BevorResearch preview

Harness your smart contract security

Bevor gives your AI agents and tools a graph of execution paths. Findings stay in context between runs, so reviews can reuse earlier work and spend fewer tokens.

Book a demo See how it works

How it works

See how your agents impact your security posture.

Bevor gives agents a map of your codebase and the history of previous reviews. Your team can follow their runs, inspect findings, and contribute analysis that informs the next review.

Following a change

Follow a change beyond the diff.

Bevor compares execution paths between versions so you can see what needs another review. It keeps findings linked to unchanged paths and automatically invalidates them when the vulnerable path no longer exists.

Solidity code graph581 nodes · 1600 connections indexed

Example change setVault()

src/core/ImprintProv.sol

The connected codebase, with setVault() selected. Recorded findings stay visible in red.

Changed functionFindingsCallsShared stateInheritance

Follow the change

Calls, shared state, and inheritance connect the edited function to other code that may need review.

Keep findings attached

Recorded findings stay linked to their code as you explore a change and its dependencies.

Reuse matching analysis

When code and dependencies match, Bevor can reuse prior analysis, reducing repeated input and token use.

CLI & dashboard

Keep the tools you trust.

Import findings from your agents and security tools, inspect them against the code, and work through the review with your team.

Product preview

~/my-protocolmain / 3f8a2c1

# Run your security tools
$ npx @openai/codex-security …
$ slither . --sarif slither.sarif

# Bring the reports into Bevor
$ bevor agent submit codex.sarif
$ bevor agent submit slither.sarif

2 reports imported · 3 findings staged

Ready for your team to review

Protocol teammy-protocol

security-review-codex-slither

main/3f8a2c1

3 findings · 3 staged

LendingPool.solSolidity

121contract LendingPool is Ownable {
122  uint256 public liquidationCapacity;
123  IERC20 public asset;
124 
125  function setLiquidationCapacity(
126    uint256 capacity
127  ) external {
128    liquidationCapacity = capacity;
129  }
130 
131  function rescueTokens(
132    address receiver, uint256 amount
133  ) external onlyOwner {
134    asset.transfer(receiver, amount);
135  }
136 
137  function setAsset(address next) external onlyOwner {
138    asset = IERC20(next);
139  }
140}

FINDING

1 / 3

src/lending/LendingPool.sol:125

Missing access control on setLiquidationCapacity

HighAccess controlStaged

Codex Security · codex.sarif

DESCRIPTION

This setter changes the liquidation limit without an access check. Confirm which accounts should be allowed to update this parameter.

REFERENCE

LendingPool.setLiquidationCapacity

RECOMMENDATION

Restrict the setter to the appropriate role and test that unauthorized calls revert.

Review candidate · Not yet validated

Illustrative workflow. Commands abbreviated.

Read the CLI docs

Who it is for

For the people securing smart contracts.

Security researchers

Build a case for each finding.

Use earlier findings and analysis to guide audits and bug bounty research, and keep the evidence behind each finding linked to the code.

Protocol teams

Security at every stage of your protocol.

Build security into development, prepare for formal audits, and deploy with confidence. Keep findings and review history current as you investigate issues and assess upgrades after launch.

Blockchain ecosystems

Help your ecosystem review its code.

Give projects access to Bevor so their teams can coordinate security work with the tools and auditors they already use.

Talk through your security workflow with us.

Book a walkthrough with the team, or start with the docs.

Book a demo Read the docs