$3.2B+ lost to smart contract exploits in 2024 alone.   See how Garrison would have caught them →
 v3.0.0 Production/Stable  ·  Free + Pro  ·  MIT Core Licensed

The Security Platform
Smart Contracts Deserve

Enterprise-grade smart contract security with 21+ analyzers, protocol signatures, and air-gapped deployment. Garrison delivers professional-grade smart contract audits in minutes — not months.

Launch Garrison View Live Demo Get Pro License View on GitHub
21+ Analyzers
638+ Tests Passing CI
--suppress Configurable Suppression
EVM + Solana (50+ networks)
23 EVM Heuristic Rules
4 Output Formats
The Stakes

The DeFi Security Crisis Is Real

Attackers are getting faster. Manual audits are expensive and slow. Fragmented tools miss cross-contract attack vectors. Something had to change.

$3.2B+
Lost to smart contract exploits in 2024
$625M
Ronin Bridge (2022)
$320M
Wormhole (2022)
$197M
Euler Finance (2023)
$60M
Curve Finance (2023)
Recent Exploits
Reentrancy · $11M · Rari Capital
Flash Loan · $182M · Beanstalk
Access Control · $80M · Fei Protocol
Oracle Manipulation · $116M · Mango Markets
Integer Overflow · $7M · Compound
Signature Replay · $20M · Wintermute
Reentrancy · $11M · Rari Capital
Flash Loan · $182M · Beanstalk
Access Control · $80M · Fei Protocol
Oracle Manipulation · $116M · Mango Markets

Fragmented Tooling

Teams run Slither, then Mythril, then Aderyn — each with different output formats, different false positive rates, and no unified view of risk.

Manual Audits Take Weeks

A professional audit costs $30K–$100K and takes 2–6 weeks. Most teams can't afford that cadence for every deployment or upgrade.

Cross-Contract Blindspots

Most tools analyze contracts in isolation. Real exploits span multiple contracts — flash loans, reentrancy chains, oracle manipulation across protocols.

Simple by Design

How Garrison Works

From installation to client-ready report in under 5 minutes. No configuration hell. No fragmented output.

01

Point at Your Contracts

One CLI command targets your contract directory. Garrison auto-detects EVM Solidity or Solana Rust/Anchor and loads the appropriate analyzer stack.

$ garrison scan ./contracts
[✓] EVM detected — 4 contracts
02

21 Analyzers, Orchestrated

Static analysis, AI-powered pattern matching, fuzzing, symbolic execution, and cross-chain attack path mapping all execute concurrently — no sequential waiting.

[*] Running 21 analyzers...
[!] CRITICAL: Flash loan reentrancy
[!] HIGH: Oracle staleness ×4
03

Get Client-Ready Reports

Receive a full HTML report, interactive D3.js attack graph, Markdown summary, and SARIF output for CI/CD — all in one run. No post-processing needed.

[✓] HTML report generated
[✓] Attack graph ready
[✓] SARIF exported
See a Full Audit Run →
Quick Start

Up and Running in 5 Minutes

Install, configure, and run your first audit with a single command. No Docker. No cloud account required.

PyPI v3.0.0 — pip install garrison-security --upgrade Status: Production/Stable Python 3.9 | 3.10 | 3.11 | 3.12 MIT License Released: Apr 19, 2026
bash — garrison-engine
$ pip install garrison-security --upgrade
Successfully installed garrison-security-3.0.0

# Activate Pro features (optional)
$ export GARRISON_PRO_LICENSE=your-key-here

$ garrison scan ./contracts --config garrison-audit.toml --report --project-name "MyDeFi"

[*] Initializing Garrison v3.0.0
[*] Loading analyzers (Free + Pro)...
[✓] Heuristic Scanner — 23 EVM rules loaded
[✓] Slither — Trail of Bits analyzer ready
[✓] Aderyn — cyfrin analyzer ready
[✓] Medusa Fuzzer — corpus initialized
[✓] AI Audit Copilot — RAG knowledge base loaded [PRO]
[✓] Attack Path Visualizer — D3.js engine ready [PRO]
[✓] Threat Intelligence — 10,000+ findings indexed
[*] Scanning ./contracts (4 files, 1,247 lines)...
[!] CRITICAL: Flash loan reentrancy — VulnerableVault.sol:240
[!] CRITICAL: Oracle staleness check — VulnerableVault.sol:22
[!] HIGH: Signature replay attack — VulnerableVault.sol:234
[!] MEDIUM: Centralization risk — VulnerableVault.sol:255
[✓] Generating HTML report with attack graph...
[✓] Exporting SARIF for CI/CD integration...
[✓] Report saved: audit_report_2026-04-19.html

✓ Audit complete. 42 findings (11 Critical, 16 High, 13 Medium). Report ready.

