Verify the code your agents wrote. Before it ships.
Veylqorix independently verifies AI-generated and human-written code before it is committed, pushed, merged, or deployed. It orchestrates real scanners — dependency auditing, secret detection, license checks, static analysis, and test suites — normalizes their output into one finding schema, and turns it into a deterministic gate decision with auditable evidence.
$ veylqorix scan . --json
23 findings · 2 critical
exit 1 — FAIL · SARIF written
source
app/page.tsx
waiting
waiting for a code change…
Four guarantees
AI coding agents now write a large share of production code — fast, plausible, and occasionally unsafe. Lint and CI pipelines were not designed to verify that volume. Veylqorix fills the gap:
Guarantee 01
Real evidence, no fabrication
Every finding, severity, and exit code comes from an actual scanner run. A check that cannot run is reported SKIPPED or ERROR with a reason — never a clean pass.
Guarantee 02
One engine, many surfaces
CLI, MCP, GitHub Actions, and the dashboard are thin adapters over a single core, so security logic exists in exactly one place and behaves identically everywhere.
Guarantee 03
Deterministic gate
Exit codes are stable — 0 PASS, 1 FAIL, 2 INCOMPLETE — so CI branching is predictable and auditable run to run.
Guarantee 04
Agent-safe policy
An AI agent cannot suppress findings or raise thresholds: exceptions must be documented, capped, expirable, and visible in the committed policy file and every gate report.
What the gate ships with
4
scanners, one schema
0/1/2
stable exit codes
9
secret families, offline
6
MCP tools, validated
8
ecosystems detected
37
Rust crates audited, 0 findings
How the gate decides
From a code change to a verdict, four stages run in order. Each one is auditable, and none of them can be skipped by an agent:
- 01
Scan
Real scanners run — dependency, secret, license, and quality. Nothing is invented; a scanner that cannot run is SKIPPED or ERROR.
- 02
Normalize
Every result is cast into one finding schema, so a finding from Gitleaks and a finding from npm audit speak the same language.
- 03
Judge
The committed policy file — not an agent, not a checkbox — decides which severities block. Exceptions are documented, capped, and expirable.
- 04
Gate
A deterministic decision: 0 PASS, 1 FAIL, 2 INCOMPLETE. Coverage is auditable run to run, and a merge that forces past a red gate is stated, never hidden.
Run a gate in three commands
Nothing to install for the secret, license, and quality scanners — they run from the Node runtime. The CLI is not on npm yet, so it is run from the monorepo build:
$ veylqorix scan . --json
23 findings · 2 critical · exit 1 (FAIL) — evidence recorded, SARIF ready.
$ veylqorix check .
type + lint + tests only, no scanners — gate reports INCOMPLETE (exit 2) by design.
$ veylqorix report . --format sarif
A SARIF 2.1.0 report a human or an answer engine can both read.
Ecosystems detected
Veylqorix reads the manifest for each language so it knows which dependency scanner to call. Where a toolchain or network is missing, the scanner is skipped and coverage degrades — it never fails silently:
manifest + lockfile
requirements / pyproject
go.mod / go.sum
in the Rust engine
pom / gradle
Gemfile / lock
composer.json
csproj / packages
Where Veylqorix plugs in
Every surface is a thin adapter over the same core engine (packages/core), so there is exactly one place where security logic lives:
CLI
01Real scans, deterministic exit codes, safe dry-run hook installer. Not published to npm yet — run from dist/, with the Rust engine built from source.
MCP server
02Six validated tools, root-confinement + redaction. Requires pnpm build.
GitHub Actions gate
03Real scan + SARIF upload, all actions pinned to SHAs. Advisory until a branch-protection rule requires the check.
Agent skills
04Portable SKILL.md plus MCP configs for Claude Code, Codex, and Cursor.
Dashboard
05Live scan data from the API; clearly-labeled DEMO MODE when the API is down.
Plugin SDK
06Scanner extension SDK: add your own scanners and quality checks; their findings flow into runAudit and the same gate. Not published to npm yet.
Honest note
The gate and the CLI hooks are advisory until enforcement is in place — a branch-protection rule that requires the check, or a published CLI. Findings are produced and the check fails; a merge can still be forced. That is stated everywhere, never hidden.
Release posture
Release-readiness hardening, validated against the engineering docs: GitHub Actions pinned to commit SHAs, the transitive postcss and sharp vulnerabilities patched in place via pnpm overrides, and the Rust engine clean under cargo-audit (37 crates, 0 findings). Publishing is gated on npm provenance attestation; nothing is on the registry yet — run from source.
Scanner adapters reuse real tools
| Scanner | Backed by | Offline? |
|---|---|---|
| Dependencies | npm audit (Node) / pip-audit (Python) | optional |
| Secrets | Rust engine secret scanner (offline, 9 families) — TypeScript fallback, redacted values | yes |
| Licenses | manifest-level license checks, copyleft risk | yes |
| Quality | tsc, eslint, ruff, project test scripts | no |
System architecture — entry points reach one core engine; results fan out to CLI, API, and CI surfaces.
Scan lifecycle — normalize before judging, gate failures are first-class, verify don't trust.
What Veylqorix is not
Read this first
- Veylqorix reports what its scanners found. It does not certify the absence of vulnerabilities or secrets.
- A scanner that cannot run makes the gate INCOMPLETE (exit 2) — degraded coverage is surfaced, never green-washed.
- Regex secret detection has false positives and negatives; it complements tools like Gitleaks, it does not replace them.
- License scanning is manifest-level, not a transitive license audit. A clean quality check is not a security certification.
A check that cannot run is reported SKIPPED or ERROR with a reason. Veylqorix surfaces incomplete audits instead of green-washing them.
The full story, in three places
Story
How it was built
Five diary-style posts: the gap, the eight-day board, INCOMPLETE, one engine, and the sync loop.
Changelog
0.1.0 → 0.1.1, then Rust
Every release, every group of changes — now including the Rust security engine wired in through a TypeScript adapter.
Tour
Inside the platform
CLI, MCP, API, dashboard, GitHub gate, security model, and community ground rules.