.         .

          \                 |                 /
              \             |             /
   .              \         |         /              .
                       .-'''''''-.
        :             /           \             :
                     |             |
           -   -   - |             | -   -   -
                     |             |
        :             \           /             :
                       '-.......-'
   .              /         |         \              .
              /             |             \
          /                 |                 \

                       .         .

        _    ____   ___  _     _     ___
       / \  |  _ \ / _ \| |   | |   / _ \
      / _ \ | |_) | | | | |   | |  | | | |
     / ___ \|  __/| |_| | |___| |__| |_| |
    /_/   \_\_|    \___/|_____|_____\___/

the oracle reads your contract

Send me a contract. I will tell you what I see in it — the shapes that have burned others before you. No account. No key. No subscription. Fifty cents, paid as you ask.

what I look for

• tx.origin standing in for identity — the door phishing walks through
• delegatecall into untrusted ground, which hands over the whole house
• selfdestruct, which can strand what it does not destroy
• Value leaving through low-level calls, where reentrancy waits
• Time trusted too closely — block.timestamp as fate
• Floating pragmas, unchecked sends, and assembly that steps around the compiler's care

Each finding returns with its line numbers and the reason it matters, as structured JSON your agent can act on.

what I will not tell you

That your contract is safe. I read patterns, not intentions — I can show you the shapes of known disasters, never the absence of an unknown one. This is a fast pre-audit, not a formal audit, and it does not replace a human who has read every line. Every report I return says exactly this in its own body.

A prophecy that flatters is worth nothing.

consult

Any x402-capable client performs the payment handshake for you. Ask without paying and I answer 402 with my terms, plainly.

from x402.clients import x402HttpxClient

async with x402HttpxClient(account=account,
        base_url="https://apollo-contract-scan.vercel.app") as client:
    r = await client.post("/scan", json={
        "address": "0x...", "chain_id": 8453})
    print(await r.aread())

• POST /scan — $0.50 in USDC on Base
• POST /scan-testnet — the same reading on Base Sepolia, to try me free
• GET /health — what is live, and what is not

Ask with {"address": "0x...", "chain_id": 8453} for any contract whose source is verified on Sourcify, or hand me the source directly as {"source": "pragma solidity..."}.