AI shipped your codebase. We tell you what's actually inside — before your acquirer, investor, or new hire finds out. We ran LuxScope against express — score 84/100, 25 findings across 56 risk files, plus 23 generated handoff documents. View the report →
LuxScope — codebase intelligence scanner. Recon run against express.
terminalluxscope v0.1
LuxScope Score: 84 / 100 v0.1.0
Security 69 / 100
Complexity 67 / 100
Documentation 99 / 100
Dependencies 100 / 100
Dead Code 100 / 100
Score is the headline. The report lists findings and risk-ranked files.View sample report →
LuxFaber — agent-readiness scanner. Run against expressjs.com.
terminalluxfaber v0.1
Agent-readiness: 39 / 100 scoring v1.1
Crawl Access 73 / 100
Structured Data 0 / 100
Semantic HTML 0 / 100
Content Clarity 15 / 100
Determinism 100 / 100
Score is the headline. The report lists gates, findings and quick wins.View sample report →
Everything we build, in one place.
Infrastructure tools built for engineers. MIT where open, proprietary where not.
Intelligence. Delivered as a session.
Deterministic scanners for code, agent-readiness, and the media accessibility debt generic audits miss — each shipped as a scored, versioned report.
Codebase IntelProprietary
LuxScope
Know what breaks before you change it.
Know which files will break before you touch them. Identify the tech debt due-diligence will surface — before the investor does. Give a new hire a working mental model in one report instead of two weeks of context-gathering. Audit AI-generated code you didn't write and can't fully vouch for. LuxScope reads your codebase deterministically. It is local-first and sends no telemetry.
Sample: 40/100 · 27 files analyzed (SecGate, our own public repo)
$750 launch price (first 5 audits), then $1,500 · one-time
AI agents and AI crawlers read public websites whether you designed for them or not. LuxFaber scores your site on agent-readiness: crawl accessibility, structured data, semantic HTML, content clarity, and determinism. It does not promise that any AI product will cite your site. Same input, same score every time — no LLMs in the scoring path.
Deterministic scoring against WCAG 2.1 media and document criteria (1.1.1, 1.2.x, 2.4.2, 3.1.1) for the assets HTML scanners skip. Crawls video, audio, PDFs, Office documents, and image alt text — quantifies content accessibility debt in billable units, plus an unscored static-HTML code baseline. Same input, same score, every run. An automated scan is a prioritization aid, not a certification of ADA or legal compliance.
→1 walkthrough call of the findings, up to 60 minutes
→PDF report
TurnaroundTypical: 5–7 business days
Data residencyDeleted the day of delivery
FormatHTML + PDF + JSON
Also free for engineering teams.
Two MIT-licensed CLIs we maintain alongside LuxScope. One command, no account, same scoring discipline — built for engineers who already own the codebase, not for buyers commissioning a review.
SecurityMIT · free · zero config
SecGate
One command. One report. One exit code.
$ npx @stelnyx/secgate
Runs Semgrep, Gitleaks, osv-scanner, Trivy, and npm audit in one command. Normalizes findings into one report and fails the pipeline on CRITICAL or HIGH. Aggregation is deterministic — same inputs produce a JSON-byte-identical report every run, locked by determinism + golden snapshot tests.
Inventories every HTTP endpoint across Express, Fastify, NestJS, and OpenAPI specs. Classifies auth posture, diffs code vs spec, fails the pipeline on open writes. 100% static — no HTTP, no credentials, no running server. Same inputs → byte-identical report.
SecGate — deterministic security gate. Same inputs → same score, every run. Run against express-pin.
terminalsecgate v0.2.13
Status: FAIL · Risk 365 · rule v1
Semgrep 43 findings
Gitleaks 0 findings
npm audit 0 findings
osv-scanner 0 findings
Trivy 0 findings
Score is the headline. Report ships findings, fix order, ETAs.View sample report →
ApiGate — static API surface auditor. Run against express-pin.
terminalapigate v0.3.0
Headline: 50 / 100 FAIL rubric v1
Inventory 100 / 100
Auth Coverage 0 / 100
Open Risk 0 / 100
Spec Drift n/a
Determinism 100 / 100
Score is the headline. Report ships findings, fix order, ETAs.View sample report →
Bundle · same domain
LuxAbility + LuxFaber Audit
Both audits on one domain, with one re-scan within 30 days. $1,100 launch price (first 5 audits), then $1,800.
Pricing
One-time audits, priced by scope.
Every audit is done for you and includes one re-scan within 30 days. Typical turnaround is 5–7 business days. Prices are in USD.
LuxAbility Audit
Media and document accessibility debt report
$750one-time
$750 launch price (first 5 audits), then $1,200
Scores video, audio, PDFs, Office documents and image alt text against WCAG 2.1 media and document criteria. Not a full WCAG audit, and not a certification of ADA or legal compliance.
Scope: 1 domain, up to 200 crawled pages. Media and documents only.
Agent-readiness score across crawl access, structured data, semantic HTML, content clarity, and determinism, with a prioritized fix list. It does not promise that any AI product will cite your site.
Scope: 1 domain: a 10-page crawl of your site plus up to 3 pages you choose, each scanned individually.
The LuxAbility and LuxFaber audits run together against one domain.
Scope: 1 domain. Scopes as listed for each audit.
Multi-domain or government-wide scopes: quote separately (from $2,500). A single city, county or agency with one domain pays the per-product price above.
We run the scan first. You pay when you get the report.
Free tools: SecGate and ApiGate, MIT-licensed CLIs on npm. Scan data from audits is deleted after delivery on request.