Proof Trust Use Cases Pricing Docs Case Study GitHub Sandbox
$ local-first ai code scanner

find risky AI code before CI_

Ratchet scans code from your terminal, explains the risky parts, and applies the fixes it can prove safely. Local by default, with BYOK support for AI review.

securitytypeserror handlingtestsperformancemaintainability
Run the sandbox →
install in 30 seconds · works locally · BYOK for AI review
Local by defaultNormal scans run in your terminal process.
Transparent behaviorOpen-source core and documented data flow.
BYOK AIDeep review uses your provider key directly.
CI-ready JSONClean stdout for parsers and gates.
~/acme-app — zsh
dev@~/checkout $ ratchet scan --output-json
scanning 847 files before merge
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✗ HIGH: unsanitized markdown render
⚡ MEDIUM: missing error boundary
⚡ MEDIUM: unbounded retry loop
  src/Preview.tsx:42 ┆ escape rendered HTML
  src/api.ts:89 ┆ cap retries with backoff
  src/App.tsx:17 ┆ wrap route with boundary
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⏱ completed in 2.3s · JSON starts cleanly
★ score: 72/100 · 2 safe fixes available
dev@~/acme-app $
$ what it catches
security

Risky AI Defaults

Flags unsafe rendering, broad permissions, exposed secrets, and injection-prone patterns before review fatigue misses them.

types

Generated Type Holes

Finds any-casts, unchecked JSON, nullable path mistakes, and contract drift that usually surfaces as production weirdness.

errors

Missing Failure Paths

Looks for swallowed errors, missing boundaries, unbounded retries, and brittle async flows.

tests

Coverage Gaps

Points to risky changed files without coverage and helps prioritize tests around real blast radius.

performance

Slow-by-Accident Code

Surfaces N+1 calls, unnecessary rerenders, blocking loops, and avoidable startup work.

architecture

Complexity Creep

Tracks module weight, coupling, and maintainability drift so generated code does not silently calcify.

$ 30 second path
01

Install

npm install -g ratchet-run. No account, browser, or hosted workspace.

02

Scan

ratchet scan --output-json returns parser-clean findings for terminals, bots, and CI.

03

Fix

ratchet improve applies safe fixes, leaves judgment calls for humans, and writes a local report.

$ real proof

Dogfooded on Ratchet itself

The CLI smoke suite now checks that ratchet scan --output-json starts with valid JSON, after a real stdout pollution bug was found and fixed during handoff verification.

Machine-readable output

CI can parse scan results without scraping terminal art. That makes the product useful to agents, GitHub Actions, and release scripts immediately.

Transparent scoring

The scoring docs publish the dimensions and weights instead of asking teams to trust a mystery number.

$ trust model

MIT Licensed

Fully open source core. Fork it, extend it, ship it.

Founder-built by kcemate

Built in public as a focused developer tool, not a borrowed wrapper pitch.

Transparent Data Flow

Local scans stay in your terminal. Networked features and their data paths are documented rather than hidden behind a blanket claim.

Your Code Stays Local

Normal scans run locally. AI-powered deep scans are opt-in and send scoped snippets only to the model provider you configure.

CI-Friendly Output

JSON and SARIF output fit existing automation without forcing a hosted dashboard into the loop.

BYOK AI Review

Bring your own API key for deep analysis and fixes. No Ratchet server sees your repository.

$ product lanes

Community

For developers and agents that need a fast local scan before committing generated code.

  • Unlimited local scans
  • Deterministic fixes
  • CI, JSON, and SARIF output

Pro

For one developer who wants Ratchet to move from diagnosis into test-gated improvement.

  • ratchet improve
  • ratchet torque
  • BYOK and local model support

Team

For small teams that need the Pro workflow across contributors without paying by repository.

  • 5 active contributors included
  • Unlimited repositories
  • Additional contributors at $12/month
$ quickstart
~/new-project — zsh
you@~/new-project $ npm install -g ratchet-run
you@~/new-project $ ratchet init
  ✓ detected: TypeScript, React, Node.js
  ✓ created .ratchet.yml
you@~/new-project $ ratchet scan --output-json
  ★ score: 72/100 — 14 findings, valid JSON
you@~/new-project $ ratchet improve
  ✓ fixed 11/14 · score: 91/100
you@~/new-project $
Works with TypeScript, JavaScript, Python, Go, Rust, and more.
$ pricing

Pay for the developer workflow, not repository count. Every plan stays BYOK/local-model friendly.

$0
Free forever
Community
  • Unlimited local scans and projects
  • Safe deterministic fixes
  • CI, JSON, and SARIF output
  • BYOK deep analysis
  • Unlimited public repositories
Get Community
$79/mo
or $790/year
Team · 5 contributors
  • Everything in Pro
  • 5 active contributors included
  • Unlimited repositories
  • One plan for the team workflow
  • $12/month per additional contributor
Buy Team

Enterprise

For organizations that need procurement support, a security review, or deployment requirements beyond self-serve. We’ll scope the plan around what Ratchet can support today.

Contact sales

Secure hosted checkout. Ratchet never handles or stores your card details.

$ visual proof

GitHub PR comment

Ratchet: 72/100
HIGH src/Preview.tsx:42
escape rendered HTML

2 safe fixes available

Before / after

- dangerouslySetInnerHTML={{__html: md}}
+ <SafeMarkdown source={md} />

CI gate

pass when score stays above threshold and no critical findings ship.

$ run it once before you merge

Paste code in the sandbox or install the CLI. The first useful moment should happen before a sales page would even finish loading.

Run sandbox →
Community is free forever · paid plans stay BYOK/local-model friendly
Built by kcemate · MIT core · transparent scoring · tested on Ratchet itself