GLAM's docs (Mintlify, with a well-maintained llms.txt/llms-full.txt) are broad and unusually agent-aware, but they contradict themselves on exactly the numbers and claims that matter most for an asset-management protocol: audit status, protocol fees, and the permission model — and the flagship quickstart can't be copy-pasted as written.
1. Disclaimer calls GLAM "unaudited" while the Security page lists four completed audits (critical)
Problem: The v1 Disclaimer opens: "We welcome you to GLAM's unaudited, experimental beta version, comprising GLAM Protocol, GLAM API, GLAM SDK, GLAM GUI...". The v1 Security page in the same docs version lists four completed Adevar Labs audits dated November 7, 2025 through April 8, 2026 ("GLAM Protocol Audit", "Protocol Integration Patches", "SingleAssetVault", "Security Enhancements"). The llms.txt guidance layer further asserts "Current audited or documented integrations include Jupiter Swap, Kamino, CCTP...". Both claims cannot be true.
Consequence: This is infrastructure for "institutional asset management." An institution doing diligence — or an AI agent asked "is GLAM audited?" — gets opposite answers depending on which page it reads. Agents fail silently on contradictions like this: one summarizes GLAM as audited, another as explicitly unaudited, and both cite official docs. The disclaimer also references a "GLAM API" component that the v1 Welcome page says is "coming soon."
The fix: Update the Disclaimer to reflect current audit status (e.g., "audited components X, Y; staging programs and pending-audit integrations remain unaudited") and link to the Security page as the single source of truth. Remove or qualify the "GLAM API" mention until the API ships.
2. Protocol base fee: Fees page says 20 bps, SDK pages say the program enforces 1 bps (critical)
Problem: The Fees page states: "The base fee is fixed at 0.2 percent (20 basis point) annually for all tokenized vaults" with "base_rate = base fee rate (default 0.002)". But the SDK create-vault example annotates baseFeeBps: 0, // will be overwritten in program with 1 and flowFeeBps: 0, // will be overwritten in program with 2000, and the SDK fees page's example passes . That's a 20x discrepancy (20 bps vs 1 bps) in the protocol fee every tokenized vault pays.
Code verification
Runtime snippet checks
Run the public examples from this audit in an isolated sandbox and attach the pass, fixed, skipped, and failed counts to the report.
Consequence: Vault managers model economics and disclose fees to investors based on these docs. Depending on which page they read, they'll represent the protocol's cut as 0.2% or 0.01% of AUM annually — a material misstatement in either direction. The flow fee (2000 bps = 20% of manager fees per the code comments) is never quantified anywhere in prose at all.
The fix: State the actual current protocol base fee and flow fee once, in numbers, on the Fees page; make the SDK code comments and setProtocolFees examples match; document that the program overwrites caller-supplied protocol fee values.
3. CLI docs link vault templates to a GitHub repo that 404s (significant)
Problem: The "Create a Vault" and "Vault Templates" sections both link to https://github.com/glamsystems/glam/tree/main/cli/templates — github.com/glamsystems/glam returns HTTP 404 (verified; the org's public repos include no glam repo). The quickstart page links templates to a different, working repo: github.com/glamsystems/glam-cli/tree/main/templates. Separately, llms.txt's "External Resources" links "GLAM documentation source" to https://github.com/glamsystems/docs, which also 404s.
Consequence: Templates are the only documented way to configure a vault via glam-cli vault create <template.json>; the reference page for template structure sends developers to a dead repo. Agents following llms.txt — the file explicitly written for them — hit a dead "documentation source" link.
The fix: Point both cli/general links at glamsystems/glam-cli/tree/main/templates, and fix or remove the glamsystems/docs entry in llms.txt.
4. CLI quickstart creates manager-config.json but every subsequent command uses ./delegate-config.json (significant)
Problem: The Setup section defines three config files: owner-config.json, manager-config.json (holding the delegate keypair), and user-config.json. Every later delegate step — vault set, vault token-balances, kamino-vaults deposit/withdraw, manage fulfill — invokes glam-cli -C ./delegate-config.json ..., a file the walkthrough never creates.
Consequence: Anyone following the flagship quickstart verbatim gets a file-not-found error at the exact step where the delegate takes over. An AI agent replaying the walkthrough (the AI quickstart says its prompts "mirror the CLI quickstart flow") fails the same way. This is a five-persona, mainnet, real-money tutorial — it should be executable as written.
The fix: Rename the setup block to delegate-config.json (or update the commands to -C ./manager-config.json) so the walkthrough is self-consistent.
5. SDK create-vault declares two examples "equivalent" that configure different vaults (significant)
Problem: The tokenized-vault TypeScript example is followed by "The code above is equivalent to creating the vault with glam-cli using the following template" — but the values disagree across the board: vault redemptionFeeBps 20 (TS) vs 10 (JSON); manager fees 10/20 vs 0/0; management feeBps 10 vs 0; performance hurdleRateBps 500 vs 5 (a 100x gap). The TS example also calls new BN(...) five times while importing only GlamClient, WSOL, nameToChars, StateAccountType — it doesn't compile as written.
Consequence: A developer (or agent) copying either "equivalent" artifact deploys a vault with materially different fee economics than the other — and the TS path fails at compile time first. Since fee structures are what investors are subscribed under, a wrong hurdle rate (5% vs 0.05%) is not cosmetic.
The fix: Make the two examples actually equivalent value-for-value, and add BN to the import (import { BN } from "@coral-xyz/anchor"), as the other SDK pages correctly do.