# Pro outputs (HTML report + SARIF) require GARRISON_PRO_LICENSE
# Free outputs: Markdown + JSON always available
7 Innovative Features

Capabilities No Other Tool Offers

From AI-powered copilots to cross-chain attack visualization — built by auditors who were frustrated with what existed.

AI-Powered Audit Copilot

RAG-based knowledge retrieval with LLM integration surfaces real-time vulnerability context, historical exploit patterns from Code4rena and Immunefi, and concrete remediation guidance — during the audit, not after.

Highest Impact RAG + LLM

Cross-Chain Attack Path Visualizer

Interactive D3.js force-directed graphs map multi-contract attack vectors across EVM and Solana, revealing flash loan chains, reentrancy paths, and oracle manipulation routes that single-contract tools miss entirely.

D3.js Interactive

Time-Travel Historical Scanner

Git-based temporal vulnerability tracking detects exactly when a vulnerability was introduced, which commit added it, and whether it's a regression from a previously patched issue. Audit the history, not just the snapshot.

Novel

Anchor IDL Security Validator

The first tool to perform deep Solana IDL constraint and CPI flow analysis. Validates account constraints, detects missing signer checks, and maps cross-program invocation risks — a blindspot for every other EVM-focused tool.

First-Mover Solana Native

CI/CD Pipeline Generator

Auto-generates ready-to-commit GitHub Actions, GitLab CI, and CircleCI configurations with customizable severity thresholds, PR blocking rules, and Slack/Discord alert webhooks. Security in every merge, zero setup time.

Automation

Exploit PoC Auto-Generator

Automatically generates working Foundry test cases that demonstrate detected vulnerabilities as actual exploits. One-click reproduction for bug bounty submissions, client reports, and developer education — no manual PoC writing.

Unique

Protocol Fingerprint Scanner

Compares codebases against a curated database of known-vulnerable patterns and forked protocols to identify "genetic" vulnerabilities inherited from upstream code — because most DeFi protocols fork, and most forks inherit the bugs.

Intelligence
Deep Dive Into All Features
Honest Comparison

Garrison vs The Alternatives

We built what we wished existed. Here's how it stacks up against the tools auditors actually use.

Capability Garrison Slither Semgrep Aderyn Manual Audit
Static Analysis (EVM) ✓ ✓ ✓ ✓ ✓
Solana / Anchor Support ✓ ✗ ✗ ✗ ✓
AI-Powered Copilot (RAG) ✓ ✗ ✗ ✗ ✗
Cross-Contract Attack Graph ✓ ✗ Partial ✗ ✓
Exploit PoC Generation ✓ ✗ ✗ ✗ Manual
CI/CD Pipeline Generator ✓ Manual Partial Manual ✗
Time-Travel Git Scanner ✓ ✗ ✗ ✗ ✗
Fuzzing Integration ✓ ✗ ✓ ✗ Manual
HTML + SARIF + MD Reports ✓ JSON only JSON/HTML MD only Manual
Open Source (MIT) ✓ ✓ ✗ ✓ —
Cost Free + from $49/mo Free $49–$499/mo Free $30K–$100K
Full Coverage

21 Integrated Analyzers

Every major security analysis technique unified in one platform. No tool-switching. No format translation. No gaps.

