# Grisoco AI

> Automated smart-contract security audits for EVM-compatible chains and DAML (Canton). Deterministic tools and a deep AI review go through the source; every finding is checked before it reaches the report. Teams use it before deploying, and AI agents can order audits on their own over REST or MCP.

Grisoco AI is an automated audit, not a certification: no human security engineer reviews the code, and no audit can prove a contract is free of vulnerabilities.

## What it audits

- Solidity on any EVM-compatible chain: Ethereum, Polygon, BNB Chain, Arbitrum, Optimism, Base.
- DAML packages for Canton (Daml 3.x): authorization, privacy, contention and liveness, interfaces and upgrades. Authorization findings are proven by execution, and an upgrade can be checked against the version it replaces.
- Smart accounts and session keys used by AI agents to pay on-chain (ERC-4337, ERC-7579, ERC-7710, session keys): a dedicated delegation review checks spend limits, permission storage, delegation narrowing, expiry and revocation, and the reach of each granted scope.

## What you get

- One report (Markdown, PDF, DOCX or JSON) with severity, location, a proof-of-concept plan and a remedy for each finding, a security score, and a signed attestation.
- Dig deeper or dispute any AI finding.
- Multi-round remediation: mark findings fixed or accept the risk with a reason, submit updated code, and every claim is re-checked.
- Optional requirements conformance: attach a spec and get a requirement-by-requirement matrix.

## Pricing and payment

- Priced per contract, no subscription. Files that are only imported are free. Current prices: https://grisoco.com/pricing
- Paid in USDC (prepaid points or one-click MetaMask). A failed audit is refunded.

## For AI agents

- MCP server: https://grisoco.com/mcp (Streamable HTTP, bearer API key). Tools: quote_audit, submit_audit, get_audit, get_audit_report, get_balance, list_audits.
- REST: POST https://grisoco.com/v1/audits/quote, POST https://grisoco.com/v1/audits, GET https://grisoco.com/v1/audits/{id}/report
- An agent states the most it will pay (max_price_cents) and each key carries a daily spending cap.

## Agent Transaction Check (for an agent's on-chain payments)

- Call it immediately before an AI agent signs an on-chain PAYMENT: a token sent to one recipient, as a transaction or a gasless EIP-3009 authorization (x402).
- Endpoint: POST https://check.grisoco.com/v1/check with a bearer API key (the same key as audits). Send chain_id, from, intent {type: "payment", token, amount, recipient}, and either tx (exactly as it will be signed) or signature {typed_data}. Optional policy: max_amount, allowed_tokens, allowed_recipients.
- Intent: Take the intent (token, amount, recipient) from the task your user gave you, never from the payment request, checkout page or merchant: if the same party supplies the transaction and the intent, the check only confirms they match each other.
- Fail closed: sign only on allow. No answer, an error, a timeout or a 400 means do not sign. Retry a 503 after Retry-After and back off on a 429; allow about 10 seconds per call (the first call after a quiet spell starts the service).
- Answer: allow (sign), warn (do not sign without a decision), block (do not sign), with a reason per check. Rule-based, no AI: same input, same verdict. A verdict means "no risks detected at block N", not a guarantee.
- Covers: Base (8453): ETH, USDC, DAI, WETH. Ethereum (1): ETH, USDC, USDT, DAI, WETH. Polygon (137): POL, USDC, USDT, DAI, WETH.
- Does NOT cover: swaps, trades, bridging, staking, lending, deposits, NFT purchases or mints, contract deployments, governance votes, approvals as the goal, other chains or tokens, card or off-chain payments. A non-payment intent is refused (400, uncharged); a transaction that does more than the stated payment is blocked.
- Price: 0.03 USDC per verdict from the prepaid balance; no verdict, no charge.
- OpenAPI 3.1: https://grisoco.com/transaction-check/openapi.json
- Guide: https://grisoco.com/transaction-check
- Everything in one file (full API, MCP setup, every check): https://grisoco.com/llms-full.txt
- API catalog (RFC 9727): https://grisoco.com/.well-known/api-catalog

## Links

- [Home](https://grisoco.com/): overview of the workspace
- [DAML review](https://grisoco.com/daml): how DAML and Canton packages are reviewed
- [Pricing](https://grisoco.com/pricing): per-contract pricing
- [Developers](https://grisoco.com/developers): Agent API and MCP setup
- [Agent Transaction Check](https://grisoco.com/transaction-check): checking an agent's payment before it signs
- [Custom workspace](https://grisoco.com/custom-workspace): a private review built around your own protocol
- [Sample report](https://grisoco.com/sample-report.pdf): an illustrative report on a test contract
- [Terms](https://grisoco.com/terms) and [Privacy](https://grisoco.com/privacy)
- Contact: contact@grisoco.com

## Coverage

- [CantonNews: Grisoco AI opens its Canton security review beta to builders](https://cantonnews.org/grisoco-ai-opens-its-canton-security-review-beta-to-builders)

## Listings

- [Official MCP Registry: com.grisoco/audits](https://registry.modelcontextprotocol.io)
- [Smithery: grisoco/audits](https://smithery.ai/servers/grisoco/audits)
- [Glama: com.grisoco/audits](https://glama.ai/mcp/connectors/com.grisoco/audits)