Getting started with Hi AUDIT
Hi AUDIT is a security tool that runs as an MCP server. Install it once, add it to your editor, and detectors plus CVE data stay current without local tooling updates.
Installation
Install the agent with a single command, then register it with your IDE. Cursor, Claude Code, and Windsurf are detected automatically.
$ curl -fsSL https://get.hiaudit.io | sh
$ hiauditagent mcp add
✓ Added hiauditagent to Cursor, Claude Code, and Windsurf configs.
Quick start
Open your repository in your IDE and ask for an audit in plain language. The agent picks the right tools and playbooks for your codebase.
> hiauditagent web2 analyze src/
> hiauditagent web2 taint src/api/
> hiauditagent analyze contracts/
> hiauditagent report
A typical first audit: map the architecture with overview, scan with analyze, triage with filter, then generate the report.
MCP tools
15 tools are exposed to your IDE. Six cover web codebases, and nine cover smart contracts.
Web
| web2_analyze | Static analysis for TS/JS, Python, Go, Rust, Java+ |
| web2_finding_details | Full context for a specific web2 finding |
| web2_detectors | List web2 detectors and rule categories |
| web2_taint | Track untrusted data from source to sink |
| web2_security | OWASP Top 10 posture scoring with CWE mapping |
| web2_errors | Error-handling and information-leak analysis |
Smart contracts
| analyze | Run static analysis across a Solidity codebase |
| finding_details | Full context and traces for a specific finding |
| detectors | List available detectors and their severity classes |
| related_functions | Functions reachable from a target function |
| contract_summary | High-level summary of a contract's behavior |
| storage_layout | Storage slot layout and upgrade-safety checks |
| access_control | Role and permission mapping across contracts |
| inheritance_graph | Contract inheritance and dependency graph |
| gas_report | Gas usage hotspots and optimization candidates |
Playbooks
23 skill playbooks encode senior-auditor workflows. Trigger them by name in chat, e.g. hiauditagent poc or hiauditagent web2 owasp.
Web
Smart contracts
Solana
Supported languages
Web analysis and taint tracking cover the major application languages, including legacy COBOL codebases. Smart-contract analysis covers Solidity and Solana (Anchor) programs.
Security & data handling
Analysis requests are processed by the Hi AUDIT service and are not used to train models. Findings and reports are stored in your workspace and can be deleted at any time. For questions or to report a vulnerability, contact security@hiaudit.io.