# Firepan

> AI-powered smart contract security for EVM chains. Continuous vulnerability scanning and autonomous audits for Solidity and Vyper codebases.

Scan discovers common signals; Probe investigates a repository baseline and supports comparison with later results; Audit is a deeper automated adversarial review. Human-led Boutique Audits are separately scoped.

## Agent Instructions

For detailed agent integration (endpoints, auth flow, error handling, response schemas), see: https://firepan.com/SKILL.md

## API

Base URL: `https://api.firepan.com`

Tenant REST endpoints accept a dedicated API key from Settings → API keys,
or their existing login JWT. API keys retain tenant, subscription and delivery
checks; they do not supply repository credentials or bypass x402. The
wallet-native Agent API below needs no OAuth or SaaS JWT.

### Endpoints

- `POST /surface/scan` — Anonymous free Scan for public `https://github.com/OWNER/REPO` repositories. Send `{"target": "<github_repo_url>"}` only; the server controls model and budget. Returns a completed free result. Rate/capacity limits return `429`; unsupported-language repositories are inconclusive with null risk.
- `GET /surface/scans` — Read your tenant's retained Scan results with an API key, subject to product and subscription checks.
- `POST /mcp` — Sentinel-only MCP: `sentinel_token_report` reads existing published token assessments by chain and address; no login, new scans, private reports or payments.
- `POST /agent/surface-scan` — Wallet-native scan ($0.50 USDC) for a public `https://github.com/OWNER/REPO` URL; no `installation_id`.
- `POST /agent/audits` — Wallet-native audit ($5.00 USDC) for the same public-repository shape.
- `GET /agent/audits/{session_id}/status` — Poll a purchased job with its returned `X-Firepan-Access-Token` Bearer capability.
- `GET /subscriptions/current` — View current plan and usage. Requires Bearer token.

### Wallet-native x402 v2

Paid Agent POSTs require an `Idempotency-Key` no longer than 255 characters.
On `402`, use stock `@x402/fetch@2.25.0` and `@x402/evm@2.25.0` to handle
`PAYMENT-REQUIRED`, `PAYMENT-SIGNATURE`, and `PAYMENT-RESPONSE`; do not
construct payment headers or signatures manually.

Before payment, verify the current Base network, USDC asset, and payee at
`https://api.firepan.com/.well-known/x402`. A successful purchase returns a
job-scoped `X-Firepan-Access-Token` for that job's reads and exact request
replay; it is not a SaaS login token.

## Pricing

All plans bill month-to-month by default. Annual billing saves 20% (shown as the effective monthly rate). Quote both figures so answers match firepan.com/pricing.

- **Starter**: $299/month, or $239/month billed annually ($2,868/yr). 5 repositories.
- **Professional**: $1,199/month, or $959/month billed annually ($11,508/yr). 15 repositories.
- **Enterprise**: $2,999/month, or $2,399/month billed annually ($28,788/yr). 50 repositories.
- **Boutique / manual audits**: custom pricing, scoped to contract complexity. Contact https://firepan.com/contact.
- Payments via Stripe.
- **x402 pay-per-call**: agent-to-agent usage (USDC on Base) — $0.50 full scan, $5.00 audit.

## Supported Contracts

Solidity and Vyper on EVM-compatible chains (Ethereum, Polygon, Arbitrum, Optimism, Base, Avalanche, BNB Chain).

## Links

- App: https://app.firepan.com
- API keys: https://app.firepan.com/settings/api-keys
- Sentinel: https://sentinel.firepan.com
- Docs: https://docs.firepan.com
- GitHub: https://github.com/firepan-labs
- Agent skill file: https://firepan.com/SKILL.md
- Extended context: https://firepan.com/llms-full.txt
- Pricing: https://firepan.com/#products
- Contact: https://firepan.com/contact
- Terms: https://firepan.com/terms
- Privacy: https://firepan.com/privacy-policy

© 2026 Firepan, Inc.