Solana Foundation Open-Sources Microscope, a Free Self-Hosted Program Monitoring Tool

The Solana Foundation published Microscope on September 22, a self-hosted monitoring and alerting stack for Solana on-chain programs. The MIT-licensed repository ships a Rust-based indexer, a Prometheus and Loki metrics pipeline, and a generated Grafana dashboard. Protocol teams deploy it in their own environment; the Foundation does not host it or receive any deployment data.

Asymmetric Research is a smart-contract security auditing firm that tested Microscope and reported that its alert categories map to the STRIDE security framework. The firm has evaluated a range of Solana DeFi protocols; its earlier STRIDE findings covered logging gaps and key management weaknesses across 40 audited protocols. STRIDE maps threats across six categories: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.

What Microscope Monitors and How Alerts Work

Microscope subscribes to confirmed transactions for one configured program, decodes each with Carbon, and writes structured records through two paths: metrics to Prometheus and structured logs to Loki via Alloy, with a 30-day default retention window. Grafana reads both to produce the dashboard and evaluate alert rules.

Four record types are tracked:

• program_instruction -- every IDL-decoded program instruction
• program_event -- IDL-decoded log or direct event-CPI emissions
• multisig_activity -- Squads v3, v4, and Smart Account (v5) instructions normalized to stable action names
• event_decode_failure -- event payloads the IDL decoder rejected

Raw program-log string matching is not supported. Alerts target decoded events, instructions, or Squads actions only. Rules are defined in microscope.toml with configurable conditions on any decoded field path. Each alert specifies a kind (event, instruction, or multisig), a name matching an instruction or event declared in the IDL, a severity level, one or more notification channels, and optional field conditions using operators including eq, ne, gt, gte, contains, and exists. Conditions combine under match = "all" or match = "any". Notifications route to Slack, Telegram, or PagerDuty.

The data source is Yellowstone gRPC by default. An alternative RPC polling mode is available for teams that prioritize endpoint cost over latency. In Yellowstone mode, an RPC endpoint acts as a gap-recovery layer when the stream misses slots due to disconnects. Both modes maintain a durable checkpoint so restarts replay missed transactions rather than skipping them.

Squads Multisig Monitoring

A single Microscope deployment can monitor one program and, optionally, one Squads multisig. Configure the default vault address, internal state account, and version (v3, v4, or v5) in microscope.toml. At startup the indexer verifies locally that the state account derives the configured vault without an RPC call.

Version-specific instructions are normalized to actions like proposal_approved, transaction_executed, member_added, and threshold_changed. For v4 governance changes, the documentation recommends alerting on configuration_transaction_created rather than member_added, because the v4 config transaction applies changes from a stored account and its execution emits only configuration_transaction_executed without the individual change details.

Docker Compose, AWS, GCP, and Kubernetes Deployment

Microscope ships four deployment paths:

• Local Docker Compose: just up after editing microscope.toml and a .env file
• AWS Terraform: provisions a dedicated VPC, an SSH-only Ubuntu VM, a private versioned bucket, a cloud secret, and a least-privilege workload identity
• GCP Terraform: the same pattern with state stored in a GCS bucket
• Kubernetes: a reference configuration for teams running their own Prometheus, Loki, and Grafana stack

A Grafana Cloud mode is also available for teams that want to push metrics and logs into an existing hosted stack. That mode runs only the indexer and Alloy containers; local Grafana, Loki, and Prometheus are not required.

The bundled setup-deployment Claude Code skill automates initial configuration by interviewing the operator for each value, deriving alert rules from the IDL, and writing microscope.toml and .env (or terraform.tfvars for cloud deployments).

Getting Started and Jupiter Lend Reference Config

Because the IDL decoder compiles the target program ID and IDL as build inputs rather than runtime parameters, just generate must run after any IDL change. The indexer refuses to start when its config names a different program or IDL than the compiled decoder.

A complete working example at docs/examples/jupiter-lend.md monitors Jupiter JUP$0.299-2.1% Lend and the Squads multisig that governs its upgrade authority. The Foundation notes it is a teaching example only; it does not operate that deployment or have any affiliation with Jupiter.

Development requires Rust 1.97 or newer, Node.js 24 or newer, and Python 3.11 or newer. The repository includes a CONTRIBUTING.md, a SECURITY.md for private vulnerability reporting, and a CHANGELOG.