Introduction

Hawk-i is an open-source security-intelligence platform for Solidity and Web3 smart contracts. It combines deterministic static analysis, LLM reasoning, and a live Docker exploit sandbox into a single command-line tool that runs entirely on your machine.

Hawk-i v1.0.0 is a finished, local-first tool. There is no cloud requirement, no account, and no phone-home. Point it at a repository or a deployed contract address and it produces audit-grade findings, a quantified security score, and reproducible proof-of-concept exploits.

What makes it different

• Static plus reasoning plus proof - 50 auto-discovered rules, optional LLM reasoning, and a Docker sandbox that actually runs exploits.
• No dead rules - every static rule is verified by a liveness test that proves it fires through the real scan pipeline, not just in isolation.
• The Deep agent - an autonomous loop that invents novel attacks and synthesizes a Hardhat or Foundry proof-of-concept for each one.
• Deployed-contract scanning - pull verified source straight from block explorers across the major EVM chains.
• Audit-grade output - professional reports, an Immunefi-style submission format, and first-class JSON export.