01
Heuristic Scanner
23 EVM heuristic rules targeting the most exploited vulnerability classes in DeFi history.
Static
02
Slither
Trail of Bits' industry-standard static analyzer. Detects reentrancy, access control, and arithmetic issues.
Static
03
Aderyn
Cyfrin's Rust-based analyzer with a focus on low false positives and actionable output.
Static
04
Liar Detector
Identifies misleading comments, incorrect NatSpec, and documentation that contradicts code behavior.
Static
05
Access Matrix
Builds a full permission graph — who can call what, under what conditions, with what effects.
Static
06
Upgrade Diff
Compares proxy upgrade implementations for storage collisions, function selector clashes, and initialization gaps.
Static
07
Solana Analyzer
Native Rust/Anchor analysis for Solana programs — account validation, PDA derivation, and CPI security.
Solana
08
Medusa Fuzzer
Property-based fuzzing that generates adversarial inputs to break invariants and trigger edge cases.
Fuzzing
09
Foundry Tests
Runs existing Foundry test suites and generates new targeted tests for detected vulnerability patterns.
Testing
10
Mythril
Symbolic execution engine that explores all reachable code paths to find hidden execution vulnerabilities.
Symbolic
11
Supply Chain
Audits imported libraries and dependencies for known vulnerabilities, outdated versions, and malicious patterns.
Static
12
Threat Intel
Queries live threat intelligence feeds and cross-references findings against known exploit databases.
Intel
13
Knowledge Fetcher
Retrieves relevant audit findings from Code4rena, Immunefi, and Solodit to contextualize each detected issue.
RAG
14
Inflation Scaffold
Detects ERC-4626 vault inflation attacks, share price manipulation, and first-depositor exploit vectors.
DeFi
15
AI Audit Copilot
LLM-powered assistant that provides natural language explanations, severity assessments, and remediation code.
AI
16
Attack Path Visualizer
Builds interactive D3.js graphs of multi-contract attack chains, flash loan paths, and exploit sequences.
Novel
17
Time-Travel Scanner
Git-based temporal analysis that tracks when vulnerabilities were introduced and identifies security regressions.
Novel
18
Anchor IDL Validator
First-mover Solana IDL constraint analysis — validates account constraints and maps CPI security risks.
Solana
19
CI/CD Generator
Auto-generates GitHub Actions, GitLab CI, and CircleCI security pipeline configs with severity thresholds.
Novel
20
Exploit Generator
Generates working Foundry PoC test cases that demonstrate detected vulnerabilities as actual exploits.
Novel
21
Fingerprint Scanner
Identifies forked protocol lineage and inherited vulnerabilities from upstream codebases in the vulnerability database.
Intel
Deliverables

Four Output Formats, One Command

Whether you're filing a bug bounty, briefing a client, or blocking a CI/CD pipeline — Garrison has the format you need.

HTML Report

Full interactive audit report with collapsible findings, severity badges, code snippets with line highlights, and risk score visualization. Client-ready, no formatting required.

View example →

Attack Graph

D3.js force-directed graph visualizing vulnerability relationships, call chains, and multi-contract attack paths. Filterable by severity, node type, and contract.

View example →

Markdown Report

Plain Markdown for GitHub PRs, wikis, and documentation systems. Human-readable, version-control friendly, and compatible with every Markdown renderer.

Download example →

SARIF (CI/CD)

Static Analysis Results Interchange Format — integrates natively with GitHub Code Scanning, VS Code, and any SARIF-compatible pipeline. Block merges on critical findings.

Download example →
Open Source & Transparent

Built in the Open, Trusted by Auditors

Security tools must be transparent. Garrison is MIT licensed, fully open source, and actively maintained.

GitHub Repository

RunTimeAdmin/garrison-engine

Full source code, issue tracker, and contribution guidelines. Inspect every analyzer, every detection pattern, every line of the AI integration.

View on GitHub →

638+ Tests Passing CI

Comprehensive test suite — CI on every commit

Every analyzer, every detection pattern, and every output format is covered by automated tests. CI runs on every commit. No regressions ship.

View Test Coverage →

MIT Licensed

Use it, fork it, build on it

No vendor lock-in. No usage restrictions. Use Garrison in commercial audits, integrate it into your own tools, or build a business on top of it.

View License →
MIT Licensed
638+ Tests Passing
Actively Maintained
EVM + Solana
GUI + CLI
CI/CD Ready
Get Started Today

Ready to Audit Your Smart Contracts?

Garrison is free, open source, and installs in one command. Run your first audit in under 5 minutes — no account, no cloud, no credit card.

Launch Garrison Read the Docs View Live Demo
Cloud App — Live Now

Garrison Cloud is Live

Web UI, team collaboration, scheduled scans, and API access — no local install required.

Launch App Get Pro License