Skip to content

Back to the catalog

Awesome AI Web3 Security
github.comrepo

Awesome AI Web3 Security

A curated, verified awesome-list of AI-powered tools for smart contract and blockchain security, covering autonomous auditor agents (Hound, Plamen, Aether, SolidityGuard), commercial AI audit platforms (Sherlock AI, Cantina Apex, Zellic V12, Nethermind AuditAgent), MCP-based auditing plugins (Trail of Bits Skills, Claudit, Slither MCP, Solodit MCP Server), real-time on-chain ML monitoring (Forta Network, AnChain.AI), and benchmark/training datasets (EVMbench, SCONE-bench, ScaBench, SmartBugs). Every entry requires a real AI/ML/LLM component plus a specific Web3 security focus, with open-source entries needing 25+ GitHub stars, positioning it as a practical index for the emerging AI-driven smart-contract-audit tooling ecosystem.

TL;DR Curated, star-verified directory of AI-powered smart contract auditors, MCP security plugins, on-chain ML monitors, and Web3-security benchmark datasets.
Open original ↗
Document

What it is

A GitHub awesome-list (marchev/awesome-ai-web3-security) cataloguing AI-powered smart-contract and blockchain security tools, last verified March 2026. It splits into three functional groups the summary only gestures at: (1) autonomous auditors you point at code, (2) commercial/hosted audit platforms, and (3) agent-augmentation components you bolt onto your own auditing agent. The distinction matters for selection — the third group "don't orchestrate finding bugs on their own."

How it works (the selection axes it actually exposes)

Beyond the summary, the list is decision-usable because each entry carries a delivery form and a pricing tier:

  • Delivery forms: Skill (Claude Code / Codex plugins — e.g. Plamen, Nemesis Auditor, Archethect SC-Auditor, Move Auditor Skills, SCV Scan), CLI (Hound, GPTScan, SolidityGuard, Aether), and MCP servers / connectors (Claudit, Grimoire, Trail of Bits Skills).
  • Pricing tiers: Free (Hashlock AI Audit), Freemium (Nethermind AuditAgent, Olympix, AuditBase), and Paid (Sherlock AI, Cantina Apex, Zellic V12, Grego, Almanax, Savant.Chat, ChainGPT, TestMachine, Firepan, Octane, webrainsec).

Language coverage varies and is stated per-entry: Plamen (EVM, Solana/Anchor, Aptos Move, Sui Move); forefy/.context (Solidity, Anchor/Rust, Vyper, FunC/Tact, Sui Move); DarkNavy Client Auditor targets execution/consensus clients and bridges in Go, Rust, C/C++, Java.

What to do

Use the tiers to match need to effort:

  • Want something runnable today, no vendor: open-source CLIs/Skills — Hound, Aether (180+ detectors, Halmos symbolic exec, 6-pass LLM pipeline, Foundry PoC gen), SolidityGuard (104 patterns, 9 integrated tools).
  • Want to make an existing Claude Code / Codex agent smarter, not replace it: the augmentation group — Claudit (MCP server over Solodit's 20K+ findings), Grimoire, Trail of Bits Skills (35 plugins).
  • Want a managed platform / human-in-loop: paid entries — Cantina Apex (agents + human auditors), Sherlock AI (GitHub-integrated, remediation + verification tests), TestMachine (executes exploits, reports only successful ones).

Caveats

  • Benchmark claims come from the tools' own READMEs, not independent tests — notably SolidityGuard's "100% on 85/85 CTF challenges and 120/120 EVMBench." Treat as vendor-reported.
  • Curation gate is minimal: open-source entries need only 25+ GitHub stars plus a real AI/ML/LLM component and Web3 focus. Inclusion signals relevance, not audit quality.
  • Verification is a point-in-time snapshot ("Every link verified March 2026"); star counts and activity drift.

Organisations named here

  • Certora
  • DarkNavy

Technologies named here

  • Pashov Audit Group Skills
  • EVM
  • Solidity
  • Hound
  • Solana/Anchor
  • Plamen
  • Aptos Move
  • Nemesis Auditor
  • Archethect SC-Auditor
  • Sui Move
  • GPTScan
  • Vyper
  • SCV Scan
  • FunC/Tact
  • Rust
  • forefy/.context
  • SolidityGuard
  • Go, C/C++, Java
  • Aether
  • Move Auditor Skills
  • DarkNavy Contract Auditor
  • DarkNavy Client Auditor
  • Octane Security
  • Sherlock AI
  • Cantina Apex
  • Zellic V12
  • Grego
  • Nethermind AuditAgent
  • Olympix
  • Almanax
  • Savant.Chat
  • Hashlock AI Audit
  • ChainGPT Smart Contract Auditor
  • AuditBase
  • TestMachine
  • webrainsec
  • Firepan
  • trailofbits/skills
  • Claudit
  • Grimoire
  • Certora Prover + AI Composer
  • QuillAudits Claude Skills
  • Slither MCP
  • SmartInv
  • Solodit MCP Server
  • FTSmartAudit
  • ZeroSkills
  • CD Security's AUDIT-PREP
  • DarkNavy Exploit Investigator
  • Cholakov's Foundry PoC Mainnet Fork
  • Forta Network
  • AnChain.AI
  • EVMBench
  • SCONE-bench
  • ScaBench
  • Bastet
  • Majeur Benchmark
  • SmartBugs
  • Smart-Contract-Dataset
  • SmartBugs Curated
  • Awesome Smart Contract Datasets
  • Forge Dataset
  • SCV-1-2000
  • pashov/ai-web3-security
  • HackenProof AI Agents Directory
  • Forefy Auditor Skills Registry
  • Ethereum
  • Solana
  • Model Context Protocol
  • Claude Code
  • Foundry
  • Trail of Bits

Techniques named here

  • Reentrancy vulnerability detection
  • Timestamp dependence vulnerability detection
  • Integer overflow vulnerability detection
  • Delegatecall vulnerability detection
  • Business logic flaw detection
  • Symbolic execution
  • Fuzzing
  • Mutation testing
  • Static Analysis
  • Formal verification / CVL specification generation
  • Invariant inference
  • Adversarial simulation / adversarial validation
  • Behavioral state analysis / state inconsistency detection
  • Bayesian scoring
  • PoC exploit generation
  • Knowledge graph-based iterative code reasoning
  • Multi-agent orchestration
  • Zero-shot vulnerability detection
  • Knowledge distillation for model fine-tuning
  • Differential review / variant analysis
  • ML-based real-time transaction monitoring

Related in AI Security