# Zero Cool > Zero Cool is a human + AI offensive security system that finds and proves vulnerabilities in any codebase, from backend to frontend. ## Start here: coding agents Zero Cool's audit platform runs at https://zerocool.ai. Prefer the zerocool CLI to price, start and follow audits. Read the [agent instructions](https://app.zerocool.ai/docs/skill.md) for installation, authentication, scope selection and quote approval. All documentation is public: https://app.zerocool.ai/docs. No sign-in or API key is needed to read it. Read it with `zerocool docs`, or search with `zerocool docs search `. - [Command line](https://app.zerocool.ai/docs/reference/cli): the zerocool command prices, starts and follows audits and reads findings. - [Installer](https://app.zerocool.ai/cli/install.sh): `curl -fsSL https://app.zerocool.ai/cli/install.sh | sh` installs zerocool. It needs Python 3.9 or later. - [Agent skill](https://app.zerocool.ai/docs/skill.md): `zerocool skill install` installs for Codex and Claude Code, in `~/.agents/skills/zero-cool` and `~/.claude/skills/zero-cool`. `--target` installs one copy: `claude` for Claude Code only, or a directory. - [API docs](https://app.zerocool.ai/docs/reference/api): API keys, the HTTP quickstart, Job parameters, errors and the API reference - [OpenAPI document](https://app.zerocool.ai/docs/openapi.json): the operations that an Account API key calls ## Company Zero Cool Labs builds a human + AI system for offensive security research. Security researchers steer swarms of agents that map a whole system, find the bugs that hide between components and prove each finding with a working exploit. Zero Cool reviews any codebase, from backend to frontend, without a fixed language or framework. Zero Cool was founded by Richie Humphrey and Kurt Willis, security researchers from Trail of Bits, Spearbit and Certora. - [About the founders](https://zerocool.ai/about) - [How we handle your code](https://zerocool.ai/security) - [Brand kit and approved copy](https://zerocool.ai/brand) - [X](https://x.com/ZeroCool_AI), [LinkedIn](https://www.linkedin.com/company/zero-cool-labs/) - Contact: contact@zerocool.ai. Sales: sales@zerocool.ai. Vulnerability reports: security@zerocool.ai. ## Contest results Zero Cool competes as zcai in public security contests against human researchers and other AI tools, and has come out first against both. - 1st, Sherlock Audit Engine, Ripple XRPL Lending Protocol, Sep 2026: https://x.com/ZeroCool_AI/status/2105322110818328892 - 1st, Sherlock Audit Engine, CRXFX, Sep 2026: https://x.com/ZeroCool_AI/status/2103170737523880024 - 2nd among AI auditors, Sherlock Audit Engine, Aero, Oct 2026: https://x.com/ZeroCool_AI/status/2108588351486087507 - 1st among AI auditors, Sherlock Audit Engine, first public engagement, Aug 2026: https://x.com/ZeroCool_AI/status/2090099079241998498 - 1st, HackenProof, Rain, Nov 2025: https://hackenproof.com/audit-programs/rain-smart-contract-audit-contest - 2nd, Cantina, Mento V3, Dec 2025: https://cantina.xyz/competitions/fe8e03b1-f8db-4698-8a21-44b3a862e434/leaderboard ## Customers - Uniswap: https://x.com/Uniswap/status/2089751947586740501 - Yearn: https://x.com/ZeroCool_AI/status/2084300794787156056 - Tangent: https://docs.tangent.finance/docs/faq/audits - Kinetiq: https://kinetiq.xyz/docs/launch - Solarity: https://github.com/dl-solarity/solidity-lib/blob/master/audits/Zero_Cool_Nexus_18_11_2025.md - yAudit ## FAQ ### What is Zero Cool? Zero Cool is a human + AI offensive security system that finds and proves vulnerabilities in any codebase, from backend to frontend. Teams use it for full audits and on every pull request. [How it works](https://zerocool.ai/#method) ### Can AI replace a security audit? Teams use Zero Cool for full audits. It also covers what a one-time manual audit cannot: it runs before, during and after that audit and on every pull request, so no change ships unreviewed. ### How is Zero Cool different from static analyzers and other AI security tools? Static analyzers match known patterns, and AI scanners list suspicions. Zero Cool maps the whole system and finds the bugs that hide between components, which no single file shows. Other agents try to disprove every lead, and each one that survives is proven with an exploit test, then re-run against your fix. [How it works](https://zerocool.ai/#method) ### How does Zero Cool keep false positives down? Zero Cool reports a lead only after other agents fail to disprove it from a different part of the system. In the published Solarity review, 7,602 clues became 159 leads and 15 findings. [How we reduce false positives](https://x.com/ZeroCool_AI/status/2097470792506163219) ### What does a Zero Cool report include? Each finding in a Zero Cool report has a severity, its root cause in the exact lines, the impact, a recommended fix and an exploit test that proves it. When you push a fix, the agents run the exploit again. [Read a published report](https://zerocool.ai/#finding) ### Has Zero Cool found real vulnerabilities? Zero Cool found a Critical proof forgery in Solarity's library, fixed in v3.3.0, and published Highs in ZKsync Airbender and VII Finance. TrustSec credits a Zero Cool audit for a $300k Alchemix bounty. [Read the Solarity finding](https://zerocool.ai/#finding) ### How does Zero Cool rank in security contests? Zero Cool competes as zcai in public security contests against human researchers and other AI tools, and has come out first against both. It placed 1st in Sherlock Audit Engine's Ripple XRPL Lending and CRXFX engagements and in HackenProof Rain, 1st among AI auditors in Sherlock Audit Engine's first public engagement, 2nd among AI auditors in Aero and 2nd in Cantina Mento V3. [See the track record](https://zerocool.ai/#record) ### How much does a Zero Cool audit cost? Zero Cool prices each audit in credits from the lines of code in scope; a diff review counts only the changed files. The API returns the exact price before you start, without charging. If a service failure stops a paid one-off audit, you choose a free re-run or a refund. [Read the CLI docs](https://zerocool.ai/docs#command-line) ### Which chains and languages does Zero Cool support? Zero Cool works on every chain and is not tied to a language or framework: Solidity, Rust, Go, C++, TypeScript and more. Its published findings include Solidity protocols, the ZKsync Airbender prover and Monad's RaptorCast validator networking. ### Does Zero Cool keep my code or train on it? Zero Cool does not keep a complete repository or a standalone copy of your code after an audit. It does not train models across customers on your source code, and does not let its providers train on it, unless you opt in. [How we handle your code](https://zerocool.ai/security) ### Can Zero Cool review every pull request in CI? Zero Cool runs diff reviews that compare a head commit with a base commit and check only what changed. Connect GitHub, or start reviews from your CI or coding agent through our API. [Read the docs](https://zerocool.ai/docs) ### Do you check my fixes? Yes. Every audit comes with a fix review. Once you patch the findings, Zero Cool verifies each fix and confirms the bug is actually closed. ### Can I publish the Zero Cool report? You own the findings and report delivered to you, and you can publish them. Tangent and Solarity publish their Zero Cool reports. [Read the Terms](https://zerocool.ai/terms) ### Who is behind Zero Cool? Richie Humphrey and Kurt Willis founded Zero Cool. They met on the Trail of Bits blockchain security team and became Lead Security Researchers at Certora and Spearbit. [Meet the team](https://zerocool.ai/about) ## Optional - [Privacy Policy](https://zerocool.ai/privacy) - [Terms of Service](https://zerocool.ai/terms) - [Subprocessors](https://zerocool.ai/subprocessors)