Kuvryn Scout
AI code reviewCode review that never stops. Real defects get filed once, and every decision your team makes is remembered.
Keeps reviewing your GitHub and GitLab repositories with standard analysers and AI rules, and files what it finds as issues without repeating itself.
Reviews go stale. Scanners flood the backlog
A one-off audit finds problems once, and it’s out of date by the next release. Automated scanners report the same issue on every run. Ask an AI reviewer to find defects and it will find some, whether they exist or not. Before long the team stops reading the output, and the real bug sits somewhere in the noise.
Why it’s built the way it is.
Findings with a memory
Each finding is a lasting record with its own history. Once your team closes one as a false positive, or chooses to ignore it, it is never filed again. A fixed bug that comes back is reopened as a regression.
Designed to keep false positives down
A model’s claim has to name the input that breaks the code and say what it checked. Then a second model tries to refute it. Refuted candidates are set aside, not filed.
Converges, then follows the changes
A new repository gets repeated passes from different angles until they stop turning up anything new. From then on, Scout reviews each change and the code that calls it rather than rescanning everything.
Your infrastructure, your models
Scout is a single service on your own servers. It talks to any OpenAI-compatible model endpoint, local models included, and you decide which model does which job.
From setup to everyday use.
- 1
Connect repositories
Add GitHub, GitLab (cloud or self-hosted) or any Git repository. Scout clones it and maps functions, callers, and the places where untrusted data enters and can do damage.
- 2
Converge
Standard analysers and AI review rules run over the code, one perspective per pass: correctness, security, concurrency, performance and others. This continues until new findings dry up.
- 3
Check and de-duplicate
Every candidate meets a verifier that tries to refute it. Then comes a four-step duplicate check: exact match, same symbol, semantic similarity, and an AI judgement kept for the close calls.
- 4
File and sync issues
Confident findings become short GitHub or GitLab issues. Weaker ones wait in a review queue. Close an issue, or label it a false positive, and Scout updates.
- 5
Follow every change
When commits land or pull requests merge, Scout reviews the change and the code it could break. It also re-checks resolved findings for regressions.
See Kuvryn Scout at work.
What it does, in detail.
Analysis
- Standard analysers bundled Semgrep, gosec, staticcheck, govulncheck, osv-scanner, gitleaks, ruff, oxlint, shellcheck, cppcheck and hadolint all ship in the image.
- AI rules by taxonomy Security rules follow the CWE Top 25 and the OWASP Top 10. Reliability, performance, correctness and per-language idiom rules sit alongside them.
- Many languages Go in full depth. TypeScript, JavaScript, Python, Java, Kotlin, C#, Rust, Ruby, PHP, C, C++ and others too.
- Focused context The model sees the function, its callers and callees, and any path from an entry point to a risky call. It does not get the whole repository.
- Change review A single model reads the diff of a push and follows the affected code. It finishes in minutes.
Findings and triage
- Evidence on every finding The code, the reasoning, a suggested fix, the verifier’s verdict, and when the finding was first and last seen.
- Durable decisions Resolved, ignored and false-positive decisions are stored with their reason. Every later scan respects them.
- Learns from triage A well-explained dismissal turns into a repository fact that suppresses matching candidates. Every fact is listed, and any of them can be switched off.
- Two-way issue sync Issues carry a hidden marker. Closing or labelling one on GitHub or GitLab updates the finding behind it.
- Refuted list Candidates the verifier rejected are kept for review. Nothing is dropped silently.
Cost and control
- Model roles Six roles (context, analysis, deep review, verification, adjudication, embedding), each with its own model. Cheap models handle the bulk of the work.
- Daily quotas Cap tokens, spend and analysis minutes per repository per day. A scan that reaches the limit stops and tells you so.
- Usage and cost reporting Spend, tokens and call times per model and per role. Cost estimates use the prices you set.
- Scan triggers On a schedule, on new commits, on merged pull or merge requests. Or any combination.
- Pause, resume, cancel Long scans can be paused and resumed. After a restart they carry on from where they stopped.
Access and integration
- Roles and teams Built-in and custom roles with view, edit and admin rights per area, scoped to the instance, to an organisation or to specific repositories.
- Audit log Every privileged action, login and decision is logged with who, what and from where. Export it to CSV.
- REST API Anything the console does is also available through a documented OpenAPI 3.1 API with personal API keys.
- MCP server AI agents can read findings, record decisions and run scans. They get the same permissions and the same audit trail as a person.
Who uses it, and for what.
Security review of in-house systems
Keep payment, customer and integration services under continuous review for injection, SSRF, broken authorisation and leaked secrets. Findings are filed where developers already work.
Reviewing AI-written and outsourced code
When AI assistants and vendors produce more code than people can read, Scout reviews every change and the code it touches.
Taking over a legacy codebase
Point Scout at an inherited repository and let it converge. You come away with a de-duplicated list of real problems, and coverage showing what has been examined.
At a glance
- Runs on
- Your own servers or Kubernetes (container image and Helm chart), with the console built in
- Requirements
- PostgreSQL 17 with pgvector, and an OpenAI-compatible model endpoint (local or cloud)
- Integrates with
- GitHub, GitLab (cloud and self-hosted) and any Git remote; MCP clients
- Languages
- Go, TypeScript, JavaScript, Python, Java, Kotlin, C#, Rust, Ruby, PHP, C, C++ and others
- Access
- Email and password sign-in, roles, teams, organisations, API keys and an audit log
- Built with
- A Go backend, a React console and a REST API described in OpenAPI 3.1
Questions
Does our code leave our network?
Scout runs on your infrastructure and sends code only to the model endpoints you configure. Make those local models and nothing leaves your network.
How do you stop it filing false positives?
Every claim has to name a concrete trigger, and a separate model tries to refute it. Uncertain findings go to a review queue instead of becoming issues. And because your dismissals are remembered, the same false positive is never filed twice.
Can repository content trick the AI?
Code always reaches the model as data, never as instructions, and the analysers run under a fixed allow-list. Scout never executes the repository’s own code.
What does it cost to run?
Model spend depends on your repositories and the models you pick; daily quotas per repository keep it bounded. Licence pricing depends on the number of repositories and how you deploy. Book a demo.
AI that writes code to senior standards, with memory and context.
Procoder
Quality gates for AI coding agents. Work that is untested, unformatted or unfinished doesn't get to call itself done.
Learn moreKnowledge baseKryton
A self-hosted knowledge base with wiki links and a knowledge graph. Your team and your AI assistants read and write it together.
Learn moreAI memoryNovamem
A memory service for AI agents. They remember what matters between conversations, privately for each person or shared across a project.
Learn moreAI software factoryNovaForge
A self-hosted Git platform where AI agents pick up work in isolated runs. Quality gates and an independent review decide what gets merged.
Learn moreDeveloper SDKgo-ai-sdk
An open-source Go library for building AI features across 40 providers: text and streaming, structured output, tools, embeddings, images and speech.
Learn moreSee it on your own data.
We run the demo with your data, then propose a scope and pricing.