Choose where prompts go
Your code stays on your PC and never leaves unless you choose. Prompts go only to the model endpoint you pick; with a local model nothing leaves the PC, with a cloud model file text is sent to that provider.
Product
Solidity Smart Contract Audit Agent
01
Keylatch is an autonomous agent for a solidity smart contract audit on your Windows PC. It reads your code, runs your tests, and records the findings it reports.
Runs your tools
It executes your scanner and shows the real exit code.
Shows diffs
Every edit appears as a diff you can accept or reject.
Features
- Filesread, write, edit, delete, and list files in your working folder.
- Shellruns your build and test commands with real exit codes.
- Websearches the web or reads one official documentation page.
- Screenshots and imagesreads text from screenshots or generates image files.
- Orchestrationruns parallel sub-agents or sends hard steps to bigger models.
- Approval modesAuto-run, Ask first, or Plan only for your control.
- Cronruns your prompts on a schedule without you watching.
- Modelsuse a cloud provider, a local model, or the built-in model.
How it works
The agent finds the files, reads the code, and runs your checks.
Review the contract for reentrancy and access control flaws.
- list_dir
.3 files - read_file
Token.solread 120 lines - grep
external call5 matches - Shell
your test commandexit 0 - write_file
findings-log.txtsaved
waiting for your OK before the next stepRejectAccept
Walkthroughs
Find flaws
Keylatch uses list_dir and glob to find your contract files, and it uses read_file to read the code so you can review it safely. grep finds every external call and access check across the project directory structure. write_file and edit_file show the diff in Ask first before you accept. Shell runs your own test command and your static-check command on your PC. web_search reads the official Solidity documentation to verify the latest standards. This solidity smart contract audit uses ocr to read a table from a screenshot. Filter ai false positives in audits is handled by manual confirmation.
Run tests
The agent uses grep to find every external call and state change across the project, so it knows exactly where to look for issues and review the plan. Review the plan. It uses read_file to read a contract and list_dir to find the files. The smart contract audit example shows how write_file and edit_file write findings notes. You review the plan in Plan only before running anything. Shell runs your test command and saves the output to a text file. web_search and http_get read the official Solidity documentation for reference. The smart contract audit next step is to confirm findings with a local test.
What Keylatch does not do
Keylatch is not a hosted service or plugin; it is meant only for your own files, PC and servers you are authorised to use — you keep the work within them. The agent does not enforce scope; Shell, web and SSH are not folder-bound. There is no guarantee that code, scans or analysis are correct. The agent can report false positives, so a person confirms or dismisses each finding. Moving beyond static analysis in audit workflow requires careful verification.
