Tokamai

Tokamai is a developer-facing monitoring platform built specifically for Solana programs. Where traditional security audits examine source code before deployment, Tokamai operates continuously at runtime, streaming live transaction data and flagging anomalous behavior as it happens on-chain. The platform launched in December 2024 and positions itself as the first dedicated program monitoring service for Solana.

The Problem It Solves

Solana programs run in a fast, composable environment where transactions can touch dozens of interdependent programs in a single call. When something goes wrong, an unexpected error code, a compute unit spike, or an unusual account pattern, a development team's first signal is typically a user complaint or a jump in support tickets. There is no native Solana primitive for program-level runtime observability, and generic blockchain explorers provide transaction-by-transaction data without behavioral context. Tokamai is built to close that gap, giving protocol teams a continuous feed of program activity with anomaly scoring attached.

Core Mechanism

Tokamai ingests the full Solana transaction stream and filters it down to every transaction that touches programs in a user-defined watchlist. For each matched transaction, the platform surfaces structured context: fee paid, compute units consumed, signer set, balance changes across all involved accounts, and parsed instruction data. This goes beyond raw log output. The goal is to give engineers the context they need to understand what happened without manually querying multiple RPC endpoints.

The anomaly detection layer maintains per-program behavioral baselines and applies machine-learning models to score each incoming transaction. The baseline captures what normal execution looks like for a given program over time, so deviations register as anomalies rather than noise. Error-rate spikes are flagged in sub-minute detection windows, meaning a protocol team can receive an alert while an incident is still unfolding rather than discovering it in the post-mortem.

Dependency Graph Monitoring

A notable aspect of Tokamai architecture is its treatment of Solana composability as a monitoring surface rather than a blind spot. The platform constructs a dependency graph for each watched program, capturing upstream callers, downstream programs it invokes, and shared external dependencies such as price oracles. Anomalous activity anywhere in this graph, not just in the watched program itself, is surfaced. If an oracle or shared library program that a protocol depends on begins behaving unusually, Tokamai can surface that signal before it propagates into the execution path.

This approach reflects the reality of how exploits and bugs propagate in composable DeFi. Many incidents originate in a dependency or a third-party program that a team did not write and may not actively monitor. Dependency-graph coverage extends the monitoring perimeter beyond the code a team directly controls.

Alerting and Routing

Alerts from Tokamai carry the full transaction context, fee, compute, signers, balance changes, and the responsible program, rather than a bare notification. Teams can configure alert routing per watchlist, directing different program alerts to different channels depending on severity or team ownership. Supported integrations include Slack, PagerDuty, Telegram, and custom webhooks. The platform maintains a full audit trail of every fired notification, which supports incident review and on-call handoffs.

The watchlist-centric model means teams can organize monitoring around logical units, one watchlist per deployed program, per environment, or per risk tier, and configure alerting rules and routing independently for each.

Ecosystem Positioning

Tokamai targets the Solana developer and protocol operations segment: teams running programs in production who need runtime visibility comparable to what web application monitoring tools such as Datadog or Sentry provide for traditional software. The Solana ecosystem has mature pre-deployment security tooling, including static analysis and third-party audit firms, but runtime observability has been a gap relative to what is available in EVM ecosystems.

The platform requires no on-chain integration. It operates as an off-chain monitoring layer by consuming the transaction stream, which means teams can add monitoring to an existing deployed program without code changes or redeployment. Tokamai does not have a protocol token. It is a SaaS developer tool. There is no governance token, liquidity mining mechanism, or on-chain treasury associated with the platform. The project was founded in December 2024, participated in the Colosseum hackathon ecosystem, and operates a live application at app.tokamai.com. Team composition is not publicly disclosed.