Free scan · $-priced findings · merged fixes
Run a free scan that prices your risk in dollars, not CVSS. You get exploit-gated findings on every pull request — and each one arrives with a mergeable fix your own CI already passed.
npx @olydi/cli scan
Find and fix
Find
Exploit-gated severity plus reachability plus EPSS and KEV turn raw findings into prioritized, dollar-priced exposure on every pull request.
Fix
A reachable finding becomes a bounded branch, a readable diff, and a pull request that's already green. You review a change that's ready to merge.
Priced risk
Every reachable finding lands with its ΔEBITDA at risk — what leaving it open costs you. The scan is free, and the number is yours to keep.
How pricing works
npx @olydi/cli scan
fingerprint next 16 · node 24 · 47 of 115 capabilities apply
✖ js/missing-rate-limit app/auth/verify.ts:41 HIGH reachable
credential endpoint verifies before throttling — $340K ΔEBITDA at risk
✖ js/sql-injection src/db/users.ts:42 CRITICAL reachable
user input flows to query() without parameterization — $1.2M ΔEBITDA at risk
✓ 2,114 rule hits suppressed by reachability — no exploit path, no report
→ olydi fix FINDING-77e3 opens a gate-verified PR
Governed velocity
Quick fixes hand you a suggestion to validate. This is a pull request your own CI already passed — bounded, readable, and waiting on your approval, not your labor.
How it worksSigned fix artifact
@@ app/auth/verify.ts:38const body = credentialSchema.parse(await req.json());- const ok = await password.verify(body.password, account.hash);+ await limiter.consume(requestIp, LOGIN_POLICY);+ const ok = await password.verify(body.password, account.hash);+ await audit.append(evidencePacket(finding.id));if (!ok) return reject(401);
Evidence attached
control-family mapped; signature: ed25519 91f4e2a0See the evidence
A reachable finding becomes a fix PR, clears the gate wall, and emits signed evidence that verifies closed after merge. Open any stage and read it.
See a fixtask
evidence packet
ed25519 91f4e2a0 / control-family mapped / verified closedThe difference
Every reachable finding carries its ΔEBITDA at risk — what leaving it open costs. Severity you can take to a budget conversation.
Reachability plus EPSS and KEV plus taint proof suppress noise by construction. If we can't show you the path, we don't page you.
Scanner quick-fixes hand you a suggestion to validate. OLYDI opens a PR that's already green — you review a change that's ready.
Every merge leaves an evidence packet an auditor can open, plus a rescan that confirms closure. Your audit trail builds itself while you ship.
The gate wall
91 security and 35 QA gate families, plus your authoritative CI, run before a change asks for review. The deterministic floor always wins: a model can lower a verdict, never raise one.
Walk the gate wallfinal = min(deterministic_floor, llm_verdict)
Agent-native
Claude Code, Cursor, and Codex sessions call OLYDI over MCP: they list your findings, ask why a risk matters, check gate state, and request fixes. Every governed call is policy-evaluated, dollar-priced, and recorded to an immutable audit trail before it runs.
MCP and IDE docslist_findingsexplain_riskcheck_gate_statecreate_fix_requestFour governed tools. Policy decides before the call runs; the audit trail records it either way.