Describe a rule in plain English
The engine drafts the title, file globs, severity, and a structural pattern. Approve it and it starts catching on the next commit.
CLAUDE.md doesn't scale.
Rules do.
Pre-curated, pattern-matched packs across 8 languages — security, best-practices, lint, and architecture — plus the project rules you grow yourself, battle-tested the moment you connect. Co-authored with your AI, approved by humans, enforced in-session before code ships.
Compliance checks that run
as you commit.
The agent that writes your code checks it against the code-level controls of HIPAA and PCI-DSS — deterministic rules for the clear cases, AI review for the judgment calls a matcher can't make — at commit time, with the evidence kept per change. Built on our OWASP security pack.
Helps your team catch HIPAA- and PCI-relevant defects in code before they ship. It complements a formal audit (QSA / SAQ) — it doesn't replace one.
Deterministic coverage across your stack.
Symbol navigation, security taint, lint, and architecture rules — resolved per language by the engine, not guessed by an LLM.
| Capability | Go | Python | TS | JS | Java | Rust | PHP | Ruby |
|---|---|---|---|---|---|---|---|---|
| Code navigationxref — defs · callers · outlines | ||||||||
| Security reviewinterprocedural taint | ||||||||
| Lint & best practicesdeterministic packs | ||||||||
| Architecture graphlayers · import cycles |
Security review is interprocedural taint — Go via SSA, the rest via a shared IL. Ruby ships symbol navigation today; references, taint, and full rule coverage are in progress.