Find the riskbefore it ships.
Automated static analysis, dependency vulnerability checks, dangerous permission detection and security findings for supported repositories and contracts.
What Kernel Scan looks for.
Fast, automated, cheap enough to run on every commit — and clear about being a scan, not a proof.
Static analysis
Automated checks for known vulnerability patterns in supported code.
Dependencies
Known-vulnerable packages and versions across the dependency tree.
Dangerous permissions
Privileged functions, missing access checks and risky withdrawal or upgrade paths.
Findings
Every issue comes with a severity, a location and the evidence behind it.
Three ways in.
Point Kernel at a public GitHub repository or a deployed EVM contract. Each check is one paid tool call.
scan_repositoryPublic GitHub repository URLscan_contractDeployed EVM contract addressanalyze_dependenciesPublic GitHub repository URLFindings an agent can act on.
Paid tools return structured JSON, not a paragraph. Agents can block an unsafe deployment, propose a fix, or request a deeper check.
{
"tool": "scan_contract",
"status": "review_required",
"summary": { "high": 1, "medium": 0, "low": 2 },
"findings": [{
"severity": "high",
"title": "Privileged withdrawal lacks access check",
"location": "Vault.sol:142",
"recommendation": "Restrict withdraw() to the owner role"
}]
}Every report is stored, gets a report page, and can be retrieved later for free with get_verification.
Response schema is in draft and may change before launch.