{
  "slug": "circomspect",
  "name": "Circomspect",
  "tagline": "Trail of Bits' static analyzer and linter for Circom",
  "maintainer": "Trail of Bits",
  "url": "https://github.com/trailofbits/circomspect",
  "repo": "https://github.com/trailofbits/circomspect",
  "category": "zk-circuits",
  "targets": [
    "Circom"
  ],
  "approach": "Static analysis of Circom source for unconstrained signals and unsafe patterns; SARIF output",
  "license": "Open source (GPL-3.0)",
  "status": "Maintained",
  "since": "2022",
  "summary": "Circomspect is a static analyzer for Circom that flags unconstrained signals, unused or shadowed variables, unsafe `<--` assignments and other patterns behind known circuit bugs. It is a linter, not a verifier: fast, easy to add to CI, and blind to bugs that do not match a pattern.",
  "details": [
    "Circomspect belongs at the start of every Circom pipeline. It takes seconds, integrates with editors via SARIF, and catches the classes of mistake that dominate public ZK bug trackers. Treat its silence as the absence of known patterns, not the absence of bugs."
  ],
  "strengths": [
    "Zero setup, runs in CI.",
    "Built by an audit firm from real findings.",
    "Good developer ergonomics."
  ],
  "limits": [
    "Pattern-based; no semantic guarantee.",
    "Circom only.",
    "No completeness or soundness statement of any kind."
  ],
  "fit": [
    "Use it always, before Picus, before an audit, before anything else."
  ],
  "references": [
    [
      "Circomspect repository",
      "https://github.com/trailofbits/circomspect"
    ]
  ],
  "category_name": "ZK circuit verification",
  "page": "https://sorryfree.com/frameworks/circomspect/",
  "updated": "2026-09-13"
}