01
Run the agent
One Python binary spawns 4 scanners in parallel. Runs on your laptop, in CI, or as an ephemeral Docker container. License-safe by construction.
$ coudit scan ./repo --product api
coudit aggregates Opengrep, Trivy, Betterleaks and TruffleHog into a single normalized stream. A cryptographic deduplication engine collapses the noise, and a local LLM writes the fix — so your source code never leaves your network.
No daemons. No long-lived agents on production. Just CI — or your laptop.
One Python binary spawns 4 scanners in parallel. Runs on your laptop, in CI, or as an ephemeral Docker container. License-safe by construction.
$ coudit scan ./repo --product api
SARIF is parsed, severity reconciled (level, CVSS, CWE), paths sanitized. Each finding gets SHA-256(file·line·cwe·tool). Collisions merge. Hit count rises.
3 results → 2 unique, 1 merged
Qwen2.5-Coder or DeepSeek-R1 reads the finding plus a code window and returns a Pydantic-validated patch — explanation, impact, secure code, steps. No SaaS API. No data leaving.
{ "secure_code_patch": "..." }
Same engine, same API, same deduplication math — different operational model.
We host the backend. You install the agent in CI. Five-minute setup, zero ops on your side.
coudit-scan to your CI workflow.$ pip install coudit-agent $ coudit scan . --product api \ --backend-url https://api.coudit.com \ --token $COUDIT_TOKEN
Helm chart or docker compose. Your kube, your DB, your LLM. Air-gapped friendly. SOC 2 / HIPAA / DORA-ready.
$ helm install coudit ./chart \ --set llm.baseUrl=http://ollama.svc $ kubectl get pods -n coudit
Skip the backend entirely. Agent writes SARIF locally; pipe it into GitHub Code Scanning or read it yourself. Free.
$ coudit scan ./src --product me \ --output ./out $ gh code-scanning upload \ out/coudit-bundle.sarif.json
Run it on this very project. The backend you’re reading right now is the same one shipping to customers.
/api/v1/ingestOpengrep (LGPL-2.1). Cross-function dataflow for SQLi, SSRF, XSS, deserialization. 300+ rule families.
Betterleaks (MIT) for speed; TruffleHog (AGPL-3.0) to verify the key is actually live. Run separately at arm’s length.
Trivy (Apache-2.0) against NVD, GHSA, OSV. Direct + transitive dependencies, container layers, infra-as-code.
Same file, same line, same CWE, same tool → same row. Forever. Your backlog stops doubling on every CI run.
Pydantic-schema-enforced JSON from your own LLM (Ollama, vLLM, llama.cpp). Your code never sees a third-party API.
AGPL components are subprocess-isolated. No imports. No FFI. Your SaaS code stays proprietary.
All four engines are open source. We don’t charge for someone else’s work.
Solo developers & OSS maintainers.
Engineering teams of 3 to 25.
Regulated industries & large orgs.
No. Opengrep, Trivy, Betterleaks and TruffleHog are open source. You pay for the platform that ties them together — deduplication, normalization, AI remediation, integrations.
Nowhere it doesn’t already go. Scans happen on the machine running the agent (your laptop, your CI runner, your container). Only SARIF metadata is shipped to the backend. With self-hosted, even SARIF stays inside your perimeter.
Default is Qwen2.5-Coder-7B via Ollama on localhost:11434. You can point the client at any OpenAI-compatible endpoint — vLLM, llama.cpp, OpenLLM, even your own internal gateway. No call ever leaves your network.
For every incoming finding we compute SHA-256(file_path | line_number | CWE | tool_name). A matching active signature on the same product merges into the existing row, bumps hit_count, and appends to merge_log. New rows are only created when something genuinely new appears.
No. We never link, vendor, or import TruffleHog. The agent invokes it strictly as a separate OS process (binary on PATH or ephemeral Docker container) and reads JSON Lines from stdout. This is the textbook arm’s-length aggregation that the FSF and AGPL section 13 explicitly permit.
Yes. Opengrep accepts Semgrep YAML rules. On Pro and Enterprise you upload rule packs in the dashboard; the agent picks them up automatically.
Fourteen-day Pro trial. No credit card. Five-minute install.