6. GlamMint delegate permissions are used in the quickstart but documented nowhere (significant)
Problem: The quickstart's central delegation step runs glam-cli delegate grant --protocol GlamMint ... Fulfill, and the Flows page grants cancellation rights to "an active delegate with the Mint CancelRequest permission." But the Delegated Accounts page — the reference the quickstart itself points to "for more details on protocols and permissions" — tables only System, Jupiter Swap, SPL, Kamino, CCTP, and pending-audit staking protocols. No GlamMint protocol, no Fulfill, no CancelRequest, and no list of whatever other mint permissions exist.
Consequence: Tokenized-vault operators can't discover the permission set for the most sensitive protocol in the system — the one that mints and burns investor shares — without running glam-cli delegate grant -h and reverse-engineering. Agents building delegation flows from the reference table will conclude mint permissions don't exist.
The fix: Add a GlamMint section to the permissions tables (Fulfill, CancelRequest, and any others) with bitflags and IDL links, matching the format used for the other protocols.
7. CLI Commands Overview omits five documented command groups (significant)
Problem: The "Commands Overview" table lists 11 commands (env, vault, invest, manage, delegate, integration, jupiter, kamino-lend, kamino-vaults, kamino-farms, cctp) but omits transfer, timelock, stake, lst, and marinade — all of which have their own dedicated documentation pages (/v1/cli/transfer, /v1/cli/timelock, /v1/cli/staking). Similarly, /v1/cli/integrations says "Available protocols include" and lists only six, omitting the staking protocols whose CLI pages require enabling them.
Consequence: llms.txt tells agents to "Use the CLI for operator workflows." An agent (or human) starting from the CLI introduction — the canonical command index — will conclude token transfers, timelocks, and all staking operations aren't CLI-supported, when full pages document them.
The fix: Complete the Commands Overview table with all documented command groups, and either enumerate all enable-able protocols on /v1/cli/integrations or mark the list as partial with a pointer to the full integration list.
8. SPL integration table assigns the same bitflag to two different protocols (minor)
Problem: In the audited-integrations table, "Token Program" and "Token 2022 Program" under the SPL integration are both listed with bitflag 0b00000001, while every other multi-protocol program (Native, Kamino, Stake Pools) uses distinct bits per protocol.
Consequence: Developers computing protocol bitmasks (the SDK's enableProtocols takes parseInt(protocolBitflag, 2)) can't tell whether the duplication is a typo or whether both token programs genuinely share one flag — and enabling/auditing the wrong bit is an access-control operation.
The fix: Correct the bitflag if it's a typo, or add a footnote stating both token programs are intentionally governed by a single protocol flag.
9. CLI says manual pricing is "for debugging purpose only"; SDK requires an explicit pricing transaction before fulfillment (minor)
Problem: cli/manage: "This is for debugging purpose only and you don't need to call it manually before performing fulfillment... (relevant instructions are automatically included in those transactions)." sdk/pricing's "typical pricing workflow" sends a separate pricing + validateAum transaction, then fulfills; sdk/invest warns "Before fulfilling requests, the vault must be priced."
Consequence: The two surfaces describe opposite operational requirements for the same fulfillment flow. An SDK developer who internalizes the CLI's "automatic" framing skips pricing and hits runtime failures; neither page explains that the surfaces differ (or why).
The fix: State explicitly on both pages whether pricing instructions are bundled automatically (CLI) or must be sent by the caller (SDK), and cross-link the difference.
10. Staking pages require a --bypass-warning flag that no command syntax shows (minor)
Problem: The page-top warning says: "Staking integrations... are only supported in staging programs. Code is pending audit. Use the --bypass-warning flag to acknowledge and proceed." None of the nine command blocks on the page (stake list/deactivate/withdraw, lst stake/unstake, marinade stake/stake-native/withdraw-stake) include the flag in their syntax or examples, and the CLI configuration docs don't mention the related glam_staging interplay on this page.
Consequence: Users copy the documented commands, hit the warning gate, and have to guess where the flag goes; the page also never explains that these commands additionally require the glam_staging: true config documented elsewhere.
The fix: Show [--bypass-warning] in the command syntax blocks and add a note linking the staging-programs config requirement.
11. AI quickstart's "minimum" config omits the field the CLI docs call required (minor)
Problem: cli/introduction: "At minimum, you need to provide cluster, json_rpc_url, and keypair_path in the configuration file." The AI quickstart's example config.json omits cluster entirely (only keypair_path, json_rpc_url, priority_fee, jupiter_api_key). The docs also alternate repo names for the same SDK — sdk/overview links glamsystems/glam-sdk-ts, sdk/introduction and the permission tables link glamsystems/glam-sdk (a redirect).
Consequence: Either cluster isn't actually required (making the CLI intro wrong) or the AI quickstart config fails validation — precisely the kind of ambiguity that derails the autonomous agents this page targets. The dual repo naming makes agents treat one SDK as two.
The fix: Make the two config docs agree on required fields, and standardize on one GitHub repo URL for the SDK everywhere.
What they do well
First-class agent support: llms.txt with explicit LLM guidance and a complete llms-full.txt, plus an installable glam-skill for coding agents.
The CLI quickstart links every step to a real mainnet transaction on Solscan — verifiable, concrete, and rare.
Honest risk documentation where it counts: pending-audit tables with bitflags, permanent-delegate custody warnings, and the timelock/redemption-period caveat.
Top 3 recommendations
Reconcile the Disclaimer with the Security page and the Fees page with the SDK fee values — audit status and protocol fees are the two claims an asset-management protocol cannot afford to contradict itself on.
Make the flagship examples executable as written: fix the quickstart's delegate-config.json/manager-config.json mismatch, the create-vault "equivalent" examples, and the missing BN import.
Fix the dead glamsystems/glam and glamsystems/docs links and complete the CLI command/permission reference tables (GlamMint, transfer/timelock/staking commands).