bronlabs

Audit a file, package, or diff for cryptographic correctness, errs-go compliance, deserialization safety, and audit-scope risk. Use when the user asks to audit, review for security, or check before merging into in-scope code.

Audit code for timing side-channels — variable-time operations on secret values. Use when the user asks to check constant-time, timing, or side-channel safety of a file, function, or diff in this repo.

Run audit twice in parallel — once in this Claude session, once via OpenAI's Codex CLI — then merge the findings into unique-to-each / agreed-by-both buckets followed by both raw reports. Use when the user says "dual-audit <target>" or wants a second-opinion audit of a file, package, or diff.

Run pr-review twice in parallel — once in this Claude session, once via OpenAI's Codex CLI — then merge the findings into unique-to-each / agreed-by-both buckets followed by both raw reports. Use when the user says "dual-review PR

Run spec-compliance twice in parallel — once in this Claude session, once via OpenAI's Codex CLI — then merge the findings into unique-to-each / agreed-by-both buckets followed by both raw reports. Use when the user says "dual-spec-compliance <target>" or wants a second-opinion check of paper/spec/reference-implementation alignment for a package.

Review a GitHub PR by number against the repo's PR template, audit checklist, and conventions. Use when the user says "review PR

Determine whether a package faithfully implements its cited reference — academic paper, normative spec (RFC / wiki / design doc), or upstream reference implementation code. Use when the user asks to check paper/spec/reference-implementation compliance, reduction alignment, byte-exact parity with an upstream, or whether the code matches the protocol description in a README, paper, RFC, or `code` directive.

Write tests (unit, property, or smoke) for a target file/function in this repo. Use when the user says "write tests for X" or "add tests".

Manage saved addresses (the address book) on the Bron treasury platform. Use when the user wants to list saved addresses, save a new one, delete one, or look up a record id to use as `toAddressBookRecordId` in a withdrawal. State-changing actions (create, delete) require human-in-the-loop confirmation.

Create, approve, decline, or cancel transactions on the Bron treasury platform. Use whenever the user wants to send funds, broadcast a withdrawal, allowance, bridge, stake/unstake operation, or move money between accounts. Drives the Bron transaction state machine (signing-required → signing → signed → broadcasted → completed) end-to-end. Mandatory human-in-the-loop on every state-changing call. Live state via the long-poll `bron_tx_wait_for_state` MCP tool (universal) or `bron tx subscribe` + Monitor (CLI; preferred for multi-tx fan-out).

Read account balances on the Bron treasury platform. Use when the user asks "what's in account X", "show me balances", "what's our USD position", "list all non-zero positions", etc. Read-only — no state changes, no confirmation needed. Knows how to project to specific columns, fold USD totals in via `--embed prices`, and pipe to jq for custom aggregations.

Read and analyse transactions on the Bron treasury platform. Use when the user asks "show me my last transactions", "what was the volume last week", "what did this swap actually trade", "find the deposit from address X", "summarise activity for account Y", "did this withdrawal complete?", etc. Read-only — no state changes, no confirmation needed. Knows the transaction-vs-events mental model (transactions are sagas, events carry real money movement) and how to drive `bron tx list` / `bron tx events` with `--embed events` for accurate per-asset / per-USD analysis. For state changes (creating, approving, cancelling) use `bron-tx-send`. For live streaming, use `bron-tx-subscribe`.

Stream live transaction updates from the Bron treasury platform in real time via the bron CLI's WebSocket transport. Use when the user wants to "watch" many transactions in parallel, react to status changes across the workspace, build a live dashboard, or run an operator-style session over several minutes. For single-tx wait-for-completion, prefer the `bron_tx_wait_for_state` MCP tool from `bron-tx-send` — it's universal across MCP clients and doesn't need a bash background process. Same filters as `bron tx list`. Read-only, transparent auto-reconnect, no state changes. Pair with the `Monitor` tool so each pushed frame wakes the agent immediately — no polling, no manual `tail`.