Continuous AI security analysis on every pull request — distilled into one score that protocols publish, users check, and the ecosystem learns to trust.
A curated knowledge base distilled from 800+ documented real-world exploits — not a generic linter ruleset.
Maximum signal
Every file in scope goes through a coordinated pipeline of specialized AI agents — deep vulnerability hunting cross-referenced against 800+ documented exploits, and a dedicated engineering review covering security patterns, gas, and code quality — steered by your project's own assumptions and trust model. Each finding ships with everything an engineer needs to judge it, reproduce it, and fix it.
Every finding carries a severity, and every scan rolls up to a merge-relevant verdict: PASS, PASS WITH WARNINGS, or FAIL.
The exact lines at fault, quoted from your repository — no hunting through a report to figure out what the finding refers to.
A rewritten version of the vulnerable section, so the path from finding to fix is a review and a commit, not a research project.
What an attacker actually gains — drained funds, frozen withdrawals, broken accounting — stated plainly so you can prioritize.
The step-by-step route from entry point to exploit, so you can verify the finding is real before you spend time on it.
Concrete remediation guidance on every finding, with a proof-of-concept where one applies, demonstrating the exploit end to end.
How it works
No sales call, no onboarding project. Kagex is GitHub-native end to end.
Sign in with GitHub and install the Kagex app on the repositories you want covered. Your code is fetched for analysis when a scan runs — nothing else.
Define the audit scope per repository with glob patterns, and give the agents your team's context — trust assumptions, known invariants, out-of-scope areas — as text or a PDF/DOCX upload.
Run a scan from the dashboard whenever you want, or add a label to a pull request and Kagex scans it automatically. A pipeline of specialized AI agents dissects every file in scope — each analyzed with its imported and inherited contracts in view, so cross-contract bugs aren't missed. An independent verification agent then re-checks every finding to filter out false positives before anything reaches your score. Results land as PR comments with a PASS / PASS WITH WARNINGS / FAIL verdict.
Work through findings in the dashboard: acknowledge, mark will-fix, dismiss as false positive, or resolve. Dismissed issues never reappear on unchanged code. Export the whole picture as a markdown security report.
Security score
Every scan produces a 0–100 security score across seven categories — access control, reentrancy, upgradeability, oracle safety, ERC compliance, math, and business logic. Engineers see exactly which category slipped; management sees one KPI that moves.
Every pull request is judged against the previous scan: newly introduced issues are flagged as regressions, verified fixes are credited, and the score delta lands right in the PR comment — 89 → 91 is a review conversation everyone can have.
And it's built to be shown, not hidden: publish a live score badge on your README or website, linking to a public transparency profile served by Kagex — always current, impossible to fake.
Security score
Previous 89
+2Illustrative report — your numbers come from your code.
Progress & recognition
Teams earn Security Points for verifiable improvements — never for spend, never for scan volume. Points climb a league ladder and unlock badges your team can actually be proud of.
Fixes count only when a rescan confirms the issue is gone.
“We reached Diamond security on Kagex” is a tweet, a badge, and a hiring signal.
On the roadmap: seasonal leaderboards, public protocol rankings, and KAGE-token utilities on the service side — staked compute tiers, certification-maintenance bonds, and bounty pools.
One rule is permanent: points, leagues, and any future token never touch the score. The score reflects your code — nothing else.
Honest positioning
A manual audit is a snapshot: weeks of scheduling, a $25k–$250k engagement, and a report that describes one commit. Every commit after it is uncovered until the next engagement.
Kagex is the layer in between. It reviews code continuously as it changes, clears out the findings a scanner should catch, and hands your auditors a cleaner codebase — so their time, and your budget, go toward the issues only humans find.
Label a pull request and get a verdict before it merges. Findings arrive as PR comments where your team already reviews code — no separate tool to check, no report to circulate.
Manual audits bill for every finding, including the ones a scanner catches in minutes. Clear those out first, and your audit budget goes toward the deep issues only humans find.
An audit certifies one snapshot of the code. Every commit after it is uncovered. Kagex diffs every scan against the last one — newly introduced issues are flagged the moment they appear, and your security score shows the drift.
Crypto or invoice. No card required to start a pilot.
200 scans per seat per year, pooled across your team.
Access is granted manually — contact us to get started. In the meantime you can already register with your GitHub.
500 scans per seat per year for teams shipping weekly.
Access is granted manually — contact us to get started. In the meantime you can already register with your GitHub.
1,000 scans per seat per year. Scan every PR without thinking.
Access is granted manually — contact us to get started. In the meantime you can already register with your GitHub.
Each scan starts every category at 100 and deducts per open finding, weighted by severity — a critical costs far more than a low. Resolved and dismissed issues don't count; accepted risks count at half weight. The overall score averages seven categories, and every scan is compared to the previous one so you see the delta, not just the number. The score can't be influenced by anything except the state of your code.
Solidity, today. Kagex is built for smart-contract teams, and the knowledge base — 3,500+ vulnerability patterns across 36 categories — is distilled from documented real-world exploits in that ecosystem.
No, and we won't pretend it does. Kagex is the continuous layer between audits: it reviews code as it changes, catches what a scanner should catch, and lets your auditors spend their time on what only they can find. Ship to your audit with fewer known issues, and keep coverage after the auditors leave.
Two layers. Before you ever see a finding, an independent verification agent runs an auditor's false-positive protocol against the full contract — including its base and imported contracts: it checks reachability and inherited guards, traces attacker-controlled data flow from source to sink, applies bug-class-specific checks, and argues the devil's-advocate case that the finding is false. A finding is discarded only when it's disproven with high confidence — a real bug is never dropped on a hunch — so false positives are filtered out up front and never touch your score. Then every issue you do see has a lifecycle (acknowledge, will-fix, false positive, resolved); when you dismiss one, Kagex fingerprints it so the same issue on unchanged code never reappears. Triage is done once, not once per scan.
You can scope each repository with glob patterns so the agents only review what matters, and provide assumptions — trusted roles, known invariants, accepted risks — as text or a PDF/DOCX upload. The agents read that context before judging your code, which cuts findings that are technically true but irrelevant to your threat model.
Your repository is fetched for analysis when a scan runs, and scans execute server-side. Your code is not shared, and access is limited to what the GitHub App installation grants.
Minutes. Sign in with GitHub, install the app, set your scope, and run a scan — teams go from first sign-in to structured findings the same day. Compare that with manual audit engagements, which typically cost $25k–$250k and take weeks to schedule.
Kagex is in pilot, and new workspaces are approved manually. Sign in with GitHub to request access, or email [email protected] — once your workspace is approved, you can connect repositories and start scanning.
Connect GitHub, scope your repositories, and get structured findings in minutes. Workspaces are approved manually during the pilot.
Start scanning