Scanning

The hawki scan pipeline is the core workflow. It runs a fixed sequence of stages and produces a findings set, a security score, and a report.

The pipeline

1. Index - the source is parsed with tree-sitter, contracts and dependencies are mapped.
2. Static rules - 50 auto-discovered rules run, and each finding is enriched with a remediation template.
3. AI reasoning (with --ai) - an LLM adds explanation and impact context.
4. Sandbox (with --sandbox) - attack scripts run inside Docker to confirm exploitability.
5. Deps - dependency versions are checked for known vulnerabilities.
6. Score and report - findings are scored and rendered.

Reports land in ./hawki_reports/ as timestamped report_*.json files. Persistent state lives under ~/.hawki/.

Scanning local code

Point Hawk-i at a directory or a Git URL. Remote repositories are cloned automatically.

$ hawki scan ./contracts
$ hawki scan https://github.com/org/repo.git

Scanning deployed contracts by address

Pass an address and a chain. Hawk-i pulls verified source from the chain's block explorer (Etherscan-family), falling back to web3 and raw bytecode when source is unavailable.

$ hawki scan --address 0xYourContract --chain ethereum
$ hawki scan --address 0xYourContract --chain polygon --explorer-key <KEY>

Supported chains

Per-chain RPC and explorer endpoints ship built in for seven EVM mainnets, plus the Sepolia testnet and a local node:

• - Ethereum
• - Polygon
• - Arbitrum
• - Optimism
• - Base
• - BNB Chain
• - Avalanche
• - Sepolia (testnet)
• - Local (Anvil or Hardhat)

Use --rpc-url to point at your own node and --explorer-key to supply a block-explorer API key.