Find integration issues before your users do.

A practical first pass for anchor operators

Anchor Doctor is a small, extensible diagnostic tool for Stellar ecosystem integrations. It follows service URLs published in stellar.toml, checks selected endpoints, and returns findings with links and remediation guidance where available.

Run your first audit

The npm package is not published yet. Clone the repository, build the CLI, then supply an anchor hostname (with or without an HTTPS scheme).

git clone https://github.com/anchor-tools/stellar-anchor-doctor.git
cd stellar-anchor-doctor
npm ci
npm run build
node ./bin/stellar-anchor-doctor.js anchor.example.com

# Use the Testnet network passphrase
node ./bin/stellar-anchor-doctor.js testanchor.stellar.org --testnet

# Save machine-readable output
node ./bin/stellar-anchor-doctor.js anchor.example.com --format json

Diagnostic checks

The auditor first reads /.well-known/stellar.toml, then checks declared services. A suite with no declared endpoint reports that it was not configured rather than treating it as a failure.

Report formats and score

Choose text for people, json for scripts, or markdown for an issue or pull request. The command exits with code 1 when errors are found; --strict also makes warnings fail. Invalid command usage exits with code 2.

The score starts at 100, subtracts 15 for each error and 5 for each warning, and is bounded between 0 and 100. Informational findings and passing checks do not change the score. Grades are a project-defined summary, not an external certification.

CLI options

stellar-anchor-doctor anchor.example.com --format markdown --strict
stellar-anchor-doctor anchor.example.com --skip sep-6,sep-38 --timeout 12000

JavaScript and TypeScript API

Import the engine to run an audit and work with structured findings in your own Node.js application.

import { DoctorEngine } from 'stellar-anchor-doctor';

const engine = new DoctorEngine();
const report = await engine.runAudit({
  domain: 'anchor.example.com',
  testnet: false,
  timeout: 8000,
});

console.log(`${report.score}/100 (${report.grade})`);
for (const finding of report.findings) {
  if (finding.severity === 'error' || finding.severity === 'warn') {
    console.log(finding.title, finding.remediation);
  }
}

Scope and limitations

This is an early-stage diagnostic aid, not a conformance suite or a security audit. Network results are a point-in-time observation and may vary by region, time, and service availability.

• SEP checks validate selected fields and response shapes only; they do not exercise complete user flows.
• SEP-10 currently checks that a challenge includes a Manage Data operation and at least one signature; it does not cryptographically verify the signer against SIGNING_KEY or validate every nonce and domain rule.
• Some checks are intentionally shallow. A reported pass does not imply that every requirement in the linked SEP has been met.
• The tool performs network requests to endpoints named by the target's public metadata. Use only on systems you are authorized to audit.

Found an incorrect result? Please report a bug with the suite, expected behavior, observed output, and a reproducible test case. Avoid sharing credentials or personal data.

Contributing and Drips Wave

Contributions are welcome. Start with the contributor guide, browse the open issues, or read the maintainer's Wave task backlog. Check the live issue for scope, status, and current program rules before beginning work.

1. Install Node.js 20.19 or newer and run npm ci.
2. Run npm run typecheck, npm test, and npm run build.
3. Add or update mock-based tests for behavior changes; unit tests must not make live network requests.
4. Open a focused pull request that links the issue and explains the change.