Verify the code. Prove the quality. Ship with confidence.

Open-source CLI and Claude Code plugin that audits real codebases offline, shows the evidence behind every finding,
hands fixes to verified fixers or your coding agent, and gates releases without hiding what it did not check.

_{Relivaro's release report for its own repository (build, tests, type check and lint executed; dependencies checked on OSV.dev). English / Türkçe · light / dark / system.}

How it works

• Audit — 89 rules on tree-sitter syntax trees with taint tracking, plus project intelligence: stacks, monorepo
  units, data stores, CI/CD, routes and environment variables. Offline and read-only.
• Evidence — every finding carries file:line, a redacted snippet, facts, confidence, impact and CWE/OWASP mapping.
• Fix — 15 deterministic fixers produce a reviewable diff; everything else becomes a fix prompt for your coding agent.
• Verify — a fix must remove its findings, add none and keep your tests green, in an isolated copy, with rollback.
• Release — up to 18 gates, each marked executed, measured, static analysis or not run. Unverified is
  never a silent pass.

From findings to fixes

Start with what matters. The action center splits open findings by how they get fixed and puts the most severe root causes first: Deterministic fix — a Relivaro fixer produces a concrete patch. Agent-assisted — a coding agent investigates, changes the code and adds a regression test. Manual review — needs runtime evidence, an operational decision or approval first.
	Hand it to your coding agent. Select findings and press Generate fix prompt: an editable brief for Claude Code, Codex or any coding agent with the run id, stable finding ids, locations, evidence and permission boundaries. The agent re-checks each finding against the current code (relivaro recheck), rejects false positives and asks before changing anything. The report is one self-contained file: no network, no CDN, a strict CSP, secrets redacted.
	Every claim is checkable. Findings show the code that triggered them with the line highlighted, how to verify the fix, and whether someone reviewed them: detected, confirmed, false positive, needs verification or accepted risk (relivaro review add).

Quick start

Claude Code plugin — no npm install needed:

/plugin marketplace add cihantopac/relivaro
/plugin install relivaro@relivaro

Then run /relivaro in your project, or a single step: /relivaro:audit, :security, :performance,
:reliability, :test, :optimize, :release. Claude checks significant findings in your code and asks before
executing project commands, going online or editing anything. Plugin guide

CLI — requires Node.js 22+, no runtime dependencies, no install scripts:

npm install -g relivaro

relivaro audit . --open

relivaro release . --allow-exec --online

relivaro fix apply latest --yes --verify "npm test" --allow-exec

Reports land in .relivaro/runs/<run-id>/ (report.html, .md, .json, optional .sarif). No install:
npx relivaro audit .. All commands: docs/CLI.md.

Safe by default. Read-only and offline. Project code runs only with --allow-exec, the network is used only with
--online, and files change only through fix apply --yes — with backups and hash-guarded rollback.

Evidence

• 251 tests (unit, integration, security, end-to-end) on Linux, macOS and Windows × Node 22 and 24 in CI.
• Detection corpus: 10 fixture projects, 172 expected findings, precision and recall 100%, enforced in CI.
  A controlled corpus — real code will produce false positives and misses.
• Real repositories: validated read-only on 5 production codebases; every significant finding checked by hand
  (validation).
• Speed: a 3,060-file repository in about 1.5 s; a 241k-line monorepo in about 3 s on an Apple M4
  (benchmarks).
• Report safety: tests inject </script> payloads through analysed source; the report stays inert and makes no
  network requests.

Source-level rules cover JavaScript, TypeScript (JSX/TSX), PHP and Python; Go, Ruby, Java/Kotlin, Swift,
Dart/Flutter and Rust projects get project intelligence, dependency, configuration, CI/CD and secret analysis.
Rule reference

Limitations

Taint tracking is intra-procedural, static performance findings are suspicions until measured, and Relivaro is not a
DAST tool or fuzzer. --allow-exec uses process controls, not a sandbox. Passing Relivaro does not mean software is
secure or bug-free. Details: security model.

Documentation

CLI · Configuration · Rules · HTML report ·
Plugin · Security model · Architecture ·
Release readiness · Changelog

Product family

Independent open-source tools by the same author. Each works on its own.

The Relivaro logo and icons (assets/brand/) were designed with
Markilo.

License

Apache-2.0. Bundled tree-sitter runtime and grammars are MIT-licensed; see
THIRD_PARTY_NOTICES.md.