AI smart contract audit

Public demo · test mode · no real charges

An AI audit you can check.

Connect a GitHub repo, choose the audit tools and see the price before anything runs. The PDF report names every tool, version and model, shows where the tools disagree and lists what was not checked.

Try the demoView a sample report

Read-only GitHub access. Price capped before you run. Unused reserve returns to your balance.

Report view: severity bars for Critical, High, Medium and Low, a list of eight findings, and the open finding F-1, High, found by 2 of 3 tools with a proof of concept verified by a fork run.
Fig. 1  A finding in the web report. Interim capture of the prototype, demo data.
  1. Found by 2 of 3 tools
  2. Evidence: poc-pass-fork
  3. Tools and versions pinned
Tools
5audit tools in the catalog
Presets
3presets: Quick, Standard, Deep
Price cap
Capa hard price limit on every run
Access
Read-onlyGitHub access to the repositories you select

Why this exists

A list of findings is not an audit.

01

Which tool said it?

Most AI scanners give you one verdict from one engine. You cannot tell what ran, which version, or on which model.

02

Do they agree?

Agreement between tools is not proof, especially when tools share a model. We show how many tools reported each issue and how many independent model families stand behind it.

03

What was skipped?

A clean report can mean a clean repository or a timeout. Ours lists the files and functions that were actually read, and the ones that were not.

NOTE

Zero findings is not "safe". The report says so on the first page.

How it works

From repository to report in eight steps.

Every screen below is a capture of the product prototype, running on demo data. Real-app captures replace them at launch.

  1. 01 / 08

    Fund your balance

    Top up by card or with USDC. The balance pays only for audits and cannot be withdrawn. Every entry shows up in your ledger.

    1. Card or USDC
    2. Spent only on audits
    Top-up dialog in test mode: pay by card, a $100.00 balance top-up through a Stripe test checkout, with the note that credits are spent only on audits.
    Fig. 1  Top-up dialog (demo data, test mode).
  2. 02 / 08

    Connect GitHub

    Install the GitHub App on the repositories you choose. Access is read-only, and we check it before anything is cloned. We pin the exact commit, so the report always refers to one version of your code.

    1. Read-only, selected repositories
    2. Pinned commit
    Repository step with access confirmed: read-only Contents permission, the selected repository, a one-hour token that is never stored, and a snapshot pinned to commit 8f3a2c1.
    Fig. 2  Repository step (demo data).
  3. 03 / 08

    Set the scope

    We detect your files, frameworks and dependencies, and the manager proposes what to include and why. You tick the files, and the estimate updates as you do.

    1. Files with in/out toggles
    2. The manager’s reason
    3. Live estimate
    Scope step: the manager proposes four core files totalling 1,266 nSLOC with a reason for each exclusion, a file list with checkboxes, and a live estimate of $75.96 expected and $113.94 cap.
    Fig. 3  Scope step (demo data).
  4. 04 / 08

    Choose the tools

    Pick a preset or build your own set. Each tool shows its version. In the report, tools that run on the same model family count as one voice, and we say so.

    1. Presets
    2. Tool versions
    3. Build your own set
    Tools step: three presets, Quick, Standard (recommended) and Deep, each listing its tools with versions and a rate per nSLOC, plus a link to build your own set.
    Fig. 4  Tools step (demo data).
  5. 05 / 08

    See the price, then decide

    You see an expected price and a hard cap before anything runs. Starting a run reserves the cap from your balance, and whatever is not used goes back.

    1. Expected price and cap
    2. What is reserved
    3. Two confirmations
    Review step: repository, scope, tools and price summary, a reserve of $113.94 with enough funds, two confirmation checkboxes and a Run audit button.
    Fig. 5  Review step (estimates, demo data).
  6. 06 / 08

    Watch it run

    Stages, cost and log update live. You do not need to keep the tab open: you get a notification when the report is ready. If a tool fails on our side, you are not charged for it.

    1. Stages
    2. Cost against the cap
    3. Live log
    Run in progress, late: later stages are active, including deduplication, agreement and an independent review by a different model.
    Fig. 6  Run view, night theme (demo data).
  7. 07 / 08

    Read the findings

    Each finding shows severity, evidence level, the tools that reported it and where they disagree. We say "confirmed" only for findings with a passing proof of concept or a static check.

