Free, fast heuristic security scanner for Solidity — point it at a repo, get a professional report in seconds. Runs clean on OpenZeppelin (0 findings, 247 files) so you get signal, not noise. Add it to CI in two lines.

Part of OpenClaw, an autonomous multi-agent system that runs a Web3 security workflow 24/7. This is the open-source scanning core.

🛡️ Shipping to mainnet? Want a human on it? The scanner flags candidates — a hand-verified review adds real findings (zero false-positive spam) + a plain-English report in 48h. Start with a Quick Scan from $49 (pay in USDC or card). → Pricing & services →

python scan.py https://github.com/org/protocol --name "Protocol" --out ./report
# → ./report/report.md  +  ./report/report.html

No dependencies beyond Python 3.9+ and git. It clones (shallow), runs the detectors, writes the report, and cleans up after itself.

One command, no clone (via pipx):

pipx run --spec git+https://github.com/juan23z/openclaw-audit openclaw-audit <repo-or-path> --out ./report

Or install it: pipx install git+https://github.com/juan23z/openclaw-audit → then just openclaw-audit <repo>.

Get a security scan on every push and PR — a summary lands as a comment on your PR, the full report in the job summary + an artifact. Two lines:

# .github/workflows/security.yml
name: security
on: [push, pull_request]
permissions:
  contents: read
  pull-requests: write        # lets the scan post its summary as a PR comment
jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: juan23z/openclaw-audit@v1
        with:
          path: contracts        # optional, default '.'
          # fail-on-candidates: true   # optional, default false (heuristics are advisory)
          # comment-on-pr: false       # optional, default true

That's it — no API keys, no cost. Want verified findings + continuous monitoring (re-audited on every change)? Get a human audit → order on Fiverr · sample report & service

Scanning your contracts with OpenClaw Audit? Add the badge to your README:

[![Secured with OpenClaw Audit](https://img.shields.io/badge/secured%20with-OpenClaw%20Audit-6f42c1?logo=ethereum&logoColor=white)](https://github.com/juan23z/openclaw-audit)

Detectors skip dependencies and tests (node_modules, lib, out, test, mock, …) so you only get findings in your code.

Runs clean on clean code: 0 findings across the entire OpenZeppelin contracts library (the most-audited codebase in web3). Detectors skip comments, tests and dependencies — so you get signal, not a wall of false positives.

Don't take our word for it — see the full Calibration Report: OpenClaw run across 10 of the most-audited codebases in the ecosystem (OpenZeppelin, Solady, Uniswap v2/v3/v4, Morpho Blue, Permit2, PRBMath…), with every flag verified by hand. 14 candidates across 608 source files; 4 codebases perfectly clean. Every number is reproducible in one command.

These are heuristic candidates, not confirmed vulnerabilities. Static heuristics produce false positives — verify each finding by hand before acting. The report labels every item as "candidate · verify".

Want a human review with verified findings and a plain-English report? Start with a Quick Scan ($49, pay in USDC or card) or a full core review → pricing & services

contracts/AuditAttestation.sol lets an auditor publish a keccak256 hash of a delivered report + a verdict on-chain, so anyone can verify a report's authenticity and date (tamper-evidence + provenance). Two-step ownership, access-controlled attesters, no external calls. Compiles with Solc 0.8.24 and ships with a Foundry test suite (8 passing tests):

cd contracts && forge install foundry-rs/forge-std && forge test

Deploy on any EVM testnet.

MIT — see LICENSE. Built by Nawel.