Codebase audits, and the work that follows them.
Send us the repository. We scan it, read what came back ourselves, and return a scored report, the mechanical fixes already applied as reviewable diffs, and a short list of decisions only your team can make. If the free tier is enough on its own, we will say so.
Understand it, mend it, or keep it true.
Start at the first and stop when you have what you came for. Most teams stop after the first.
A health check
We scan the whole repository and read the output ourselves. You find out what is wrong, how much of it clears at no cost, and what it would cost to be wrong about the rest.
- Scored report across forty dimensions
- Findings priced by what they cost to clear
- A phased roadmap, ordered by risk
- A walkthrough with your engineers
An improvement sprint
The assessment, plus the work. Mechanical corrections applied and verified; bounded refactors carried out one function at a time and checked. Architectural decisions stay yours.
- Corrections landed as reviewable, scoped diffs
- Before and after scores on the same dimensions
- A receipt for every change
- Architectural findings with evidence attached
A standing partnership
It sits in your CI and re-checks every commit. We stay on for the judgment calls, watch the trend lines, and go deep once a quarter.
- Re-trued on every commit
- Monthly trend reports
- Quarterly deep-dive sprint
- Team conventions enforced as rules
Scoped per repository · ask for a quote · every engagement ends with the artifacts in your hands
Three acquired codebases, one review queue, and nobody who could say where the risk was.
Case study · logistics platform, Series B
A logistics platform had grown by acquisition: three codebases merged into one TypeScript service over fourteen months, much of it written fast with AI assistance. Nothing was on fire. That was the problem: the review queue was backed up, senior engineers were the bottleneck on every merge, and no one could point at a file and say whether it was safe.
- Read the repository before proposing anything.
Three days, 340 files, no meetings. Every dimension was scored on the first day, and we spent the rest of the time on what it flagged.
- Did the free work first.
141 mechanical findings were corrected and verified by re-parse: dead exports, swallowed errors, logging left in hot paths. All reversible, all landed as scoped diffs their reviewers could read in one sitting.
- Left the arguments to the humans.
21 architectural findings, including the merged auth paths and an unbounded context load, came back as evidence, not edits. Two shipped that quarter; the rest went on the roadmap with a price beside each one.
“We stopped arguing about whether the code was bad. We had a number, a list, and a diff that had already been applied. The argument became which fifteen things to do next.”
re-scored on the same forty dimensions
Seven languages, six linters, and no single answer to whether it is safe.
An AI learning system that answers questions which used to cost a week of SQL and a warehouse bill. It learns from documents and data, works answers out through an ontology, and presents them through the Microsoft Agent Framework.
Case study · corporate learning, mid-market · engagement in progress
One product, seven stacks. Fabric IQ carries the business semantics, Foundry IQ retrieves from a SharePoint corpus, and the agent layer sits on top. Getting there meant C# services, a React front end, Python for the ontology work, T-SQL, PowerShell, Bicep, and SPFx web parts. Much of it was written fast with AI assistance.
Six linters watched those seven stacks and agreed on nothing. Two of the stacks had no coverage at all: nobody lints an SPFx web part or a Fabric artifact. The same swallowed exception was corrected three different ways in three languages, and the only real quality gate was two senior engineers reading every merge. A security review failed on a finding that had already been corrected in C# and missed in Python.
- One grammar per language.
Each stack is parsed with its own syntax-tree grammar, so a swallowed exception in Python and the same mistake in C# come back as the same finding, scored on the same dimension.
- The Microsoft surfaces have dedicated specs.
Thirteen spec files cover ASP.NET Core, EF Core, Blazor, Azure Functions, Semantic Kernel, Azure OpenAI, Azure AI Search and a Foundry and Fabric set. SPFx web parts parse as TypeScript, which is where nobody was looking.
- The senior engineers became reviewers again.
Mechanical findings arrive already corrected and verified by re-parse. What reaches a person is the short list that needed a person, with evidence attached.
- One score, so the argument ends.
Six linters produced six opinions and no number anyone trusted. Forty dimensions across seven languages produce one, measured the same way before and after.
A learning system holds documents people did not expect it to hold. Findings map to the same nine frameworks as every report, so the privacy questions get answered from evidence. That was the second reason they called.
Bicep and ARM templates are not covered. Azure infrastructure is covered through 50 PSRule-mirrored Terraform detectors, which this client does not use.
Figures are the current health check. The after score publishes when the sprint closes and the repo is re-scored on the same forty dimensions.
Four steps from first call to finished work.
You will know inside half an hour whether this is worth doing, and the report is yours either way.
- 01A call
Thirty minutes on what worries you and what the repository looks like. We tell you whether this is worth doing.
- 02Read-only access
One clone, or we run it on your machine and never take a copy. Air-gapped works.
- 03The report
Scored, prioritised, priced. Yours whether or not anything happens next.
- 04The work
Corrections land as reviewable diffs against a branch you own. Nothing merges without your review.
- your code never leaves your perimeter unless you say so
- every artifact is a file in your repo
- no lock-in, the scanner is open core