    1. Agreement: found by 2 of 3 tools
    2. Evidence level
    3. Tools and versions pinned
    Report view: severity bars for Critical, High, Medium and Low, a list of eight findings, and the open finding F-1, High, found by 2 of 3 tools with a proof of concept verified by a fork run.
    Fig. 7  Report view (demo data).
  8. 08 / 08

    Download the report

    A PDF with the commit, the tools and their versions, the model snapshot, coverage and the false positives we discarded. The web version stays linked. The PDF is the record.

    1. Severity bars for four levels
    2. Agreement per finding
    Read the web version
    Page 2 of the sample PDF: severity bars for Critical, High, Medium and Low, and a table of eight findings with evidence level, agreement and status, under a SAMPLE watermark.
    Fig. 8  Page 2 of the sample PDF (illustrative sample).

    auto-audit-sample-report.pdf

Top-up dialog in test mode: pay by card, a $100.00 balance top-up through a Stripe test checkout, with the note that credits are spent only on audits.
Fig. 1  Top-up dialog (demo data, test mode).

Tools and presets

Pick the depth. See the tools.

Presets are tool sets, not marketing tiers. Each tool is listed with its version, commit and license.

Quick

1 tool. No proof-of-concept runs. A fast pre-check before you spend more.

from$0.03per nSLOCestimate

StandardDefault

2 tools, de-duplication and a review pass. A sensible default for most repositories.

from$0.06per nSLOCestimate

Deep

3 tools with different methods, a reviewer on a different model, and fork-run proofs of concept where the tool supports them.

from$0.12per nSLOCestimate

Advanced: choose the tools yourself. Two by default, three at most.

ONE VOICE

Tools built on the same model family share blind spots. We count them as one voice and say so in the report.

  • solidity-auditor v2
  • solidity-auditor v3
  • krait v8.2
  • pentimento in development
  • plamen 2.2.4

See all tools and licenses

Third-party tools are listed by name for transparency. Names belong to their owners and do not imply endorsement or affiliation.

Price

Price first. Cap always.

01

See it before you run

You get an expected price and a hard cap before anything starts. The estimate updates as you change the scope.

02

The cap is a hard stop

Starting a run reserves the cap from your balance. The run stops at the cap and hands you a partial result, with the option to add budget.

03

Unused reserve comes back

You pay the actual cost, never more than the cap. Whatever is left returns to your balance. If a tool fails on our side, you are not charged for it.

Preset
Expected$180.00
Cap$270.00
Reserved at start$270.00

3,000 × $0.06 = $180.00; cap = 1.5 × $180.00 = $270.00

You pay the actual cost, never more than the cap. Whatever is not used returns to your balance.

Start an audit with this estimate

EstimatePricing version placeholder-v1, updated 2026-10-25. Prices are placeholders until real run costs are measured.

Try the demoFull pricing and billing details

Security

Assume the repository is hostile.

Code from a repository is untrusted input. Each audit is designed to run in an isolated container with no network, no secrets and one output folder.

Audit pipeline: fetch, build, analyze with no network, reportFour stages in sequence. Only the analyze stage is isolated from the network; it talks to a gateway that accepts one kind of request.FETCHread-only cloneBUILDcompile, no secretsANALYZEno networkREPORTschema-checkedGATEWAYone request type, with a budgetEach audit runs in a fresh container that is deleted afterwards.
  • DesignedRead-only GitHub access to the repositories you select, checked before anything is cloned.
  • DesignedA fresh sandbox for every run, deleted afterwards. Nothing is shared between customers.
  • DesignedNo internet inside the sandbox. The only way out is a gateway that accepts one kind of request.
  • DesignedNo real API keys inside. Keys live in gateways outside the sandbox.
  • DesignedFindings are parsed against a schema and rendered without external resources.
  • DesignedEvery run has a budget and a time limit.

These are design controls, not an audit result and not a certification. Each moves to "Implemented" only when the matching test passes.

We also publish the risks we cannot fully remove. Read the security design

What we do not claim

Read this before you buy.

  1. 01

    Not a guarantee.

    A report describes one commit at one point in time. It can miss things and can be wrong.

  2. 02

    Zero findings is not "safe".

    It can also mean a tool timed out. The coverage section lists what was actually read.

  3. 03

    Agreement is not proof.

    Two tools that agree may share a model. We call a finding confirmed only when a proof of concept passes or a static check backs it.

