audit_contract
Audit Solidity source or bytecode for vulnerabilities. Get a risk score and detailed findings with optional deep analysis.
Instructions
Static security audit of a Solidity smart contract OR a deployed contract's bytecode. Paste the contract source (or raw 0x… runtime/creation bytecode for an unverified contract) and get a SAFE/REVIEW/HIGH-RISK/CRITICAL verdict with a 0–100 risk score. The FREE tier (no key) runs 4 high-signal detectors (reentrancy, access-control, low-level calls, weak randomness) and returns the verdict + finding counts + top issue titles. Set deep=true for the PREMIUM audit: a real taint/dataflow engine + the full 12-detector suite (incl. flash-loan/oracle manipulation, ERC-4626 inflation, governance/timelock, permit/signature replay) and deployed-bytecode screening — every finding with its exact line, the source→sink flow, code evidence, SWC/CWE ids, confidence and a fix. The part an agent can't reproduce in one shot. Call this BEFORE deploying, approving, or sending funds to a contract.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | The full Solidity source code of the contract to audit. | |
| deep | No | When true, runs the PREMIUM full audit. Requires an API key (set SENTINEL_KEY in your MCP env); without one you get the free verdict plus instructions to unlock the deep report. |