Kagex reviews every change to your Solidity code with multi-agent AI analysis — surfacing the findings your next audit would bill you for, while they still cost nothing to fix.
A curated knowledge base distilled from 800+ documented real-world exploits — not a generic linter ruleset.
Maximum signal
Every file in scope goes through a coordinated pipeline of specialized AI agents — deep vulnerability hunting cross-referenced against 800+ documented exploits, and a dedicated Solidity engineering review covering security patterns, gas, and code quality — running in parallel on Claude, Anthropic's frontier model, and steered by your project's own assumptions and trust model. Each finding ships with everything an engineer needs to judge it, reproduce it, and fix it.
Every finding carries a severity, and every scan rolls up to a merge-relevant verdict: PASS, PASS WITH WARNINGS, or FAIL.
The exact lines at fault, quoted from your repository — no hunting through a report to figure out what the finding refers to.
A rewritten version of the vulnerable section, so the path from finding to fix is a review and a commit, not a research project.
What an attacker actually gains — drained funds, frozen withdrawals, broken accounting — stated plainly so you can prioritize.
The step-by-step route from entry point to exploit, so you can verify the finding is real before you spend time on it.
Concrete remediation guidance on every finding, with a proof-of-concept where one applies, demonstrating the exploit end to end.
How it works
No sales call, no onboarding project. Kagex is GitHub-native end to end.
Sign in with GitHub and install the Kagex app on the repositories you want covered. Your code is fetched for analysis when a scan runs — nothing else.
Define the audit scope per repository with glob patterns, and give the agents your team's context — trust assumptions, known invariants, out-of-scope areas — as text or a PDF/DOCX upload.
Run a scan from the dashboard whenever you want, or add a label to a pull request and Kagex scans it automatically. A pipeline of specialized AI agents dissects every file in scope — vulnerability hunting, exploit-pattern matching, and Solidity engineering review — and results land as PR comments with a PASS / PASS WITH WARNINGS / FAIL verdict.
Work through findings in the dashboard: acknowledge, mark will-fix, dismiss as false positive, or resolve. Dismissed issues never reappear on unchanged code. Export the whole picture as a markdown security report.
Security score
Every scan produces a 0–100 security score across seven categories — access control, reentrancy, upgradeability, oracle safety, ERC compliance, math, and business logic. Engineers see exactly which category slipped; management sees one KPI that moves.
Every pull request is judged against the previous scan: newly introduced issues are flagged as regressions, verified fixes are credited, and the score delta lands right in the PR comment — 89 → 91 is a review conversation everyone can have.
And it's built to be shown, not hidden: publish a live score badge on your README or website, linking to a public transparency profile served by Kagex — always current, impossible to fake.
Security score
Previous 89
+2Illustrative report — your numbers come from your code.
Progress & recognition
Teams earn Security Points for verifiable improvements — never for spend, never for scan volume. Points climb a league ladder and unlock badges your team can actually be proud of.
Fixes count only when a rescan confirms the issue is gone.
“We reached Diamond security on Kagex” is a tweet, a badge, and a hiring signal.
On the roadmap: seasonal leaderboards, public protocol rankings, and KAGE-token utilities on the service side — staked compute tiers, certification-maintenance bonds, and bounty pools.
One rule is permanent: points, leagues, and any future token never touch the score. The score reflects your code — nothing else.
Honest positioning
A manual audit is a snapshot: weeks of scheduling, a $25k–$250k engagement, and a report that describes one commit. Every commit after it is uncovered until the next engagement.
Kagex is the layer in between. It reviews code continuously as it changes, clears out the findings a scanner should catch, and hands your auditors a cleaner codebase — so their time, and your budget, go toward the issues only humans find.
Label a pull request and get a verdict before it merges. Findings arrive as PR comments where your team already reviews code — no separate tool to check, no report to circulate.
Manual audits bill for every finding, including the ones a scanner catches in minutes. Clear those out first, and your audit budget goes toward the deep issues only humans find.
An audit certifies one snapshot of the code. Every commit after it is uncovered. Kagex diffs every scan against the last one — newly introduced issues are flagged the moment they appear, and your security score shows the drift.
Crypto or invoice. No card required to start a pilot.
40 scans per seat each month, pooled across your team.
No scan limit, subject to fair use. Priority queue.
Each scan starts every category at 100 and deducts per open finding, weighted by severity — a critical costs far more than a low. Resolved and dismissed issues don't count; accepted risks count at half weight. The overall score averages seven categories, and every scan is compared to the previous one so you see the delta, not just the number. The score can't be influenced by anything except the state of your code.
Solidity, today. Kagex is built for smart-contract teams, and the knowledge base — 420+ vulnerability patterns across 52 categories — is distilled from documented real-world exploits in that ecosystem.
No, and we won't pretend it does. Kagex is the continuous layer between audits: it reviews code as it changes, catches what a scanner should catch, and lets your auditors spend their time on what only they can find. Ship to your audit with fewer known issues, and keep coverage after the auditors leave.
Every issue has a lifecycle: acknowledge, will-fix, false positive, resolved. When you dismiss a finding, Kagex fingerprints it — the same issue on unchanged code will never reappear in a later scan. Triage work is done once, not once per scan.
You can scope each repository with glob patterns so the agents only review what matters, and provide assumptions — trusted roles, known invariants, accepted risks — as text or a PDF/DOCX upload. The agents read that context before judging your code, which cuts findings that are technically true but irrelevant to your threat model.
Your repository is fetched for analysis when a scan runs, and scans execute server-side. Your code is not shared, and access is limited to what the GitHub App installation grants.
Minutes. Sign in with GitHub, install the app, set your scope, and run a scan — teams go from first sign-in to structured findings the same day. Compare that with manual audit engagements, which typically cost $25k–$250k and take weeks to schedule.
Kagex is in pilot, and new workspaces are approved manually. Sign in with GitHub to request access — once your workspace is approved, you can connect repositories and start scanning.
Connect GitHub, scope your repositories, and get structured findings in minutes. Workspaces are approved manually during the pilot.
Start scanning