You don’t have to adopt anything to get the answer.
Hand us the repository. We run the engine, read what it found, and come back with a scored report, the safe fixes already applied, and a short list of decisions only your team can make.
Understand it. Mend it. Keep it true.
Start at the first and stop when you have what you needed. Nothing here obliges you to the next thing.
A health check
We run the full engine over the repository and read the output ourselves. You find out what is actually wrong, how much of it is free to fix, and what it would cost to be wrong about the rest.
An improvement sprint
The assessment, plus the work. Deterministic fixes applied and verified; cataloged refactors executed under constrained scope and validated. Structural decisions stay yours.
A standing partnership
Truemend runs in your CI and re-trues on every commit. We stay on for the judgment calls, watch the trend lines, and go deep once a quarter.
scoped per repository · ask for a quote · every engagement ends with the artifacts in your hands
Three acquired codebases, one review queue, and nobody who could say where the risk was.
A logistics platform had grown by acquisition: three codebases merged into one TypeScript service over fourteen months, much of it written fast with AI assistance. Nothing was on fire. That was the problem: the review queue was backed up, senior engineers were the bottleneck on every merge, and no one could point at a file and say whether it was safe.
Three days, 340 files, no meetings. The engine scored every dimension and we spent the time on what it flagged rather than on interviews.
141 deterministic findings were fixed and verified by re-parse: dead exports, swallowed errors, logging left in hot paths. All reversible, all landed as scoped diffs their reviewers could read in one sitting.
21 structural findings, including the merged auth paths and an unbounded context load, came back as evidence, not edits. Two shipped that quarter; the rest went on the roadmap with a price beside each one.
“We stopped arguing about whether the code was bad. We had a number, a list, and a diff that had already been applied. The argument became which fifteen things to do next.”
re-scored on the same 40 dimensions
Seven languages, six linters, and no single answer to “is this safe?”
An AI learning system that answers questions which used to cost a week of SQL and a warehouse bill. It learns from documents and data, synthesizes answers through an ontology, and presents them through the Microsoft Agent Framework.
One product, seven stacks. Fabric IQ carries the business semantics, Foundry IQ retrieves from a SharePoint corpus, and the agent layer sits on top. Getting there meant C# services, a React front end, Python for the ontology work, T-SQL, PowerShell, Bicep, and SPFx web parts. Much of it was written fast with AI assistance.
Six linters watched those seven stacks and agreed on nothing. Two of the stacks had no coverage at all: nobody lints an SPFx web part or a Fabric artifact. The same swallowed exception was fixed three different ways in three languages, and the only real quality gate was two senior engineers reading every merge. A security review failed on a finding that had already been fixed in C# and missed in Python.
The engine parses each stack with its own AST grammar, so a swallowed exception in Python and the same mistake in C# are recognised as the same finding and scored on the same dimension.
Thirteen spec files, roughly 338 patterns, cover ASP.NET Core, EF Core, Blazor, Azure Functions, Semantic Kernel, Azure OpenAI, Azure AI Search and a Foundry-and-Fabric set. SPFx web parts parse as TypeScript, which is where nobody was looking.
Deterministic findings arrive already fixed and verified by re-parse. What reaches a human is the short list that needed a human, with evidence attached.
Six linters produced six opinions and no number anyone trusted. Forty dimensions across seven languages produce one, measured the same way before and after.
A learning system holds documents people did not expect it to hold. Findings map to the same nine frameworks as every report, so the privacy questions get answered from evidence rather than from a questionnaire. That was the second reason they called, not the first.
Bicep and ARM templates are the honest gap. Azure infrastructure is covered through 50 PSRule-mirrored Terraform detectors, which this client does not use.
Figures are the current health check, not a result. The after score publishes when the sprint closes and the repo is re-scored on the same 40 dimensions.
No discovery theatre.
Thirty minutes on what worries you and what the repo looks like. We say plainly whether this is worth doing.
One clone, or we run it on your machine and never take a copy. Air-gapped works.
Scored, prioritised, priced. Yours whether or not anything happens next.
Fixes land as reviewable diffs against a branch you own. Nothing merges without your review.