  4. 04

    Not a replacement for a human audit.

    Use it before one, and for every change in between.

  5. 05

    No benchmark numbers yet.

    We will publish quality results only when we have measured them, with the method and the date.

  6. 06

    Names belong to their owners.

    Third-party tools are listed for transparency and do not imply endorsement.

Evidence, not logos

What you can check today.

There are no customer logos, testimonials or ratings here, because there are no customers yet. These are the things you can verify yourself.

Pinned toolsUpstream commit and license for every tool.A real PDFDownload the sample and read every page.The methodWhat Agreement and evidence levels mean.Security designWhat is designed, and the risks that stay.
As of 2026-10-25, from public pages of 9 comparable AI audit products (our own teardown). "Not found" means not found on public pages, not "absent from the product"; private screens were not visible. Products are not named because such facts go stale.
QuestionTypical AI audit serviceAuto Audit (design)
Self-serve, no sales callSeveral offer it; others are demo-request only.Yes. Today in demo mode, access by invitation.
Public priceSome publish per-line prices; others show none.Yes: versioned placeholder estimates, labelled as such.
Price cap per runFound on 1 of the 9 products read.A hard cap is shown before a run; unused reserve returns.
Tool and model versions in the reportNot found on any of the 9.Every tool with commit, license and model family. The model snapshot pin is written per run.
Choice of toolsNot found: each sells its own engine.Presets, or your own set (three at most).
Coverage: what was not checkedDescribed in the docs of 1 product, not in its reports.A section of every report.
Discarded false positives visibleA few keep a history; most filter on the vendor side.Listed with the reason and the tool that raised them.
Public sample reportNot found on any of the 9.Yes. Illustrative and watermarked, because real runs are not live yet.
Independent quality measurementNot found. Published numbers are self-reported.None yet. We publish no benchmark numbers until we measure them.

The report

This is what you keep.

A PDF you can hand to a developer, an investor or an auditor. It carries the commit, the tools, the model, the coverage and the findings we threw out.

2 / 8

Page 2 of 8

Summary

Findings by severity and status, with Agreement N of M.

  1. Agreement
  2. Evidence level
Download sample PDFRead the web version

8 pages. Illustrative sample generated with invented data; real runs will differ. Every page is watermarked SAMPLE.

FAQ

Questions, answered plainly.

What exactly do I get?

A web report and a PDF: findings with severity, evidence level and the tools that reported each one, plus the tools and versions used, coverage, what was not checked, and the false positives we discarded. You also get the raw findings as JSON.

Does this replace a human audit?

No. Use it before one, and between releases. AI tools miss issues and raise false alarms, and a report is not a guarantee. We say this on the first page of every report.

Which tools run, and can I choose?

You pick a preset (Quick, Standard, Deep) or choose the tools yourself. Every tool is listed with its version, commit and license on the tools page, and the report names the ones that ran.

How is the price calculated?

By the size of the code you select, measured in non-comment source lines (nSLOC), times the preset rate. You see an expected price and a cap before the run. You pay the actual cost, never more than the cap. Current prices are estimates.

What if a tool fails?

If a tool fails because of us, you are not charged for it. If it times out or reads only part of your code, the coverage section of the report says which files were not read.

Who can see my code, and where does it go?

Your code is cloned into an isolated sandbox with no network access. To produce findings, the text the tools read is sent through our gateway to the AI model provider. Retention and provider terms are not final yet: the policy text is pending. The security page describes the design and the risks we cannot remove.

Which languages are supported?

Solidity repositories today (Foundry or Hardhat projects). Other languages are not supported yet.

What is Agreement, and why not "confirmed"?

Agreement shows how many tools reported a finding and how many independent model families stand behind it. Several tools built on one model are one voice. We use "confirmed" only for findings backed by a passing proof of concept or a static check.

How do I pay, and what about refunds?

You top up a balance by card or with USDC and each audit spends from it. The balance is for audits only and cannot be withdrawn. When a run costs less than its reserve, the difference returns to your balance. Refund terms are pending in the legal text.

Is this live?

Right now this is a public demo in test mode: payments are test payments, access is by invitation and no real customer code is processed.

Run it on your repository.

See the price first. Nothing runs until you confirm.

Try the demoView a sample report

Public demo · test mode · no real charges