Local code security review for AI-assisted engineering teams.

Code Radar gives developers, coding agents, and GitHub Actions one local-first quality gate for security, dependencies, secrets, and AI-generated code risk.

Install Radar

$ radar scan . --quick

radar scan . --quick Passed with warnings

License validation online

Inventory 412 files

Security rules 12 findings

Dependency audit 3 advisories

Report export SARIF + HTML

Merge signal 78 Block high-risk changes before review.

critical SQL injection risk src/api/payments.ts:42

high Hardcoded secret services/auth/.env:12

medium Vulnerable transitive package Cargo.lock

GitHub Actions PR gate

Code Radar Check failed

1 critical, 2 high. SARIF uploaded to code scanning.

MCP server Agent-ready

scan_project_summary
explain_finding
run_quality_gate

No source upload Scans run in the local workspace or GitHub runner.

License checks only Entitlement validation does not send repository contents.

CI-ready evidence SARIF, JSON, HTML, and terminal output from one engine.

Agent workflow MCP tools expose findings without turning review into chat.

Proof before promises.

Enterprise buyers do not need another security scanner claim. They need to know where it runs, what it sends, how it fails, and what evidence reviewers get.

Local-first

Use Radar before code reaches a hosted review service.

Fail closed in CI

Repository slots and GitHub Actions validation protect paid plans from shared keys.

Cross-platform

Designed for macOS, Windows, Linux, and GitHub-hosted runners.

Auditable output

Every finding carries severity, location, reason, fix path, and export formats.

One scanner across local work, agents, and CI.

The same scan engine powers the CLI cockpit, MCP tools, and GitHub Actions quality gates, so findings do not change shape between developer workflow and pull request enforcement.

Local CLI

Run fast or full scans before commit, inspect findings, export reports, and keep cache local.

radar scan . --quick

TUI cockpit
Fast/full profiles
Local report cache

MCP server

Expose project summaries and findings to Codex, Claude, Cursor, and other MCP clients.

radar mcp install all

explain_finding
fix_prompt
quality_gate

GitHub Actions

Fail risky pull requests, publish SARIF, and leave reviewers with a short action plan.

radar scan . --format sarif --fail-on high

PR annotations
Threshold gates
Repo slot validation

Developer-loop utilities without another dashboard.

Radar adds the small surfaces developers actually use after the first scan: local hooks, trend history, badges, and agent-ready repair prompts.

Pre-commit hook

Block high-risk findings before they become commits.

radar hook install

Trend history

Track whether security, code health, and slop scores are improving.

radar trend

README badge

Publish the latest local Radar signal without a hosted dashboard.

radar badge

Agent handoff

Give coding agents scoped repair context tied to real findings.

radar prompt . --diff --copy

Coverage for code that moves faster than review.

Radar focuses on the risks AI coding accelerates: unsafe data flow, committed secrets, vulnerable dependencies, generated-code duplication, oversized files, and missing review evidence.

Security

Injection, risky auth, traversal, unsafe APIs.

SEC-SQLI-001: untrusted input reaches raw SQL

Secrets

Hardcoded tokens, env leaks, private keys.

SECRET-KEY-001: API token committed in config

Dependencies

RustSec, GHSA, lockfiles, supply-chain risk.

SCA-GHSA: vulnerable transitive package

Code health

Duplication, large files, complexity, dead code.

SLOP-DUP-001: duplicate block detected

AI slop

Brittle generated code and low-signal changes.

SLOP-SIZE-001: oversized source file

Reports

Terminal, SARIF, JSON, and HTML evidence.

radar scan . --format sarif --fail-on high

Sample report

Merge readiness evidence your team can inspect.

A Radar report is not just a score. It includes file locations, severity, why the finding matters, how to fix it, and export formats for CI or code scanning.

Security: 78
Code health: 91
Files: 412

Severity Rule Finding Location

critical SEC-SQLI-001 Untrusted input reaches raw SQL construction src/api/payments.ts:42

high SECRET-KEY-001 Hardcoded token committed in configuration services/auth/.env:12

medium SCA-GHSA-9422 Vulnerable transitive dependency in lockfile Cargo.lock

info SLOP-SIZE-001 Oversized source file is hard to review safely src/routes/admin.ts:1

Report formats

Security posture that can survive procurement questions.

Radar is built around local execution, explicit entitlement validation, hashed licensing data, and portable reports. The product should be inspectable before a team relies on it in CI.

Security model No source upload, hashed licensing secrets, metadata-only telemetry, and fail-closed paid commands. CI model GitHub Actions validation uses repository slots and runs in the runner environment. Agent model MCP exposes structured findings and repair prompts without giving agents a cloud scanner dependency.

Plans map to real workflow boundaries.

Solo is local-only. Pro and Studio add repository slots for GitHub Actions and broader agent/CI workflows.

Capability Solo Pro Studio

Machines 1 2 3

Repository slots for CI 0 10 25

GitHub Actions gate No Yes Yes

MCP server Local only Included Included

Reports Terminal, JSON, SARIF, HTML Terminal, JSON, SARIF, HTML Terminal, JSON, SARIF, HTML

Best for Solo local scans Serious solo developer Freelancer or indie workflow

Solo

Solo local

Monthly Loading price /month

Yearly Loading price /year

1 machine 0 repos No GitHub Actions

Local CLI and TUI cockpit
Security, dependencies, secrets, code health
SARIF, JSON, and HTML reports
No source upload

Pro

Serious solo dev

Monthly Loading price /month

Yearly Loading price /year

2 machines 10 repos GitHub Actions included

Everything in Solo
Repository slots for CI validation
MCP server for coding agents
PR gate with annotations and SARIF upload

Studio

Freelancer or indie hacker

Monthly Loading price /month

Yearly Loading price /year

3 machines 25 repos GitHub Actions included

Everything in Pro
More machines and client repos
Agent-ready repair prompts
Best fit for repeat review workflows

Documentation for rollout, not just install.

Start locally, activate a license, add MCP tools, then enforce the same checks in CI when the repository is ready.

Operational quick start

Install Radar, run a fast scan, inspect the report, and add MCP or GitHub Actions only when that workflow needs enforcement.

radar scan . --quick
radar mcp doctor
radar scan . --format sarif --fail-on high

Review generated code before it becomes review debt.

Run Radar locally, give agents deterministic findings, and block risky pull requests with the same evidence.

Install Radar Read the docs