---
title: "Project detection"
description: "How OMS works out your project's toolchain by reading files, without running any of your code."
url: https://barestate.xyz/docs/concepts/project-detection
---

# Project detection

> How OMS works out your project's toolchain by reading files, without running any of your code.

OMS learns which toolchain your project uses by reading a handful of project files and comparing what it finds with a set of pinned versions. Nothing in your project is executed, so detection is safe to run on code you haven't looked at yet.

## What it reads

The toolchain reader opens only `Anchor.toml`, `Cargo.toml`, `Cargo.lock`, `package.json`, `config` and `config.toml`, plus files ending in `.ts`, `.tsx`, `.js`, `.mjs` and `.rs`. It skips symlinks and these folders: `.git`, `.oms`, `node_modules`, `target`, `vendor` and `.oms-cargo`.

| Limit | Value |
|---|---|
| Depth | 12 |
| Files | 2,000 |
| Per file | 2 MB |
| Total | 16 MB |

TOML files are parsed by `python3 -I` with `tomllib`, so this needs Python 3.11 or newer.

## What it checks against

The pinned versions are Anchor 1.2.2, Solana and Agave 4.4.1, platform-tools 1.58, npm, and SBPF arch v3. The rules are `anchor`, `pins`, `crates`, `duplicates`, `client`, `transaction`, `arch` and `advisory`. Each finding carries a source URL and an observation date of 2026-11-08.

The `advisory` rule flags Anchor 1.0.0 and 1.0.1, but only when the lock file confirms the version.

## Where you see it

In a session, a summary of the report goes into the system prompt as untrusted project data, and the model can call a `toolchain_check` tool for the full report. On the command line, run `oms toolchain check`. See [Check your toolchain](https://barestate.xyz/docs/guides/check-your-toolchain). OMS also lists installed program clients from `node_modules/<client>/package.json` as "name version".

## Other detection

For lookups, OMS reads manifests (`Cargo.toml`, `package.json`, `Anchor.toml` and `programs/*/Cargo.toml`, 200 KB in total) and imports from at most 200 files and 200 names. It doesn't follow symlinks, and it skips `node_modules`, `target` and dot folders.