Developer tools

An open source scanner that runs where you commit.

rvl scans your codebase for reliability risk, in your terminal, in seconds. It is open source under Apache 2.0, and your code never leaves the machine.

Run your first scan free View on GitHub

rvl — terminal

$ rvl scan

spec cache 2026-08-20.a660ca56 (schema 1, Current)

sites 1 | specs 60 | unparseable lines 0

judgments 18 (from the signed cache)

■ BLOCKING

orderbot/notify.py:6 — secret.stripe_secret_key — hardcoded Stripe live secret key

severity: high

control RC-043 · explain: rvl explain ndbn

■ ADVISORY

Dockerfile (stage:0) — dep-manifests dockerfile.base_image_pin — not one of digest, tag

severity: medium

control RC-041 · explain: rvl explain gim6

✗ blocked — fix or suppress 1 blocking finding to commit

Install it, scan, and gate the commit

Five commands take you from nothing to a gated commit. rvl doctor tells you what is missing on this machine for this repo, and how to fix it.

rvl — quick start

$ brew install --cask revelara-ai/tap/rvl

$ rvl init # write .revelara.yaml, install the agent skills

$ rvl doctor # what is missing on this machine, for this repo

$ rvl scan # scan the current directory

$ rvl hook install # gate `git commit` on the scan

Two scanners that work together

The deterministic scanner reads your code the way a compiler does, through the real language toolchain. Where it can resolve a call site to a reliability risk, it resolves it, and it does so the same way every time.

The agentic scan then adjudicates what is hard to decide, from a smaller surface. The deterministic scanner also runs alone. It will not catch everything the agentic scan catches, but what it does catch, it catches in seconds, while the change is still in your working tree.

rvl doctor checks the toolchain for each language in your repo

Every finding has a next step

A scan prints a finding ladder with a short id for each finding. rvl explain shows the sites, the control, and the fix.

rvl suppress writes the waiver into .revelara.yaml. A waiver is then a committed decision that your team reviews through git, and not a setting on one laptop.

rvl — one finding

■ BLOCKING (base severity elevated by incident evidence)

svc/main.py:4 — requests.get has no timeout or deadline — not at the call, not on a client or session it is built from, and not anywhere up the call chain, and requests applies no default of its own; it can hang indefinitely

severity: high

control RC-019 · explain: rvl explain bfyx

$ rvl explain bfyx # the sites, the control, the fix

$ rvl suppress bfyx --reason="…" # waive it in .revelara.yaml

A gate that gives the same answer every time

rvl hook install gates git commit on the scan. A deterministic gate matters most when an agent works in a commit loop: the agent can only commit when the gate says clean, and that only works if the gate gives the same answer each time it is asked.

Exit 0: clean
Exit 1: the scan could not complete
Exit 2: usage error
Exit 3: blocking findings remain

Your code stays on your machine

The Revelara scanner and rvl CLI run entirely within your own environment. Your source code is analyzed locally and does not leave your infrastructure; only the risk findings you choose to share are transmitted.

rvl is open source, so you can verify this in the code. rvl report shows exactly what would ever be transmitted. Read the security page.

Useful before you have a key

The scanner rules ship in two tiers. The vocabulary tier syncs without an API key, under CDLA-Permissive-2.0. When you have a key, the commercial tier layers over it. rvl cache status reports both.

Run your first scan free.

Install the CLI, scan a repo, and read the findings in your terminal. Your source code stays on your machine.

Start free trial See pricing