Audit

Peregrine is built for autonomy. You can launch an audit for a target smart contract and let it run the entire flow on its own—from planning the strategy, through analysis by the orchestrator and specialist agents, to producing the final report. Or you can steer it by reviewing its plan, guiding its focus, approving stages, pausing execution, or directing specific work.

Starting an audit

Tell Peregrine the target smart contract. You can either:

• Let it proceed autonomously. Peregrine plans the audit internally, executes the full workflow using its orchestrator and specialists, gathers evidence, and generates the report with no further input from you.
• Steer the process. Peregrine proposes a plan for your review. You examine the strategy, adjust as needed, and approve it before execution starts. During the run you can pause, resume, or provide additional direction.

In either case an orchestrator manages the overall flow. It brings in specialist agents at the right moments and incorporates their results.

Pause the audit, resume it later, list your audits, and view reports at any time through your client. The state persists so you never lose progress.

In the TUI you use slash commands to perform these actions. Other clients expose the same capabilities through their own interface.

Audit workspaces

Peregrine keeps every audit in its own isolated workspace. The workspace stores:

• A read-only snapshot of your original target code.
• Agent conclusions and other intermediate results.
• Structured evidence for any vulnerabilities that surface.
• Execution traces and replay logs.
• The final report in both human-readable and machine-readable formats.

Your source repository stays completely untouched.

Specialist agents

Peregrine never relies on a single view. An orchestrator coordinates several specialist agents that examine the contract from different angles:

• Researcher maps the attack surface, finds entry points, and forms initial hypotheses.
• Exploiter turns hypotheses into tests, runs targeted fuzzing, and builds proof-of-concept exploits.
• Skeptic reviews the work of the other agents and hunts for flaws in their reasoning or evidence.
• Judge examines the collected evidence and decides whether each candidate finding is valid.

Benefit from this separation of concerns because every finding receives multiple rounds of scrutiny before it reaches your report.

How findings become part of the report

Peregrine only accepts a finding after it passes several independent checks. Model suggestions alone are never enough.

A candidate moves into the final report only when:

1. It references concrete evidence files kept in the audit workspace.
2. At least two different verification methods outside the model confirm the issue.
3. A reproducible trace or adapter replay exists.
4. The Judge agent reviews the full evidence and states publicly that the finding is valid.

When a required tool or analysis capability is not available, Peregrine records a coverage gap in the report instead of guessing. You always see exactly what was tested and what was not.