Tool 02 · Analysis · Free

AI Deep Scan

Every deterministic analyser on this site, run in one pass and merged into a single prioritised report — then handed to an AI reasoning layer for the class of finding that pattern matching structurally cannot reach.

At a glance

Local passAlways runs
Analysers4 combined
AI layerOptional, server-proxied
UploadsOnly if the AI layer is enabled
CostFree

AI Deep Scan

Run it

AI layer
A first pass, not an audit. Automated analysis — including the AI layer — is good at recognising known shapes and bad at understanding what your protocol is for. Findings here are a starting point for a human review, and anything it reports should be verified before you act on it.

The local analysers never transmit anything. If the AI layer is configured by the site owner, the source is sent to their server-side proxy for that step only.

How it works

What this tool does, and what it can't.

The local pass runs four analysers over the same source: the twenty-rule pattern pre-check, the access control matrix (which flags privileged functions with no guard), the gas analyser (whose unbounded-loop rule is also a denial-of-service finding), and the storage layout checker. Their results are merged, deduplicated and sorted by severity.

The AI layer is given the source and the local findings, with an explicit instruction not to repeat them. Its job is the reasoning half: state interleaving, economic incentives, cross-function assumptions, accounting drift, specification mismatch. It is required to give a concrete exploit path for anything it rates Critical or High, and to downgrade what it cannot demonstrate.

Every finding is tagged with its origin — PATTERN, ACL, GAS, STORAGE or AI — and a confidence level, because a regex match and a model's inference deserve different amounts of your trust.

FAQ

Questions about this tool.

More in the methodology and the glossary.

Yes. The four deterministic analysers always run and produce a full report. If no AI endpoint is configured, the tool says so plainly rather than quietly skipping the step.

The local analysers never transmit anything. If the site owner has configured the AI layer, the source is posted to their own server-side proxy for that one request. The badge at the top of the tool tells you which mode is active before you paste anything.

It is genuinely useful for the reasoning-shaped findings that regex cannot reach, and genuinely unreliable about specifics — it will occasionally assert a line number or a behaviour that is not in the code. That is why the prompt requires an exploit path for high-severity claims and why every AI finding is labelled as such. Verify before you act.

No. It has no threat model, cannot ask your team what the protocol is supposed to guarantee, and cannot write a proof of concept against a fork. It is a first pass that makes a human review faster and better-targeted.

Set AI_ENDPOINT in js/deep-scan.js and deploy the included serverless function with your API key in the environment. The README has the full steps for Netlify and Vercel.

Beyond automation

No tool reads your specification. We do.

The findings that drain protocols come from state assumptions, economic design and cross-contract interaction — none of which a scanner sees. Free scoping in under two working days.