • tx submit chain
Chain state
  • utxo query chain
  • utxo diff chain
  • context params chain
  • context tip chain
Replay
  • replay bundle
  • replay run
  • replay diff
Analysis
  • diagnose
  • auto
  • budget show
  • budget compare
Blueprint & UPLC
  • blueprint show
  • blueprint apply
  • blueprint convert
  • uplc eval
Project
  • env
  • gen-context
  • test-sequence
  • scaffold test

Commands marked chain need a Blockfrost key; the other 24 run fully offline — deterministic checks in CI with zero secrets. Full detail: /manifest.md