-------------------------------------------------------------------------------- title: "Firepan Platform Overview" description: "AI-powered smart contract security platform providing continuous vulnerability scanning, autonomous auditing, and security monitoring for EVM chains." last_updated: "2026-03-30" source: "https://firepan.com" -------------------------------------------------------------------------------- # Firepan Platform Overview Firepan is an AI-powered smart contract security platform that transforms traditional one-off audits into continuous, automated security monitoring. The core engine is Hound, an autonomous AI auditor that analyzes Solidity and Vyper codebases for vulnerabilities using pattern matching, LLM-verified analysis, and knowledge graph construction. ## Mission Make onchain security continuous, affordable, and default. Firepan combines repeatable repository analysis with separately scoped human-led Boutique Audits. ## Core Capabilities - **Scan** — Fast pattern-based triage with optional LLM verification. - **Probe** — Investigates a selected commit and helps prioritize concerns with file and line evidence and next checks where available. The first run provides a baseline; later results can be compared with it. - **Audit** — Deeper automated adversarial review with curated findings and supporting evidence. - **Boutique Audit** — Separately scoped human-led assessment. - **CI/CD Integration** — Automated scan-on-push via GitHub App. PR comments with scan results. - **Dashboard** — Real-time view of scan history, risk scores, findings, and audit reports at app.firepan.com. ## Agent Integration For detailed agent instructions (endpoints, auth flow, error handling, response schemas), see: https://firepan.com/SKILL.md --- -------------------------------------------------------------------------------- title: "Getting Started" description: "How to sign up for Firepan and run your first smart contract security scan." last_updated: "2026-03-30" source: "https://app.firepan.com" -------------------------------------------------------------------------------- # Getting Started ## Step 1: Create an Account 1. Navigate to https://app.firepan.com 2. Click **Sign Up** — GitHub login is recommended (it also grants Firepan access to scan your repositories) 3. Verify your email (required for paid endpoints) ## Step 2: Add a Repository 1. From the Dashboard, navigate to **Repositories** 2. Click **Add Repository** and select a GitHub repo 3. Firepan queues an initial scan automatically ## Step 3: Run a Scan - **Scan** — Fast pattern-based analysis with optional LLM verification. Good for triage and CI/CD. - **Probe** — Helps decide what to verify or fix next on a selected commit. Review file and line evidence and suggested checks where available. Compare a later run with the first baseline; coverage still depends on the submitted scope and evidence. - **Audit** — Deeper automated adversarial review of selected source code. A human-led Boutique Audit is a separate engagement. ## Step 4: Review Findings Each scan produces: - A **risk score** and **risk level** (Critical, High, Medium, Low, Minimal) - A categorized list of **findings** with severity, location, and description - A **summary** describing the overall security posture ## Step 5: Create a Service API Key A team admin creates a key in **Settings > API keys** at https://app.firepan.com/settings/api-keys. Copy the key shown once into your application's secret store. The dashboard lists key metadata and lets admins revoke keys; it cannot reveal a saved key again. Keep dashboard login tokens within the signed-in dashboard. --- -------------------------------------------------------------------------------- title: "API Reference" description: "Firepan REST API for programmatic access to scans, audits, and results." last_updated: "2026-03-30" source: "https://api.firepan.com" -------------------------------------------------------------------------------- # API Reference ## Base URL ``` https://api.firepan.com ``` ## Authentication Tenant REST endpoints use an API key or a login JWT in the `Authorization` header: ``` Authorization: Bearer ``` Create an API key as a team admin at https://app.firepan.com/settings/api-keys. Keys retain tenant boundaries, product access, subscription expiry and delivery checks. They do not supply GitHub access, manage other keys, or bypass x402. Revoke unused keys in Settings. Separately, the wallet-native Agent API needs no OAuth/JWT for its two public-repository purchase routes. ## Endpoints ### Free Scan ```http POST /surface/scan Content-Type: application/json { "target": "https://github.com/OpenZeppelin/openzeppelin-contracts" } ``` No authentication required. Send only a public GitHub repository URL; model and call budget are server policy, and caller overrides are rejected. Returns a completed free result. Respect `429` and `Retry-After` for rate or capacity limits. Missing, private and oversized repositories are refused before work. Unsupported-language or incomplete analysis is inconclusive with null risk; missing coverage is not a clean result. ### Sentinel MCP `https://api.firepan.com/mcp` exposes only `sentinel_token_report`. Supply a supported chain and token address to read the current published Sentinel snapshot. It preserves separate Contract Safety and Adoption assessments when available and labels incomplete, preliminary and legacy reports. Unavailable tokens do not start a new scan. No login, private report access, wallet actions or purchase flow is part of this Sentinel-only release. ### Wallet-native paid scan ```http POST /agent/surface-scan Content-Type: application/json Idempotency-Key: { "repo_url": "https://github.com/OpenZeppelin/openzeppelin-contracts" } ``` Price cap: 500,000 atomic USDC ($0.50). Wallet input is a public `https://github.com/OWNER/REPO` URL; omit `installation_id`. `llm_budget` is optional and capped at 5; model override is unavailable. ### Wallet-native audit ```http POST /agent/audits Content-Type: application/json Idempotency-Key: { "repo_url": "https://github.com/OpenZeppelin/openzeppelin-contracts", "mode": "auditor", "time_limit_minutes": 120 } ``` Price cap: 5,000,000 atomic USDC ($5.00). Optional limits are `max_iterations: 30`, `time_limit_minutes: 120`, and `plan_n: 5`. Returns a `session_id`; the audit runs asynchronously. ### Poll Audit Status ```http GET /agent/audits/{session_id}/status Authorization: Bearer ``` Returns `status`, `progress`, `findings_count`, `error_message`, `started_at`, `completed_at`. ### Current Subscription ```http GET /subscriptions/current Authorization: Bearer ``` Returns current plan, billing status, and usage. ### Repositories ```http GET /repositories Authorization: Bearer POST /repositories Content-Type: application/json Authorization: Bearer { "repo_url": "https://github.com/org/repo" } ``` ### Repository Scans ```http GET /repositories/{id}/scans Authorization: Bearer ``` Returns scan history for a repository. ### Findings ```http GET /findings?project_id={id} Authorization: Bearer ``` Returns combined findings from scans and audits. ## x402 Payment Flow `POST /agent/surface-scan` and `POST /agent/audits` are wallet-only x402 v2 purchases. They return `PAYMENT-REQUIRED` on 402; stock `@x402/fetch@2.25.0` plus `@x402/evm@2.25.0` sends `PAYMENT-SIGNATURE` and handles `PAYMENT-RESPONSE`. Do not construct payment headers or signatures. Before selecting an offer, verify its network, asset, payee, and amount cap against `https://api.firepan.com/.well-known/x402`. This is runtime discovery; no Bazaar registration is asserted. On success, `X-Firepan-Access-Token` is a job-scoped Bearer capability for `/agent/audits/{session_id}` reads and exact original-POST replay with ordinary `fetch`, avoiding a second payment. It is not a SaaS token. ## Error Codes - `401 Unauthorized` — Missing, invalid, or out-of-scope Bearer credential - `403 Forbidden` / `email_not_verified` — SaaS access or verification restriction - `402 Payment Required` — wallet payment required for an Agent API purchase - `409 Conflict` — Idempotency key reused with different body - `429 Too Many Requests` — Rate limited, retry with backoff - `5xx` — Transient infrastructure error, retry with backoff --- -------------------------------------------------------------------------------- title: "Pricing & Plans" description: "Firepan subscription plans and pricing." last_updated: "2026-03-30" source: "https://firepan.com/#products" -------------------------------------------------------------------------------- # Pricing & Plans Firepan offers monthly and annual billing. Annual billing saves 20%. ## Starter — $299/month ($239/month billed annually) For individual developers and small projects. ## Professional — $1,199/month ($959/month billed annually) For growing teams with multiple smart contract projects. ## Enterprise — $2,999/month ($2,399/month billed annually) For organizations requiring comprehensive security coverage. ## Boutique Audits — Custom Pricing Combines Firepan's AI-powered analysis with expert human review. Contact sales at https://firepan.com/contact ## Agent Payments (x402) AI agents can pay per-call using USDC on Base via the x402 protocol: - Scan (full): $0.50 - Audit: $5.00 ## Billing Notes - Payments processed via Stripe (subscriptions) or x402 (agent pay-per-call) - New signups get a trial with scan and audit access - Plan limits reset at the start of each billing cycle - Upgrade or downgrade at any time from Dashboard > Billing --- -------------------------------------------------------------------------------- title: "Supported Contracts" description: "Languages and chains supported by Firepan." last_updated: "2026-03-30" -------------------------------------------------------------------------------- # Supported Contracts **Languages**: Solidity (`.sol`), Vyper (`.vy`) **EVM Chains**: Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, BNB Chain, and any EVM-compatible chain. Firepan analyzes source code — it does not require on-chain deployment. Point it at a GitHub repository containing Solidity or Vyper contracts. Contract discovery focuses on: repo root, `contracts/`, `src/`, `lib/`. --- -------------------------------------------------------------------------------- title: "Security Glossary" description: "Key security terms used throughout the Firepan