How it works
- Audit — 93 rules on tree-sitter syntax trees with taint tracking, plus project intelligence: stacks, monorepo
units, data stores, CI/CD, routes and environment variables. Offline and read-only.
- Evidence — every finding carries
file:line, a redacted snippet, facts, confidence, impact and CWE/OWASP mapping.
- Fix — 15 deterministic fixers produce a reviewable diff; everything else becomes a fix prompt for your coding agent.
- Verify — a fix must remove its findings, add none and keep your tests green, in an isolated copy, with rollback.
- Release — up to 18 gates, each marked executed, measured, static analysis or not run. Unverified is
never a silent pass.
From findings to fixes
Start with what matters. The action center splits open findings by how they get fixed and puts the most severe
root causes first:
- Deterministic fix — a Relivaro fixer produces a concrete patch.
- Agent-assisted — a coding agent investigates, changes the code and adds a regression test.
- Manual review — needs runtime evidence, an operational decision or approval first.
Hand it to your coding agent. Select findings and press Generate fix prompt: an editable brief for Claude
Code, Codex or any coding agent with the run id, stable finding ids, locations, evidence and permission boundaries.
The agent re-checks each finding against the current code (relivaro recheck), rejects false positives and asks
before changing anything.
The report is one self-contained file: no network, no CDN, a strict CSP, secrets redacted.
Every claim is checkable. Findings show the code that triggered them with the line highlighted, how to verify the
fix, and whether someone reviewed them: detected, confirmed, false positive, needs verification or accepted risk
(relivaro review add).
Quick start
Claude Code plugin — no npm install needed:
/plugin marketplace add cihantopac/relivaro
/plugin install relivaro@relivaro
Then run /relivaro in your project, or a single step: /relivaro:audit, :security, :performance,
:reliability, :test, :optimize, :release. Claude checks significant findings in your code and asks before
executing project commands, going online or editing anything. Plugin guide
CLI — requires Node.js 22+, no runtime dependencies, no install scripts:
npm install -g relivaro
relivaro audit . --open
relivaro release . --allow-exec --online
relivaro fix apply latest --yes --verify "npm test" --allow-exec
Reports land in .relivaro/runs/<run-id>/ (report.html, .md, .json, optional .sarif). No install:
npx relivaro audit .. All commands: docs/CLI.md.
Safe by default. Read-only and offline. Project code runs only with --allow-exec, the network is used only with
--online, and files change only through fix apply --yes — with backups and hash-guarded rollback.
Hosted scanning of untrusted code. --lockdown (or RELIVARO_LOCKDOWN=1) turns those opt-ins into usage errors
(exit 2): --allow-exec, --online, --open, fix apply/rollback, baseline, init, load, bench,
review add, and writing reports into the audited directory (use --workspace <dir> outside it, or --no-write). It
also ignores the repository's relivaro.config.json and inline relivaro-ignore/relivaro-accept comments, applies
.gitignore to nothing and never starts git, so no child process is spawned and no socket is opened.
--ignore-repo-config alone uses only defaults or an explicit --config.
Programmatic use. npm install relivaro, then
import { runAudit, toSarif, compareRuns, assessRelease } from 'relivaro' (ESM, typed). The run record follows
schemas/run.schema.json, and --json --compact is pinned by
tests/fixtures/contract/compact.json. Everything else is internal.
Evidence
- 338 tests (unit, integration, security, end-to-end) on Linux, macOS and Windows × Node 22 and 24 in CI.
- Detection corpus: 11 fixture projects, 185 expected findings, precision and recall 100%, enforced in CI.
A controlled corpus — real code will produce false positives and misses.
- Real repositories: validated read-only on 5 production codebases; every significant finding checked by hand
(validation).
- Speed: a 3,060-file repository in about 1.5 s; a 241k-line monorepo in about 3 s on an Apple M4
(benchmarks).
- Report safety: tests inject
</script> payloads through analysed source; the report stays inert and makes no
network requests.
Source-level rules cover JavaScript, TypeScript (JSX/TSX), PHP and Python; Go, Ruby, Java/Kotlin, Swift,
Dart/Flutter and Rust projects get project intelligence, dependency, configuration, CI/CD and secret analysis.
Rule reference
Limitations
Taint tracking is intra-procedural, static performance findings are suspicions until measured, and Relivaro is not a
DAST tool or fuzzer. --allow-exec uses process controls, not a sandbox. Passing Relivaro does not mean software is
secure or bug-free. Details: security model.
Documentation
CLI · Configuration · Rules · HTML report ·
Plugin · Security model · Architecture ·
Release readiness · Changelog
Product family
Independent open-source tools by the same author. Each works on its own.
| |
|---|
| Markilo | Brand identity and vector design for Claude Code |
| Searvex | SEO, GEO and search intelligence with sourced audits |
| Jourilo | UX, user journeys and conversion engineering in a real browser |
| Relivaro | Software quality, security and release readiness |
The Relivaro logo and icons (assets/brand/) were designed with
Markilo.
License
Apache-2.0. Bundled tree-sitter runtime and grammars are MIT-licensed; see
THIRD_PARTY_NOTICES.md.
