Introduction

Trilocore is a smart-contract security platform with two working surfaces: an Auditing IDE for proving what a deployed contract actually does, and a Contract IDE for writing, compiling and reviewing the code before it ships. Both live in one application at app.trilocore.ai, and both are driven by one public API at api.trilocore.ai.

The work is done against a fork — a private copy of a real chain, pinned to a block. You can send transactions, rewrite storage, and replay a sequence as many times as you like; nothing you do touches the live chain.

• Quickstart

  Open a fork of mainnet and send your first transaction against it, from the command line, in three requests.

  Quickstart →

• Core concepts

  Sessions, forks, executions, findings and severity, workspaces and projects, and the attestations that make a report checkable.

  Core concepts →

• Auditing IDE

  The security workbench: Composer, Fuzzer, MorphVM, Architecture Explorer, and the rest of the panel set.

  Auditing IDE →

• Contract IDE

  Git-native workspaces, Solidity and Vyper compilation, merge requests, annotations and GitHub publishing.

  Contract IDE →

• API

  Base URL, authentication, idempotency, errors and rate limits — then the per-endpoint reference.

  API overview →

• Audit reports

  Published reports, each with its severity breakdown and verdict.

  Audit reports →

What you can do

Goal	Where it happens	Start here
Reproduce a suspected bug against real mainnet state	Auditing IDE — Composer, on a forked session	Quickstart
Sweep a contract's bytecode for known-bad patterns	Auditing IDE — Passive and Findings	Auditing IDE
Find an input that breaks an invariant	Auditing IDE — Fuzzer	Auditing IDE
See who can change what in a protocol	Auditing IDE — Architecture Explorer	Auditing IDE
Write and compile a contract, then review it	Contract IDE	Contract IDE
Publish a workspace to GitHub with its full history	Contract IDE	Contract IDE
Record findings against a project and issue a report	Workspaces and audits	Core concepts
Let a third party verify a report you issued	Public attestation verification	Core concepts
Automate any of the above	The api.trilocore.ai resource API	API overview

How the surfaces relate

A workspace is the tenancy boundary: it owns projects, a contract inventory, audits, findings and reports. Both IDEs file their work into it, which is what makes an audit reconstructable months later — an execution in the Auditing IDE and a merge request in the Contract IDE end up in the same activity trail.

Everything the application does, it does through the same public API. There is no private surface behind the app: the endpoints in the reference are the ones the product itself calls.

Not in the current release

AI-assisted analysis is in development and is not part of the current release. Nothing in these pages depends on it. Where a page describes something that is planned rather than shipped, it says so explicitly.