acct-missing
The endpoint answered 404. The account was never created, or it was merged. HIGH, and it cannot be accepted.
Stellar account posture / read-only
The chain knows. Your policy should too.
Gauge reads an account's signers, thresholds and flags, compares them with what you declared, and exits nonzero when they disagree. It never holds a key, never builds a transaction, and treats every downloaded value as hostile.
$ stellar-gauge check --network testnet \ --fail-on warn \ --endpoint \ https://horizon-testnet.stellar.org \ GDSX2WUF…UVBEVGaccount GDSX2WUF…UVBEVG findings: 1 (0 accepted) [warn] flag-undeclared-clawback clawback is enabled and the policy does not declare it evidence: clawback observed true, and no clawback expectation is declaredresult: 1 findings (0 high, 1 warn, 0 info), 0 acceptedexit code: 1Exit 1
0
Pass
The run completed and every rule it evaluated agreed with the policy.
1
Findings
At least one finding reached the --fail-on threshold.
2
Config or usage
A bad flag, a rejected policy, an unknown key or a secret seed.
3
Source or internal
Unreachable endpoint, oversized body, malformed response or a rule panic.
The comparison
Two inputs. One result.
Gauge is a state comparison, not a scanner. It needs something to compare against, and it says so when that something is missing.
Declared
Your gauge.toml: the account's role, expected signers, thresholds, flags and home domain.
- role = "treasury"
- expected_signers = [...]
- expected_flags = { ... }
Observed
A snapshot fetched through Horizon, decoded strictly and sanitized before it reaches any output.
- network passphrase
- signers and weights
- thresholds and flags
A disagreement becomes a finding with a stable rule ID, a severity, an evidence line and a fingerprint. An accepted risk matches on rule and account; the fingerprint is a stable identifier for the finding.
Scope
What Gauge reads
Public ledger state, through one Horizon endpoint. Nothing else is downloaded, and no response body is ever logged.
- Signers
- Who can sign, and with how much weight. The master key is a signer like any other, and sponsored signers are named.
- Thresholds
- How much weight each operation tier requires. Low, medium and high thresholds are read as stored, without interpretation.
- Flags
- What the issuer enabled. Authorization required, revocable, immutable and clawback are compared only where the policy declares a value.
- Home domain
- The identity the account points at. Printed as a fact today; the guarded SEP-1 identity checks are specified but not shipped.
Shipped today
Four rules live, twelve specified
The account and flag families work now. Role-based severities and the signer, threshold and identity rules are still open.
acct-network-mismatch
The endpoint's passphrase differs from the requested network. No account is read. HIGH, and it cannot be accepted.
flag-drift
A declared flag disagrees with the chain. Only declared flags are compared. WARN baseline, HIGH for an issuer once role profiles land.
flag-undeclared-clawback
Clawback is enabled and the policy does not declare it. WARN baseline, HIGH for an issuer once role profiles land.
The boundary
A clean report is a posture result, not proof that the account cannot be compromised. Every report footer
Gauge cannot see who holds a key, whether signers are separate people, or what happens off-chain. It does not audit transactions, balances, offers, claimable balances, liquidity pools or Soroban contracts. It never describes an account as secure or safe.
Start here
Run it from source
There is no tagged release yet. The repository is the install path.
Shell
git clone https://github.com/posture-sec/guage cd guage go run ./cmd/stellar-gauge check \ --network testnet \ --endpoint https://horizon-testnet.stellar.org \ G...
Requires Go 1.27.3. The first command reads one account and exits 0, 1, 2 or 3. Guides for check, audit and CI.