jevscan-evm

How we reviewed this: we ran it in Docker offline against a local stand-in — its endpoint is a constant with no override, so we patched that one line, then reverted and diffed. We made no Jev calls.

What it does

Every Solidity file goes out whole with 359 yes/no questions attached: two broad ones, fourteen categories, and 343 detectors. Anything over threshold is asked again per function, then per line, producing a heat map. The questions are real content — the access-control one, for instance, ends by excluding centralisation risk from a correctly-gated admin, which is the distinction that matters in practice.

The README’s own warning is worth quoting exactly, because it sets the terms:

Warning: this is a 100% vibe-coded proof of concept. I did not read one line of the code. Use at your own risk.

A scope list turns off the filters

By default it finds .sol files, skips the usual directories, and classifies each one. Set files.paths and none of that runs — the code checks only that each entry is a file. We ran it with paths = ["src/Vault.sol", ".env", "lib/vendored/Huge.sol"] and captured the request:

{"state": {"source": "TYPESAFE_API_KEY=sk-live-…\nDEPLOYER_PRIVATE_KEY=0xdeadbeef…\n"}}

The config comment does say the scope list bypasses everything, so this is documented rather than hidden. What isn’t documented is that the results file then records a classification nobody asked for: {"path": ".env", "kind": "source", "confidence": 1.0}. That 1.0 is a literal in the code, not an answer.

The risk here is specific: the documented use for files.paths is pasting an audit contest’s scope list, which is a human copy-paste into a tool with no extension check behind it.

What it costs

One request per file per question group, and the file is re-sent in each. Our two-file test run made 23 requests and 328,000 tokens; the scan stage alone was four requests per file. There is a request cache keyed on the whole request, which makes re-runs free, and that is more than most tools here manage — but there is no spend ceiling at all, and concurrency defaults to 64 while the documentation says 8.

It is not a gate. It produces a report, has no exit-code semantics, and aborts the whole scan on an unexpected status code.

Verdict

343 editable detectors is a real asset, and the cache plus the per-line second pass show someone thinking about cost and usability. The honesty of the warning is worth more than most READMEs’ claims.

Read the scope list twice before you run it, and treat the heat map as a place to look rather than a finding. 21 commits, one author, no CI, no release — clone it.

For scanning a codebase for malicious behaviour rather than bugs, see is-malicious.

See how it compares with other tools in Best Jev tools, tested hands-on.

Review updated Sep 20, 2026. Numbers quoted from the project are its author's own; we don't publish our own measurements of Jev.