AI-powered security intelligence for software and blockchain projects. Discover vulnerabilities, understand risk, and generate evidence-based reports, before software reaches production.
Terminal
$ hawki audit ./contracts
✓ static analysis: no critical
⚠ AI logic flaw in withdraw()Simulation
[sandbox] drain success: 120 ETH
→ PoC + evidence generatedEvery finding ships with reproducible evidence, not just a severity label.
Point Hawk-i at a repo or a live contract. It resolves source, runs the rules, reasons over the findings, and prints a deterministic score, streaming as it goes.
Hawk-i Deep runs an autonomous loop: it drains the known attack scripts, then an LLM planner invents novel attacks the ruleset never encoded, and the sandbox proves each one with a runnable proof-of-concept.
~/.hawki/deep_memory.db
// test/Exploit.t.sol (synthesised by the agent)function test_drain() public { vm.prank(attacker); Attack a = new Attack(address(vault)); a.pwn{value: 1 ether}(); assertGt(attacker.balance, 1 ether); // funds drained}Not in any rule. The agent invented the attack path, wrote the exploit, and the sandbox confirmed a drain. Evidence, not a guess.
Beyond the scan pipeline, four standalone commands each answer one precise question about a contract.
Confirm the deployed bytecode actually matches your source.
hawki verify --address 0x... --source ./srcFlag known-vulnerable library and package versions.
hawki deps ./my-projectCatch proxy storage-collisions before an upgrade goes wrong.
hawki upgrade --old Old.sol --new New.solRun formal verification through SMTChecker.
hawki prove ./contracts --engine smtcheckerPass an address and a chain. Hawk-i pulls verified source straight from the block explorer, falling back to web3 and raw bytecode when source is not published.
$ hawki scan --address 0xA0b8...48
--chain ethereumSame scan pipeline, whether the target is a folder of Solidity or a contract already live on Ethereum.
Every scan yields a deterministic 0 to 100 score, a severity breakdown, and an audit or Immunefi-style report. The same findings always produce the same result.
Start at 100, subtract severity-weighted deductions (Critical 15, High 8, Medium 4, Low 1), clamp, map to a band.
Hawk-i is built to be understood. It shows its work, it stays on your machine, and it never asks you to trust a number you cannot check.
The Deep agent invents novel attacks and proves them: on real incident code it invented and landed a live reentrancy drain in the sandbox.
A 0 to 100 score with fixed risk bands. The same findings always produce the same number.
Every finding ships with a location, an explanation, a fix, and, where it counts, a runnable exploit.
100% open source under MIT. No account, no phone-home, no usage data leaving your machine. Ever.
Everything runs on your box. Bring your own LLM key, or stay fully offline with a local model.
Catch the exploit before you deploy.
Scan contracts while you write them, in the toolchain you already run. Foundry and Hardhat proofs land next to the finding, so a fix is obvious.
Open source, and yours forever.
Hawk-i v1.0.0 is a finished tool released under the MIT license. No account, no cloud requirement, and no usage data ever leaves your machine. Everything it remembers lives in plain files under ~/.hawki/.
Explore the repositoryYes, entirely. Hawk-i v1.0.0 is 100% open source under the MIT license. There is no paid tier and no upsell. The Deep agent and every module are included.
Never. There is no telemetry of any kind. Your source is analysed on your machine and nothing is transmitted. The hawki metrics command reports only local statistics, and all state lives in plain files under ~/.hawki/.
Seven EVM mainnets (Ethereum, Polygon, Arbitrum, Optimism, Base, BNB Chain, and Avalanche), plus the Sepolia testnet and a local node. Point --rpc-url at any other EVM endpoint you like.
For its novel-attack planner it calls an LLM through litellm, so you supply a key for the provider you choose, or run a local model through Ollama to stay fully offline. The rule-based stages need no key at all.
Yes. It has been run against Trail of Bits' not-so-smart-contracts, Damn Vulnerable DeFi, PancakeSwap's audited BNB Chain farming contracts (zero false criticals on production code), and DeFiVulnLabs' real incident reproductions, where the Deep agent invented and landed a live reentrancy drain in the sandbox.
Yes. v1.0.0 is the first stable release: a finished, local-first toolkit with the Deep agent, deployed-contract scanning, the verify, deps, upgrade, and prove modules, audit-grade reporting, and structured export.
Install Hawk-i, run doctor, and scan your first contract in under a minute. Free, MIT licensed, and entirely on your machine.