AUTONOMOUS AI AUDITING — LIVE

Ancient Wisdom,
Modern Security

AI agents continuously hunt in your smart contracts — in 30 minutes, not 30 days.

Start Free Audit See How It Works

✓ No credit card required✓ 1 free audit on signup✓ Results in <30 min

CRITICAL

Reentrancy: withdraw() calls external before state update

VaultCore.sol line 147#KTH-2847

13,000+Historical Findings

4Data Sources

3-PhasePipeline

1Free Audit

The Audit Pipeline

One Overmind. Five Agents.
False Positives Filtered.

Kthulhu's Overmind is the central state-machine orchestrator — assigning tasks, enforcing token budgets, escalating blockers, and coordinating five specialized agents in a strict sequential pipeline.

OVERMIND— Cloudflare Durable Object · SQLite task queue · live telemetry

ORCHESTRATING

OVERMIND — Orchestrator

→

SOURCER

→

PROTOCOL EXPERT

→

SYNTHESIZER

→

VERIFIER

Token Budget Enforcement

Each agent operates within a strict MoSCoW-gated token budget. Overmind kills runaway tasks automatically.

Automatic Escalation

CRITICAL findings trigger Management by Exception — Overmind halts the pipeline and alerts a human reviewer before delivery.

Live Telemetry

Every agent state transition, token usage, and finding is logged in the Overmind's SQLite task queue in real time.

PM AGENT

Orchestration & Scoping

The Project Manager allocates token budgets, defines the audit timeline, and tracks telemetry across the swarm.

Token budget allocation
Timeline scoping
Telemetry tracking

Overmind assigns task → monitors progress → validates output → triggers SOURCER

Kthulhu PM agent managing the audit scope

SOURCER AGENT

Data Ingestion

Attack surface mapping, ABI extraction, and Git diffing. Reads the smart contract structure and prepares the context.

Attack surface mapping
ABI extraction
Git diffing

Overmind assigns task → monitors progress → validates output → triggers PROTOCOL EXPERT

PROTOCOL EXPERT AGENT

Deep Domain Analysis

Cross-references logic against DeFi standards (AMM, Lending, Yield). Identifies complex business logic vulnerabilities.

DeFi logic analysis
AMM/Lending checks
Vulnerability detection

Overmind assigns task → monitors progress → validates output → triggers SYNTHESIZER

SYNTHESIZER AGENT

Compiler Self-Healing

Generates Foundry PoC exploit tests and Halmos refinement proofs using NVIDIA NIM to ensure exploits are actionable.

Foundry PoC generation
Halmos proofs
Trident MGF

Overmind assigns task → monitors progress → validates output → triggers VERIFIER

VERIFIER AGENT

Llama-3.3-70B Red-Teaming

Validates findings, removes false positives, and triggers Mainnet RPC Simulations to prove exploitability.

CoVe red-teaming
False-positive removal
Mainnet RPC Simulation

Overmind assigns task → monitors progress → validates output → triggers report delivery

The Overmind

Five Agents. One Mission.

The Overmind orchestrates a five-agent autonomous pipeline — each specialised, each MoSCoW-gated, each accountable.

overmind@kthulhu:~$ audit VaultCore.sol

Scroll to start the simulation…

The Overmind coordinates all five agents autonomously — from submission to report delivery. Submit your first contract →

Platform Capabilities

Everything You Need to Audit at Scale

Built for protocol teams who can't afford to wait — and audit firms who need to scale.

OVERMIND

Multi-Phase Audit Pipeline

Triage → Ensemble Reasoning → Formal Verification. A multi-phase pipeline coordinated by the Overmind — static analysis, multi-model consensus, and Foundry proof generation, with a human review gate.

RAG-Enhanced Knowledge Base

13,000+ findings from Sherlock, Immunefi, Cantina, and Code4rena — indexed with text-embedding-004 embeddings. Intent-aware hybrid search (FTS + vector + severity) on every scan.

FOUNDRY

PoC Exploit Verification

Every flagged vulnerability gets a Foundry test case. No more false-positive noise — only verified findings with working exploit sketches reach your report.

EU AI ACT

Management by Exception

Critical findings require human confirmation before report delivery — the EU AI Act compliance gate. Your security team stays in control of every high-impact decision.

API

Developer-First API

REST API and MCP server on Cloudflare Workers. Trigger audits, pull findings, and query the knowledge base from your CI/CD pipeline or IDE agent with a single API key.

Knowledge & Trust

Built on Every Public Audit
Ever Written

Our knowledge base ingests every published finding from the top security platforms — continuously. The longer Kthulhu runs, the smarter it gets.

13,000+Findings Indexed

4Knowledge Sources

3Pipeline Phases

1Free Audit on Signup

Knowledge Base Sources — Live & Archived Feeds

SherlockImmunefiCantinaCode4renaHats FinanceDeFiHackLabs

Security Commitments

90-day disclosure embargo on submitted code — audit data auto-purged after 24 months (GDPR)

CRITICAL findings require human confirmation — EU AI Act compliant

Multi-tenant isolation — zero data leakage between organisations

Full Overmind audit trail logged to immutable D1 for every decision

EU AI Act compliant — Management by Exception gate on every Critical finding

Kthulhu knowledge graph — 13,000+ vulnerability findings from Sherlock, Immunefi, and Cantina powering a RAG knowledge base

SherlockLIVE

ImmunefiLIVE

CantinaLIVE

Hats FinanceLIVE

Code4rena ArchiveINDEXED

DeFiHackLabsINDEXED

Living Knowledge Base

Trained on Every Public Audit Finding.

Kthulhu continuously ingests audit competition findings from every major platform — building the world's most comprehensive smart contract vulnerability knowledge base. Every new finding makes the next audit smarter.

13,000+Audit Findings Indexed

4Live Competition Feeds

768Embedding Dimensions

90dEmbargo → Public Feed

Technical Stack

Embeddings

text-embedding-004 (768-dim)

Vector Store

pgvector on Neon PostgreSQL

Hybrid FTS + vector + severity

Live search

Solodit + competition feeds

Pricing

Pay Per Audit. Credit-Based.

Start with a free audit credit. Pay per use as you scale — no monthly subscription for core audits, with automatic refunds on failed runs.

Starter

For independent researchers

Free

1 free credit on signup

Start Free

1 free audit credit on signup
Up to 1,000 LOC per audit
Static analysis (Slither/Aderyn) + RAG
PDF report
Community support
Refund on failed audit
PoC verification
API access
Priority processing

Managed Standard

For protocol teams

Pay-per-use

Per-audit credits · refund on fail

Start Auditing

Pay-per-audit credits
Up to 10,000 LOC
Full 3-phase pipeline (triage → ensemble → verification)
PoC exploit verification
Structured JSON + PDF report
Management by Exception alerts
API access (100 req/month)
Email support
White-label reports
Dedicated compute

Managed Pro

For audit firms & enterprises

Custom

Volume credits · contact us

Volume audit credits + higher LOC
Priority compute allocation
White-label report templates
Dedicated Overmind instance
Custom SWC classification rules
Continuous monitoring mode
Unlimited API access
SLA + dedicated support

Roadmap

KHT staking & USDC payments — on-chain staking discounts and USDC settlement are planned. Not yet available; audits are billed with account credits today.

Start Today

Your Smart Contracts Deserve Better Than a Waiting List.

Start with a free audit. No credit card. No waiting. Just submit your contract and Kthulhu's agent fleet gets to work — right now.

Submit Contract for Audit Talk to Enterprise Sales

✓ 1 free audit on signup✓ EU AI Act compliant