Most things an agent can't do, it can't do because it lacks data. Verifying a smart contract is different: it can't do it because it lacks judgment over live state. Reading the source isn't the hard part — an agent can fetch and parse Solidity fine. The hard part is knowing whether that external call is a reentrancy vector, whether that onlyOwner check actually guards the funds, whether the math can overflow. Those are exactly the checks a developer wants a second opinion on before money moves.
This is the one coding vertical where verification is attribution: a finding is only worth something if it reproduces. That is why it suits a pay-per-call API. You don't want a subscription to an auditor you use twice a month; you want a deterministic check you can run every time you touch a new contract, priced per run.
minia2a-audit is that check, packaged for agents. Two tiers, both pay-per-call, both settled in USDC on Base through x402. No API key, no subscription, no KYC — you bring a wallet.
auditStatic | auditAI | |
|---|---|---|
| Price | $2 / call | $20 / call |
| What it is | Deterministic static scan | AI deep audit |
| Coverage | 10 patterns: reentrancy, access-control, integer overflow, unvalidated call, tx.origin, delegatecall, selfdestruct, block.timestamp, assert misuse, owner-change | Business-logic, economic, and cross-contract flaws (owner-uninitialized, account-confusion, signer-auth) |
| Sampling | — | 3× sampled, deduplicated, best result |
| Languages | Solidity | Solidity, Rust (Solana), Move |
| Best for | Fast pre-check on known patterns | New or small contracts needing a suspicious-points list |
The two tiers form a funnel rather than a menu. Run the $2 scan first; it is deterministic and catches the mechanical, well-understood bugs instantly. If it comes back clean but you still don't trust the contract — or it flags something and you want the business-logic layer examined — escalate to the $20 AI pass. That pass samples three times and deduplicates, so you get a suspicious-points list rather than a single maybe.
npm install minia2a-audit
From the CLI, point it at a source file:
# $2 static scan
minia2a-audit static ./contract.sol
# $20 AI deep audit
minia2a-audit ai ./contract.sol --language solidity
minia2a-audit ai ./program.rs --language rust
From inside an agent, use the library the same way:
import { createAuditClient } from "minia2a-audit";
const audit = createAuditClient(process.env.MINIA2A_PRIVATE_KEY);
// $2 static scan over 10 patterns
const r1 = await audit.auditStatic(sourceCode);
// $20 AI deep audit (rust for Solana)
const r2 = await audit.auditAI(sourceCode, { language: "rust" });
The call returns { ok: true, findings: [...], risk: "high" } on success, or { ok: false, status, error }. That is the whole surface: two methods, one structured result. An agent can act on findings and risk without parsing prose.
The design constraint that matters for an autonomous agent: the private key stays local. You set MINIA2A_PRIVATE_KEY in the agent's environment. When it makes a call, the library signs an exact-permit2 payment in USDC on Base locally, sends the signed authorization, and the facilitator settles it. The key is never transmitted to the marketplace — it is used to sign the payment, not to authenticate against a server.
That is the difference between this and a keyed API. A keyed API ties you to one account and one vendor and has to be provisioned by a human. A wallet-based flow lets the agent own its own budget: it pays per call out of an address it controls, and the payment itself is the credential. There is no account to create, which is what makes it usable from an unattended agent.
The honest limit. The AI audit is probabilistic. It may miss a vulnerability or flag a non-issue. The static scan is deterministic but only covers the patterns it knows. Neither is a substitute for a professional audit of a contract holding real value. The right mental model is: the $2 scan decides whether a contract is worth a closer look, and the $20 pass produces the list of suspicious points a human then reviews.
The concrete pattern is a pre-check gate. Before an agent interacts with a contract — deposits into a vault, approves a spender, signs a transaction that moves funds — it runs the $2 static scan. If the scan returns a high-risk finding like reentrancy or an unvalidated external call, the agent stops and escalates rather than proceeding blind. The scan costs two dollars and takes a deterministic amount of time; the transaction it is gating can cost a lot more than that if the contract is wrong.
This is the direction the audit service is aimed at: the cost of a bad answer is high, and self-verification is almost as expensive as the audit itself. You can't cheaply check whether your auditor is right — so you want the audit to be cheap, reproducible, and structured enough that the agent can act on the output without a human in the loop.
If you are building an agent that touches contracts, try the $2 scan on a contract you already reviewed by hand and compare its findings to yours. That comparison tells you more about whether the tool fits your workflow than any benchmark number.
Full details: minia2a-audit on npm.