Vibe coding on Solana with a test-first loop
Ask an AI coding agent for a Solana program from a ten-word prompt and it will hand you an Anchor workspace, a client script, and a passing test suite in two minutes. Then you read the instruction accounts and notice the handler never checks who signed the transaction or whether the state account belongs to the caller. Because code generation is next-token prediction, an unguided model writes both the program and a happy-path test that flatters the program.
Getting production-grade Solana code out of an agent requires current documentation in context, an architecture and specification written before the Rust code, and failing tests that act as hard constraints on every instruction.
Wire current Solana docs into your editor
Solana crates and Anchor macros move fast enough that model weights go stale between point releases. Without live documentation in the prompt, an agent will invent account constraints or reach for deprecated SPL helpers.
Install the complete Solana toolchain locally first, then pick an editor with agent and MCP support such as Zed, Cursor, Cline, Claude Code, or Roo. Connect Context7 MCP for pulling current library documentation into the prompt, and add Solana MCP for Solana-specific queries. For planning architecture and account state transitions, chain-of-thought reasoning models such as Gemini 2.5, Claude 4, OpenAI O1-O3, and DeepSeek v3/R1 hold constraints much better than fast completion models.
No amount of prompting replaces knowing the stack yourself. If you are still learning how Solana accounts and PDAs work under the hood, read the official documentation, use NotebookLM to work through unfamiliar concepts, and build a few small programs by hand before handing the keyboard to an agent. You cannot catch a missing signer check in review if you do not know what Anchor expands during compilation.
Write the architecture and spec before generating code
Initialize the Anchor workspace first:
anchor init your-project-name
Before asking the agent to touch programs/, create a docs/ directory to hold three files: a high-level architecture overview, a proof-of-concept PRD, and a task breakdown. Start a fresh model session with no code context to sketch the high-level architecture and review it globally before drafting the PRD. Once the architecture holds together, pull the latest Anchor documentation through Context7 or Solana MCP to generate the PRD and break it into small, sequential tasks inside docs/. Keep the scope locked to a proof of concept rather than enterprise complexity so every generated diff stays small enough to audit.
Next, configure your project rules with claude /init and a basic memory file so the agent follows your repository layout across sessions. Set explicit structural constraints in those rules: keep every source file under 500 lines, split program instructions into modular files, and enforce consistent naming conventions across Rust accounts and TypeScript tests.
Drive each task from a failing test
Work through the task list in docs/ one item at a time using test-driven development. Because an LLM predicts whatever tokens make the prompt look complete, a failing Anchor test written first gives the model a concrete target state instead of an open-ended prompt.
At the start of each task, have the agent load the relevant library docs fresh into context so it does not fall back on stale training weights. Write the Anchor tests first, covering both the expected state transition and the failure cases, and then let the agent implement the instruction handler until anchor test passes. Before marking the task complete, read the diff to verify that the agent used your workspace boilerplate, respected the 500-line ceiling, and did not make the test pass by weakening the assertions.
Verify security and state logic before shipping
Passing tests prove the code matches your test cases, not that the program is safe on mainnet. Before wrapping up a build session, review every generated instruction for Solana anti-patterns, missing error handling, broken state management logic, and potential race conditions across instructions.
Work through the Solana Security Roadmap, run a beta testing phase on devnet with real wallets, and get an independent security audit before deploying to mainnet.