audit

audit is an automated vulnerability-discovery agent from evilsocket. Point it at a codebase and it runs an eight-stage pipeline, recon, hunt, validate, trace, report, using narrow AI agents that deliberately argue with each other: a second agent on a different model tries to disprove the first one's findings. MIT-licensed and free.

The design borrows from Cloudflare's research that real bug-hunting needs many focused agents, not one giant model doing everything. It runs on your Claude Code subscription through the official Agent SDK, so there's no separate API key or metered bill if you already pay for Claude. Setup is more involved than a one-liner, and the agents run shell commands, so a disposable VM is the right call for untrusted code.

The catch: this drives an LLM to find bugs, which means false positives and missed issues both happen. It's a force multiplier for a security reviewer, not a replacement for one. If you do code audits and already have Claude, it's worth a serious look. If you expect it to certify your code as safe on its own, that's not what this is.