Every agent change gets a first pass.
CodeTruss is the deterministic first-pass verification gate for AI-written code. Routine changes clear the checks and pass; material changes escalate for human sign-off — and every verdict leaves a signed receipt you can re-verify locally.
- Boundary
- Local first-pass gate
- History
- Explicit receipt sync
- Health
- Full-codebase audit
Specimen receipt · Boundary
SignedPASS
- Task
- Add input validation to /api/orders
- Scope
- 3 allowed · 0 unexpected
- Analysis
- 15 registry analyzers · local
- Verification
- npm test · exit 0
- Signature
- integrity-signed · re-verify: codetruss verify latest
Example signed Boundary receipt with verdict PASS: task, scope, analysis, verification, and signature rows. Values are illustrative.
local by default — explicit sync only
Exhibit 0 — Watch a boundary hold
One agent turn, replayed exactly: what the agent wrote, what the boundary classified while it wrote it, and the single reason the receipt was signed REVIEW_REQUIRED.
A replayed agent turn. The agent is asked to add a password-reset endpoint. It writes src/auth/reset.ts and edits src/lib/email/send.ts, both inside the allowed scope, then edits src/billing/webhooks.ts, which is outside it. CodeTruss returns a fast scope check during the turn, then runs all 15 local registry analyzers when the turn stops: one LOW finding from the todos analyzer at src/auth/reset.ts:41, and the configured verification command pnpm test exits 0. The signed receipt records the verdict REVIEW_REQUIRED for one reason — 1 file(s) changed outside approved scope: src/billing/webhooks.ts — and exits 1. Running codetruss verify latest re-checks the signature. Local receipts run a local SAST subset but omit the hosted symbol graph and the hosted-only passes, and report hosted Health scores as not available.
Specimen session · one agent turn
Boundary · CodeTruss
Local
Agent session
Claude · CodeTruss hooks active
0 false positives across 8 repositories, 7 of them not ours — true of that corpus, and no longer the whole story. A larger ten-repository corpus we did not choose found false positives, including a CRITICAL SQL-injection report on a parameterized drizzle query. Fixed in CLI 0.2.53. 6 of 9 bugs caught on a corpus we wrote ourselves. No other tool was run, so none of it says we score higher than anyone. Read the benchmark and the correction
Boundary · History · Health
One verification gate, from prompt to codebase.
- BoundaryLocal · before the PR
- Record the task and starting Git state, enforce scope, flag sensitive surfaces, run 15 registry analyzers plus your verification commands, and write an integrity-signed receipt.
- HistoryExplicit sync · organization scoped
- Receipts stay local until you choose one to sync. Sync sends a privacy-minimized copy for organization history and shared review; it never uploads the patch or verification output.
- HealthHosted · whole codebase
- Run a read-only repository audit with the registry suite plus graph, SAST, and route-authorization passes, health scores, architecture maps, findings, and an issue roadmap.
Install + activate · macOS + Linux
curl -fsSL https://codetruss.com/install.sh | sh
codetruss setup- 15 registry analyzers stay local
- One guided setup, then automatic checks
- Integrity-signed Markdown + JSON
§ 01 — What you receive
When a change escalates, the next question is the codebase around it. One hosted audit answers that in four exhibits. Deliverables — not a lecture.
Exhibit A
Architecture map
Every module, edge, and cycle — drawn from the real symbol graph, not a stale wiki page.
Example architecture map: modules app, lib, api and prisma with import edges, and a three-file import cycle flagged in red.
Exhibit B
Health certificate
Five scores that tell you where the risk actually lives, weakest marked in red.
Certificate of Health
Snapshot a1b2c3 · Read-only
Example health certificate with scores: structure 87, health 74, tests 71, security 64 (weakest, marked in red), docs 93.
Exhibit C
Issue roadmap
A punch list of findings, ranked and filed as labeled GitHub issues under a milestone.
- ☐ Vendored dir committed: .agent/ (1,862 files)■ HIGHM
- ☐ No CI pipeline detected■ HIGHS
- ☐ Deep nesting in geminiService.ts□ MEDS
Ranked by severity × effort · filed as GitHub issues
Exhibit D
Fix PRs
Approve a finding and CodeTruss opens the branch and the pull request. Nothing ships without you.
- const apiKey = 'sk-live-9f3…'- writeFileSync(out, data)+ const apiKey = process.env.API_KEY+ if (!apiKey) throw new Error('API_KEY missing')+ await writeFile(out, data)
§ 02 — Method
Connect
Install the GitHub App on the repositories you choose — and nothing else.
LEAST-PRIVILEGE GITHUB APP · REVOCABLE
Snapshot
CodeTruss takes a read-only tarball of your default branch. Your code is never executed.
READ-ONLY TARBALL · NEVER EXECUTED†
Analyze
A policy-selected analyzer suite walks the symbol graph and source: structure, import cycles, tests, secrets, SAST, broken access control on Prisma and Drizzle routes, and known vulnerabilities.
STATIC ANALYSIS · SAST · SYMBOL GRAPH · AUTHZ GRAPH · OSV
Roadmap
Findings become labeled GitHub issues under a milestone, with a tracking issue on top.
LABELED ISSUES · MILESTONE · TRACKING ISSUE
§ 03 — The deliverable
The audit ends as a typeset report you can hand to a client, a CTO, or your future self: scores, architecture, findings, and a prioritized plan, enriched with AI review and shared as a read-only link. Freelancers and agencies deliver it as the codebase audit their engagement is billed on. Don’t take our word for it: the specimen shown here is a real audit of a repository you already trust.
The specimen is a small, well-maintained library — the calibration point for what a healthy codebase scores. For what the same method finds in a real AI-assisted SaaS, read an independent teardown of a pinned public repository: auditing an AI-built SaaS.
Specimen · Healthy-repo calibration
expressjs/cors
Shared read-only
send it to the client as-is — or white-label it
§ 04 — Fee schedule
Free
Try CodeTruss on a single repository.
1 repository · 5 scans a month · health scores & basic reports
$0
Pro
For developers and small teams shipping agent-written code.
☛ recommended
10 repositories · 50 scans · full reports, exports, fix PRs, your own AI keys
$19 / mo
Agency
For agencies delivering audits to a book of clients.
Client workspaces · white-label reports · 200 repositories · 25 seats
$249 / mo
Full fee schedule
§ 05 — Engineer-led option
Shipping an AI-assisted release and need more than a report? The Release Assurance pilot is a fixed-scope engagement: an engineer contracts your exact release state, exercises up to three workflows that cannot fail, repairs a bounded set of defects, and hands you an evidence-backed go, conditional-go, or no-go decision in ten business days.
See the fixed pilot scopePrepared by CodeTruss — the deterministic first-pass gate for AI-written code.
Signed
Footnotes
† Read-only tarball snapshot. Your code is never executed. GitHub App access is least-privilege and revocable.