Solutions
Use case
Stop the risky change before it merges.
Every other reliability tool acts after the page. rvl acts on the diff in front of you, and a blocking finding stops the commit and tells you why.
rvl — terminal
$ rvl scan
spec cache 2026-08-20.a660ca56 (schema 1, Current)
sites 1 | specs 60 | unparseable lines 0
judgments 18 (from the signed cache)
■ BLOCKING
orderbot/notify.py:6 — secret.stripe_secret_key — hardcoded Stripe live secret key
■ ADVISORY
Dockerfile (stage:0) — dep-manifests dockerfile.base_image_pin — not one of digest, tag
✗ blocked — fix or suppress 1 blocking finding to commit
One command installs the gate
rvl hook install gates git commit on the scan. It runs as a pre-commit or a pre-push hook. In CI, branch on the exit code: 3 means blocking findings remain.rvl — quick start
$ brew install --cask revelara-ai/tap/rvl
$ rvl init # write .revelara.yaml, install the agent skills
$ rvl doctor # what is missing on this machine, for this repo
$ rvl scan # scan the current directory
$ rvl hook install # gate `git commit` on the scan
Blocking and advisory are different things
Severity says how bad a finding is. Disposition says if it stops your commit.
rvl groups findings into BLOCKING and ADVISORY, and only blocking findings close the gate. The rest is a report.The same answer every time
The gate uses the deterministic scanner, which reads your code through the real language toolchain. It gives the same answer each time it is asked, in seconds, while the change is still in your working tree.
It will not catch everything the agentic scan catches. That is the trade: a gate must be fast and repeatable, and the full scan goes deeper when you ask for it.
A waiver is a reviewed decision
When a finding does not apply,
rvl suppress writes a waiver with a reason into .revelara.yaml. Your team sees it in the diff and reviews it in git, like any other change.rvl — one finding
■ BLOCKING (base severity elevated by incident evidence)
svc/main.py:4 — requests.get has no timeout or deadline — not at the call, not on a client or session it is built from, and not anywhere up the call chain, and requests applies no default of its own; it can hang indefinitely
$ rvl explain bfyx # the sites, the control, the fix
$ rvl suppress bfyx --reason="…" # waive it in .revelara.yaml
Run your first scan free.
Install the CLI, scan a repo, and read the findings in your terminal. Your source code stays on your machine.