Pentagonal runs a permanent red team — eight specialised attackers, each fluent in a single class of exploit. Reentrancy, flash loans, oracle manipulation, MEV, economic edge cases, arithmetic overflow, access control, and gas griefing. They hunt every line you ship. The report is what’s left after they fail.
Pentagonal scopes the contract with you, surfacing the decisions an attacker would later target — supply, fees, roles, upgradeability. Then it generates the code, referenced against OpenZeppelin v5 for Solidity and the Anchor framework for Solana, and hands it straight to the red team.
Plain English. No template form. The model handles the rest of the scoping conversation.
“ERC-4626 staking vault for our governance token with a seven-day unlock and a one-percent performance fee, paused by a timelocked admin.”Decisions that hide bugs are pulled to the front. You answer them once; they land in the contract and the audit report.
Production-grade code against the most current standards. Compilation is free; the audit runs on the same artefact you deploy.
// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;
import {ERC4626} from "@openzeppelin/contracts/token/ERC20/extensions/ERC4626.sol";
import {AccessControl} from "@openzeppelin/contracts/access/AccessControl.sol";
import {Pausable} from "@openzeppelin/contracts/utils/Pausable.sol";
contract SentinelVault is ERC4626, AccessControl, Pausable {
bytes32 public constant GUARDIAN = keccak256("GUARDIAN");
uint256 public constant UNLOCK = 7 days;
uint256 public constant PERF_BPS = 100; // 1.00%
mapping(address => uint256) public unlockAt;
/* … */
}Every generation goes straight to the red team. Findings come back inline; fixes and recompiles are free for the same contract.
Each attacker owns a single class of exploit. They run against the same contract independently, cross-confirm each other’s findings, and converge on a deduplicated report graded by exploit cost — not severity-by-vibes.
EVM contracts are reviewed against OpenZeppelin and Solady references. Solana programs are reviewed against the Anchor framework and SPL conventions. Same agents, different idioms.
Markdown by default, PDF on export. Each finding includes the exploit narrative, the offending code segment with line numbers, a severity graded by attack cost, and a remediation diff.
The module implements a single-asset staking vault with time-weighted rewards. The red team broke it in eleven places, three of them critical: a reentrancy vector in withdraw, a rounding asymmetry that lets an early depositor inflate share price via direct token donation, and a missing oracle staleness check in the reward-rate setter. A consolidated remediation patch is appended.
Findings, exploit narratives, and remediation diffs feed a persistent rule store. When a new attack surfaces in one audit, every subsequent contract is hit with it. The corpus grows monotonically — coverage cannot regress.
Pentagonal ships a native Model Context Protocol server for the IDE you’re already in, and an x402 endpoint so autonomous agents can pay per call in USDC — no account, no key management.
Drop the server into Claude Desktop, Cursor, Windsurf, Cline, or Continue. Calls pentagonal_audit against the contract in your open buffer. Stdio for desktop, HTTP for hosted clients.
// claude_desktop_config.json
{
"mcpServers": {
"pentagonal": {
"command": "npx",
"args": ["-y", "pentagonal-mcp"],
"env": { "PENTAGONAL_KEY": "your-api-key" }
}
}
}Autonomous agents hit the endpoint, get a 402, attach a USDC payment header, and retry. No signup, no API key rotation, no spend limits to engineer around. The Coinbase x402 protocol handles settlement on Base.
# Agent fetches → 402 Payment Required
$ curl https://pentagonal.ai/api/audit \
-H "Content-Type: application/json" \
-d @vault.json
HTTP/2 402
x-payment-amount: 5.00
x-payment-asset: USDC
x-payment-network: base
# Agent pays and retries
$ curl https://pentagonal.ai/api/audit \
-H "X-PAYMENT: <usdc-base-tx>" \
-d @vault.json
HTTP/2 200 → audit-report.mdGeneration and audit each cost five dollars. Compilation, fixes, and re-runs are free. Pay with crypto credits, or have an agent pay per call in USDC over x402.
Pentagonal is published to every major MCP registry and skill directory. Independent reviewers list it; agents discover it without a human in the loop.