Engineering blog
Architecture deep-dives, benchmark methodology, and product updates from the team building TheAuditor, deterministic code context and polyglot SAST for AI agents.
We stress-tested TheAuditor's MCP server against our own codebase with the questions an agent asks mid-task, and tightened every answer that came back short. Each answer now comes from stored facts and says when it was cut, and a gate steers the agent to the query instead of the file.
Read post →
Before calling the release build ready, we ran it on a clean machine the way a new customer would, and hardened everything that pass turned up: safe interrupts, pinned tools, exit codes CI can trust, and a plain list of what leaves your machine.
Read post →
A benchmark proves a capability exists. It never gets to define the rule. TheAuditor writes detection logic to survive real code, and tuning a rule to chase a benchmark score is forbidden by design.
Read post →
TheAuditor recognizes 138 named frameworks, and it is not a marketing number. A CI test pins the live registry to an explicit frozen set, so the count cannot change unless someone changes the frozen list in the same commit.
Read post →
TheAuditor analyzes your infrastructure configuration through the same data-flow graph as your application code, across twelve infrastructure-as-code substrates, so misconfigurations surface as connected data-flow exits instead of isolated file-lint results that miss the context.
Read post →
Java is a first-class language in TheAuditor, and the point is how. It resolves real types with the actual Java compiler toolchain instead of matching names, so callsites, overrides, inheritance, routes, and ORM queries bind to actual resolved types.
Read post →
TheAuditor rebuilt its interprocedural taint analysis. Every confirmed dangerous flow now carries a stored, queryable, hop-by-hop proof chain, so you can see exactly how untrusted input reached a dangerous operation instead of getting an unexplained alert.
Read post →
In July we said the release was measured in days. Then we removed 62,585 net lines and rebuilt the core. Here is what 'done' actually means here, and why it is a scorecard rather than a ship date.
Read post →
The industry writes the same rule once per language: N weaknesses times M languages, maintained forever. We replaced that with one system that classifies against the public standards, so coverage grows by addition instead of by copy-paste.
Read post →
Most scanners return 'no findings' whether your code is clean or the tool simply could not analyze it. Those are opposite facts wearing the same output. We rebuilt so the tool tells you which one you are looking at, and grades its own work on every run.
Read post →
A long list of supported languages means nothing if half of them get a shallow pass. C and Solidity now get the same cross-file, source-to-sink treatment as our strongest lanes, and the analysis follows data into the infrastructure around them.
Read post →
The week we said the release was measured in days, we deleted the entire rules engine: 94,013 lines in a single commit, with nothing staged to replace it. Here is why we tore down the thing every SAST tool ships.
Read post →
TheAuditor 5.0 is in final commercial release preparation, with public availability planned for early August 2026. Here is the product promise and the internal 87% token-use result we intend to prove in the field.
Read post →
Agents burn their context budget reading whole files to answer questions a query could answer. TheAuditor hands them verified facts instead, so they stop guessing about code they never fully see.
Read post →
We pushed taint analysis deeper and are publishing the hard recall and precision numbers, not a mechanism walkthrough. Rust injection coverage is now at parity with our strongest languages, and Bash lost a class of false positives.
Read post →
The Windows and Linux binaries now produce byte-for-byte identical output across every test corpus, so a finding on your laptop is provably the same finding in CI and on a teammate's machine.
Read post →
A closed binary in your build is a fair thing to worry about. Here is the checklist a trustworthy closed-source scanner should meet, and how TheAuditor meets every item.
Read post →
TheAuditor's incremental scan now returns the same findings as a full scan, cross-file calls included. Run the fast one on every commit and trust it.
Read post →
Enterprise procurement wants a bill of materials and a clean license story before you get in the door. TheAuditor now ships both: a signed component inventory and a copyleft-free build.
Read post →
Version 5.0.0 turns TheAuditor into a release line you can trust. Every build stamps the exact commit and build time it came from, the analysis ships as a sealed, encrypted artifact, and the same adversarial scans run against the binary before it leaves the door.
Read post →
TheAuditor 5.0.0 wires its index into MCP, so an AI agent working in your repo asks structured questions (which handler serves this route, where a value comes from and goes, what's security-relevant here) and gets deterministic answers instead of a pile of files to re-read.
Read post →
TheAuditor's live-host scanner reads operational context like backported kernels, ufw rules, container limits, and nginx redirects, so its findings are accurate instead of noisy. And it never drops a result silently.
Read post →
AI agents hallucinate because they guess. TheAuditor hands them deterministic facts, and wired into the full stack, it makes file-reading agents and self-graded SAST look like relics.
Read post →
Days from public launch, we pointed our own SAST at the license server we ship on. 204 findings, 0 launch-blockers, and the false-positive rate became the next product release.
Read post →
Application code and infrastructure code live in different repos, get scanned by different tools, and stay disconnected. Then the bash script that bridges them quietly passes a tainted value into terraform apply -var.
Read post →
Every commercial SAST tool stops at the exec call. Ours doesn't. Here is what tracing a single piece of user input across multiple languages actually looks like.
Read post →
AI agents waste tokens, hallucinate relationships, and miss cross-language flows because they read files instead of querying facts. We built the database that fixes it, and the MCP server that exposes it.
Read post →
Provider freedom and serious token economics from Warden. Verified-fact code intelligence from TheAuditor. Why the pairing isn't a coincidence.
Read post →