// YOUR CODE. UNDER CROSS-EXAMINATION.
Find the flaw.
Hear the defense.
Bring the evidence.
Security review for Solidity, Rust, C/C++ and backend code.
Small agents scout. Independent agents argue.
Every conclusion leaves a paper trail.
⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⠀⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⣠⣾⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⢠⣾⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⢿⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠈⠻⣿⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠈⠻⣿⣿⣿⣿⣿⣧⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠸⣦⣈⠙⠿⣿⣿⣿⣷⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⣿⣿⡇⠀⠈⢻⣿⣿⣿⣦⡀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⢻⣿⠀⠀⠀⠀⠻⣿⣿⣿⣿⣶⣤⣤⣤⣤⣄⠀⠀⠀⠀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣦⣄⡀⠀⠀⠀⠀⠀ ⠀⠀⠀⠀⢸⣿⠀⠀⠀⠀⠀⠈⢿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣶⣤⡄⠀ ⠀⠀⠀⠀⠀⣿⠀⠀⠀⠀⠀⠀⠀⠈⣉⡉⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠛⠃⠀ ⠀⠀⠀⠀⠀⠉⠀⠀⠀⠀⠀⠀⠀⠀⠈⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠉⠁⠀⠀ ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
[ 01 / THE IDEA ]
Make the audit about the hard questions.
Prepare reviewed code, documented design decisions, tests, and a record of what needs attention. Give auditors the evidence and context to investigate potential issues.
Findings are hypotheses for human review. Detection quality and audit savings have not yet been established through independent evaluation.
[ 02 / THE REVIEW LOOP ]
No finding gets a free pass.
Solidity reviews also examine incentives, capital costs, MEV, liquidation and governance. A mechanism can work exactly as written and still put its participants at risk. [ economic review ]
SCOUT
Cover every included file.
Follow callers and state.
Use inexpensive models.
DEBATE
Independent challenge.
Independent defense.
Then a rebuttal.
ASSESS
Check the evidence.
Check the intended design.
Use a stronger reviewer.
DECIDE
[+] log for review
[-] ignore with a reason
[!] write a test
[ 03 / BUILT TO KEEP GOING ]
Close the terminal.
Keep the investigation.
SQLite checkpoints retain completed work. Resume a session after a crash, with the source snapshot checked before the next agent starts.
Run tests locally, or on a disposable EC2 instance. Keep generated tests, review arguments, JSON reports and SARIF together.
# illustrative session $ katarina start --tui ./protocol K A T A R I N A ----------------------------------- scout src/Vault.sol done challenger access boundary done defender caller model done judge regression test next state .katarina/state.db evidence report.json handoff report.md ^C to pause. Resume when ready.
[ 04 / DOWNLOAD + RUN ]
A terminal. A repository. Your keys.
Download the pi-linked executable. Go, Rust and a database server are not needed to run it. Optional analyzers and project test tools are installed separately.
[ download Linux x86_64 ]
[ source archive ] / [ SHA-256 checksums ] / [ installation guide ]
0.1.0-preview.1 / unsigned development preview / Linux x86_64 with glibc 2.35 or newer. Native macOS downloads are not included in this preview. [ macOS installation + security ]
# verify and extract the download first; see the installation guide ./katarina version ./katarina init # set your API key in the environment or a private credentials file ./katarina doctor ./katarina start --tui ./your-project
Prefer to compile it? The source archive includes locked dependencies and build instructions.
OPENROUTER / CLAUDE / OPENAI / DEEPSEEK / OPENAI-COMPATIBLE
Use environment variables or a private credentials file. Pick a provider and model for each agent role. The TUI is opt-in.
OPTIONAL / DISPOSABLE AWS TEST HOSTS
[ download stack YAML ] / [ launch AWS stack ] / [ AWS setup guide ]
Open the prefilled stack in Asia Pacific (Seoul), supply the existing IAM principal and review the permissions. Configure credentials and a prepared test AMI separately. Local analysis does not need AWS.
[ 05 / THE MANUAL ]
Know what is running.
START + CONFIGURE
[ getting started ]
[ product specification ]
[ configuration ]
Scope, providers, models and budgets.
REVIEW + RESUME
[ architecture ]
[ behavior + definitions ]
[ knowledge + evidence ]
[ reports + recovery ]
Components, requirements and evidence.
TEST + SHIP
[ running tests ]
[ AWS infrastructure ]
Local tests and disposable infrastructure.
[+] Quick reference
katarina init write an example configuration katarina doctor check providers and tools katarina index ./project inspect file coverage katarina start ./project start a review katarina sessions --state ./project/.katarina katarina resume --state ./project/.katarina SESSION katarina report --state ./project/.katarina SESSION katarina aws template write the CloudFormation YAML
Use the resume command printed at startup to retain the selected configuration and limits.