What actually happens when it reads your code.
Not one pass of a model over your repository. Four, each with a different job, and the last one exists specifically to catch what the others got wrong.
Pass 1
It maps the ground
Every file, every directory, and the shape of the history. This is the cheap pass that tells the expensive ones where to look.
Pass 2
It reads for meaning
Six separate reads, each looking for one kind of thing: what your system tracks, the rules it enforces, the journeys through it, what must stay true, where it is fragile, and what nobody wrote down.
Pass 3
It argues with itself
A second look that throws out anything it cannot point at a line of code to support.
Pass 4
It writes down what it could not answer
The questions go to you rather than becoming assumptions. This is the pass most tools skip.
Connect what you already have.
Read-only, in minutes. Nothing is written back to any of it.
- Your repository
The code itself, plus its history. This is where most of the answer lives.
- Jira
Why things were built, in the words of the people who asked for them.
- GitHub ProjectsConnected, not yet read
What is in flight, so the picture is current rather than historical.
- Documents
Specs, contracts, anything written down that the code does not say.
What you hand over, and what we do with it.
The question every engineering leader asks before granting access to a codebase, answered before you have to ask it.
- Access level
- Read-only. Nothing is ever written back to a source.
- Credentials
- Short-lived, scoped per read, expired on completion.
- Between reads
- No standing access. Nothing persists on our side.
- Where it runs
- Frankfurt, eu-central-1. Encrypted at rest.
- Certification
- None yet. No SOC 2, no ISO, no DPA. Ask before you assume.
- Single sign-on
- Roadmap. Email and password only today.
The last two are on this page on purpose. A vendor that reads your entire codebase and is vague about what it has certified is telling you something, and we would rather tell you directly.
What it will not do.
The limits are the reason the rest is usable. A tool that hides them is asking you to trust a number you cannot check.
- Decide anything
- It reports a position and its evidence. You decide.
- Run your tests
- Roadmap. Kraken derives cases; nothing executes them yet.
- Watch production
- Roadmap. It reads what is committed, not what is running.
- Scan for vulnerabilities
- No security tooling exists. Do not rely on it for that.
- Count capabilities
- A known weak spot. No screen shows a capability count.