fboiero/MIESC Smart Contract Security
Enterprise-grade smart contract security for every project - 50 tools across 35 analysis modules, 9 layers, AI-powered analysis, free and open-source
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 10, 2026
- License
- GPL 3.0
Pinned Snippet
uses: fboiero/miesc@55da2b3693221bccecaa2c74580c2bc509233172 # v5.4.3tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to smart contract file or directory | yes | contracts/ |
| mode | Analysis mode: scan (quick), audit-quick (4 tools), audit-full (9 layers), audit-layer (specific layer), audit-profile (named profile) | no | scan |
| profile | Audit profile when mode=audit-profile (fast, balanced, thorough, security, ci, audit, defi, token) | no | ci |
| layer | Layer number when mode=audit-layer (1-9) | no | 1 |
| output-format | Output format: json, sarif, markdown | no | sarif |
| output-file | Output file path | no | miesc-results |
| fail-on | Fail the action on findings of this severity or higher: critical, high, medium, low, none | no | high |
| min-confidence | Drop findings whose calibrated confidence is below this threshold (0.0-1.0) before reporting and gating. Confidence blends detector reliability, cross-tool agreement and the false-positive signal. Default 0 keeps everything. Applies to scan and audit-full. | no | 0 |
| timeout | Timeout per tool in seconds | no | 300 |
| skip-unavailable | Skip tools that are not installed instead of failing | no | true |
| extra-tools | Additional pip packages to install (space-separated, e.g., "mythril halmos") | no | "" |
| miesc-version | MIESC version to install (default: latest) | no | "" |
| python-version | Python version to use | no | 3.12 |
| upload-sarif | Upload SARIF results to GitHub Security tab | no | true |
| comment-on-pr | Post findings summary as PR comment | no | true |
| annotate-pr | Emit per-finding inline annotations on the PR diff (::error/::warning ...) | no | true |
| baseline-file | Path to a .miesc-baseline.json; when set, only findings NOT in the baseline are annotated inline | no | "" |
| notify-webhook | Generic webhook URL to POST a JSON scan summary to (mode=scan). SSRF-guarded; network errors never fail the run | no | "" |
| slack-webhook | Slack Incoming Webhook URL to POST a Block Kit summary to (mode=scan). SSRF-guarded; network errors never fail the run | no | "" |
| notify-min-severity | Only send notify/slack when a finding reaches this severity: info, low, medium, high, critical | no | low |
Outputs
| name | description |
|---|---|
| report-path | Path to the generated report file |
| findings-count | Total number of findings |
| critical-count | Number of critical findings |
| high-count | Number of high findings |
| exit-code | Exit code (0=pass, 1=findings exceed threshold) |