platform." last_updated: "2026-03-30" -------------------------------------------------------------------------------- # Security Glossary **Reentrancy** — A vulnerability where an external contract is called before internal state is updated, allowing the external contract to re-enter the original function and drain funds. **Flash Loan Attack** — An attack that exploits uncollateralized loans that must be borrowed and repaid within a single transaction, used to manipulate prices or governance. **Oracle Manipulation** — Exploiting a price feed or data oracle to provide incorrect values to a smart contract, enabling profitable but malicious transactions. **Access Control Flaw** — Missing or incorrect authorization checks that allow unauthorized users to call restricted functions. **Integer Overflow/Underflow** — Arithmetic that exceeds the maximum or minimum value of a variable type. Mitigated in Solidity 0.8+ by default. **Delegatecall Misuse** — Incorrect use of delegatecall that can allow an attacker to overwrite storage or execute arbitrary code in the calling contract's context. **Front-running** — An attack where an observer of the mempool submits a transaction with higher gas to execute ahead of a pending transaction. **Scan** — Firepan's fast pattern-based analysis mode with optional LLM verification. **Probe** — Exploratory repository analysis that helps prioritize concerns and next checks. The first run establishes a baseline; later results can be compared against it. **Audit** — Firepan's deeper automated adversarial review of selected smart contract source code. **Hound** — Firepan's proprietary AI security analysis engine. **Risk Score** — A numeric score reflecting a repository's vulnerability exposure based on scan findings. **Assessment Level** — Audit severity rating: CRITICAL, HIGH, MODERATE, LOW, or MINIMAL. --- -------------------------------------------------------------------------------- title: "FAQ" description: "Frequently asked questions about Firepan." last_updated: "2026-03-30" -------------------------------------------------------------------------------- # FAQ ## What blockchains and languages does Firepan support? Firepan supports Solidity and Vyper smart contracts targeting EVM-compatible chains including Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, and BNB Chain. ## What is the difference between Scan, Probe, and Audit? Scan discovers common vulnerability signals quickly. Probe investigates the repository: its first run provides a baseline, and later results can be compared with that baseline. Audit conducts a deeper adversarial review of the selected source scope. Each automated result needs verification before a security decision; human-led Boutique Audits are separate. ## How long does an Audit take? Varies with codebase size. Typical Audits complete in 15–120 minutes. You can monitor progress via the WebSocket URL or status polling endpoint. ## Can I use Firepan without connecting GitHub? Yes. The free Scan accepts a public `https://github.com/OWNER/REPO` URL directly via the API, subject to size, rate and capacity limits. GitHub App integration is needed for scan-on-push and PR comment features. ## Is my source code safe? Firepan processes source code in an isolated analysis environment. Source code is not shared with third parties. See the Privacy Policy at https://firepan.com/privacy-policy ## Can Firepan replace a manual audit? Firepan significantly reduces the cost and time of security reviews. However, for high-value protocols or regulatory requirements, consider combining Firepan with a boutique human audit. Contact sales at https://firepan.com/contact ## How do AI agents use Firepan? Agents can call Firepan directly. The free scan requires no auth. The wallet-native Agent API purchases public GitHub repositories with x402 v2; existing SaaS endpoints retain Bearer/JWT authentication. See https://firepan.com/SKILL.md for current instructions. ## How do I get support? - Email: support@firepan.com - Docs: https://docs.firepan.com - GitHub: https://github.com/firepan-labs --- -------------------------------------------------------------------------------- title: "Company Information" description: "About Firepan, Inc." last_updated: "2026-03-30" source: "https://firepan.com/about" -------------------------------------------------------------------------------- # About Firepan **Firepan, Inc.** is a Delaware C-corporation founded in 2025. The company builds AI-powered smart contract security infrastructure for Web3 protocols, DeFi applications, and blockchain developers. ## Contact - Website: https://firepan.com - App: https://app.firepan.com - Docs: https://docs.firepan.com - Support: support@firepan.com - GitHub: https://github.com/firepan-labs - Sales: https://firepan.com/contact ## Legal - Terms of Service: https://firepan.com/terms - Privacy Policy: https://firepan.com/privacy-policy Firepan provides AI-powered security analysis and monitoring services for smart contracts. Security assessments are point-in-time analyses and should be part of a comprehensive security program. Firepan does not guarantee the security of any analyzed contract. © 2026 Firepan, Inc. All rights reserved.