# Grisoco AI

> Two security products. Automated smart-contract security audits for EVM-compatible chains and DAML (Canton): deterministic tools and a deep AI review go through the source, and every finding is checked before it reaches the report. And the Agent Transaction Check: before an AI agent signs a crypto payment, it runs the transaction against the live chain and confirms it does exactly the stated payment (official token, exact amount, right recipient) and nothing else. Teams use the audits before deploying; AI agents can order audits and run checks on their own over REST or MCP.

Grisoco AI is an automated audit, not a certification: no human security engineer reviews the code, and no audit can prove a contract is free of vulnerabilities.

## What it audits

- Solidity on any EVM-compatible chain: Ethereum, Polygon, BNB Chain, Arbitrum, Optimism, Base.
- DAML packages for Canton (Daml 3.x): authorization, privacy, contention and liveness, interfaces and upgrades. Authorization findings are proven by execution, and an upgrade can be checked against the version it replaces.
- Smart accounts and session keys used by AI agents to pay on-chain (ERC-4337, ERC-7579, ERC-7710, session keys): a dedicated delegation review examines how the account's code enforces spend limits, permission storage, delegation narrowing, expiry and revocation, and the reach of each granted scope.

## What you get

- One report (Markdown, PDF, DOCX or JSON) with severity, location, a proof-of-concept plan and a remedy for each finding, a security score, and a signed attestation.
- Dig deeper or dispute any AI finding.
- Multi-round remediation: mark findings fixed or accept the risk with a reason, submit updated code, and every claim is re-checked.
- Optional requirements conformance: attach a spec and get a requirement-by-requirement matrix.

## Pricing and payment

- Priced per contract, no subscription. Files that are only imported are free. Current prices: https://grisoco.com/pricing
- Paid in USDC (prepaid points or one-click MetaMask). A failed audit is refunded.

## For AI agents

- MCP server: https://grisoco.com/mcp (Streamable HTTP, bearer API key). Tools: quote_audit, submit_audit, get_audit, get_audit_report, get_balance, list_audits.
- REST: POST https://grisoco.com/v1/audits/quote, POST https://grisoco.com/v1/audits, GET https://grisoco.com/v1/audits/{id}/report
- An agent states the most it will pay (max_price_cents) and each key carries a daily spending cap.

## Agent Transaction Check (for an agent's on-chain payments)

- Call it immediately before an AI agent signs an on-chain PAYMENT: a token sent to one recipient, as a transaction or a gasless EIP-3009 authorization (x402).
- What it catches: a swapped recipient; a look-alike token; more leaving than the stated amount; an extra token, coin or NFT hidden in the same transaction; a spending approval slipped in (unlimited approvals and Permit2 allowances block); any change of who controls the wallet (Safe owner, module or guard, ownership handover, proxy upgrade, role grant, EIP-7702 delegation); a token that moves money without reporting it; a transaction that would revert.
- It is not a spending limit. Limits (max_amount, allowed_tokens, allowed_recipients) are an optional policy on top; the check itself compares the transaction's real effects with the stated intent.
- Endpoint: POST https://check.grisoco.com/v1/check with a bearer API key (the same key as audits). Send chain_id, from, intent {type: "payment", token, amount, recipient}, and either tx (exactly as it will be signed) or signature {typed_data}. Optional policy: max_amount, allowed_tokens, allowed_recipients.
- Intent: Take the intent (token, amount, recipient) from the task your user gave you, never from the payment request, checkout page or merchant: if the same party supplies the transaction and the intent, the check only confirms they match each other.
- Fail closed: sign only on allow. No answer, an error, a timeout or a 400 means do not sign. Retry a 503 after Retry-After and back off on a 429; allow about 10 seconds per call (the first call after a quiet spell starts the service).
- Answer: allow (sign), warn (do not sign without a decision), block (do not sign), with a reason per check. Rule-based, no AI: same input, same verdict. A verdict means "no risks detected at block N", not a guarantee.
- Covers: Base (8453): ETH, USDC, DAI, WETH. Ethereum (1): ETH, USDC, USDT, DAI, WETH. Polygon (137): POL, USDC, USDT, DAI, WETH.
- Does NOT cover: swaps, trades, bridging, staking, lending, deposits, NFT purchases or mints, contract deployments, governance votes, approvals as the goal, other chains or tokens, card or off-chain payments. A non-payment intent is refused (400, uncharged); a transaction that does more than the stated payment is blocked.
- Price: 0.03 USDC per verdict from the prepaid balance; no verdict, no charge.
- OpenAPI 3.1: https://grisoco.com/transaction-check/openapi.json
- Guide: https://grisoco.com/transaction-check
- Everything in one file (full API, MCP setup, every check): https://grisoco.com/llms-full.txt
- API catalog (RFC 9727): https://grisoco.com/.well-known/api-catalog

## Links

- [Home](https://grisoco.com/): overview of the workspace
- [DAML review](https://grisoco.com/daml): how DAML and Canton packages are reviewed
- [Pricing](https://grisoco.com/pricing): per-contract pricing
- [Developers](https://grisoco.com/developers): Agent API and MCP setup
- [Agent Transaction Check](https://grisoco.com/transaction-check): checking an agent's payment before it signs
- [Custom workspace](https://grisoco.com/custom-workspace): a private review built around your own protocol
- [Sample report](https://grisoco.com/sample-report.pdf): an illustrative report on a test contract
- [Terms](https://grisoco.com/terms) and [Privacy](https://grisoco.com/privacy)
- Contact: contact@grisoco.com

## Coverage

- [CantonNews: Grisoco AI opens its Canton security review beta to builders](https://cantonnews.org/grisoco-ai-opens-its-canton-security-review-beta-to-builders)

## Listings

- [Official MCP Registry: com.grisoco/audits](https://registry.modelcontextprotocol.io)
- [Smithery: grisoco/audits](https://smithery.ai/servers/grisoco/audits)
- [Glama: com.grisoco/audits](https://glama.ai/mcp/connectors/com.grisoco/audits)