The problem with agentic scanning
It burns the credibility of every other finding in the report. LLM agents are excellent at locating candidate issues across a large codebase and unreliable at adjudicating them — they will rate a public court record as a leaked secret, confidently, with a quote and a HIGH. So whoever has to act on the report ends up re-deriving it themselves, and the assessment has cost more than it saved.
"ssn": "078-05-1120", "dob": "1935-04-02"
A public court record, filed in a docket anyone can read, used as a test fixture. Not a secret. Never was. The retraction stays in the report, where the reader can see that someone checked.
A scanner emits hundreds of candidates and ranks them by pattern confidence, not by whether the path is actually reachable. Nobody triages all of it, so nobody trusts any of it.
A report that mixes verified issues with unconfirmed agent output, and labels neither, is not a verdict. It is a worklist wearing a verdict's clothes.
A list of defects tells you nothing about whether the risk arrived in one bad fortnight or accreted over three years — which is the thing that decides what you do on Monday.
Codebase security & supportability assessment
Assay gives one engineer the reach of nine parallel security lenses across an unfamiliar codebase — then puts every finding through a human verification gate before it earns a place in the report. Evidence-labelled. Reproducible. And your source never has to leave your infrastructure.
--offline runs air-gapped and makes provably zero network callsHow it works
Five stages. A depth flag scales the scope — --light, --thorough
or --full — but the gate in the middle is never skipped. That gate is what makes
the output worth reading.
Map the stack, domain, data sensitivity and which gates already exist — into one recon map every lens reads first.
Nine lenses run concurrently, each narrowed to the surfaces recon actually found. Quote file:line, trace to sink, refute first.
Every high-severity finding re-checked by a human in the primary source. Non-negotiable at every depth.
An answer-first executive summary plus a labelled technical appendix — every finding carrying its evidence tier.
A self-verifying .docx, PDF, HTML or SARIF, plus the interactive history dashboard.
Two tools, one pipeline
They share a single report format and stay in sync — but neither depends on the other to run.
.docx with a live TOC, index and page numbers — plus PDF, HTML and SARIFassessment.md → audit-dash → a single HTML file you can open anywhere
Scanners and agents are excellent at locating candidates across a large codebase. Assay uses them for exactly that, then makes a human confirm each high-severity finding in the source before it ships.
Every finding carries its evidence tier, and retractions stay in the report — because a report with no retractions either got lucky or never verified.
The count is published too, so the discipline is legible to whoever reads the report rather than something you have to take on faith.
Capabilities
Every finding source-verified before it ships and labelled with its evidence tier — retractions and all.
Repo age, velocity, application LOC, bus factor, churn hotspots, cyclomatic complexity, coverage, mutation, vulnerable dependencies and an AI-authorship signal.
Node, Python, .NET and Go out of the box; any language via lizard complexity. Anything it can't run, you pass in — LCOV, SARIF, audit JSON.
A .docx with cover page, live clickable TOC, index and page numbers — no pandoc, no LaTeX. Same layout to PDF, or standalone print-ready HTML anywhere.
Brand at the shell: pour the report into your own .docx template so its theme, cover, header and footer genuinely drive the document.
secscan normalises Semgrep, gitleaks, Trivy and OWASP ZAP into one severity-sorted worklist — every row pending until a human adjudicates it.
Findings as SARIF 2.1.0 for GitHub code scanning or Defender, evidence tiers preserved. A weighted readiness score rolls the verdict into one number.
A scheduled CI workflow re-runs the deterministic checks weekly and gates on only two objective signals — an end-of-life runtime and critical/high vulnerable deps.
The build checks every heading against the generated TOC and throws if one is missing. The kit holds itself to the standard its reports demand.
The finding-history dashboard
Every finding lands on the commit that first wrote its line — so you can see whether your risk arrived in one bad fortnight or accreted over three years. One self-contained HTML file that computes every chart in the browser. No server, no build, no CDN.
Line numbers mean something only at the commit the report names. The dashboard pins to it and stops if the checkout doesn't contain it — rather than blaming HEAD and inventing a plausible, wrong answer.
A location git can't resolve gets git's own reason shown in the row and counted in a banner. That's a finding about the report, and more useful than a blank.
Filter by severity, evidence, lens or churn hotspot and the KPIs, both plots, the table, treemap, icicle and churn chart all re-render together — so the numbers always agree.
It recomputes the verification ratio from the findings table and raises a banner when the report's prose disagrees with its own numbers.
Severity rides position, not colour, and every plotted value is repeated in the table. A report whose whole purpose is not to mislead cannot ship a chart that does.
Commits touching each file up to the assessed commit — high churn × high complexity made visible as the next likely defect site.
No data egress
The kit's own code calls no LLM. The mechanical half — scan, secscan, readiness, attest, build, the dashboard — is pure deterministic Node. The intelligent half is done by an agent driving a model you choose, and it is deliberately not locked to one provider.
| Tier | You run it with | What leaves your network |
|---|---|---|
| Turnkey | The /audit skill | Prompts + code excerpts to your model provider |
| BYO key | A thin runner on an agent SDK | Prompts + code excerpts to your provider |
| BYO any model | Any agent runtime, or by hand | Nothing — on a self-hosted model |
Deliverables
Contact
Whether it's due diligence on an acquisition, an inherited system nobody owns any more, or a security review you need to be able to defend line by line — start here.