Security intelligence platform

Six clusters.
One exploit graph.

codelake runs 30+ industry scanners across code, dependencies, cloud and runtime, correlates every result into one exploit graph — then ships the fix as a reviewable PR. One platform, one queue, no alert fatigue.

Join the waitlist →
Early access opens in waves · no spam, ever
LIVE NOW Open source · Apache 2.0

Can’t wait? Start with LicScan.

Our open-source license & EU CRA compliance scanner is already shipping — a single binary for Go, Node, PHP, Python, Ruby, Rust and Java. Generate CycloneDX + SPDX SBOMs and a CRA-ready report in one command, no account required. VS Code and JetBrains plugins are free and open source too.

Get LicScan → View on GitHub
~/acme-api · licscan 
$ licscan scan . --cra
  → resolving licenses · 337 deps

  ✓ 332 permissive (MIT, Apache-2.0, BSD)
  • 4 weak copyleft (MPL-2.0, LGPL)
  × 1 viral (AGPL-3.0 — policy deny)

  CRA report → ./compliance/cra.pdf
  verdict: FAIL · exit 1
× Tool enumeration without auth42 tools exposed anonymously HIGH
× SSRF via tool argument169.254.169.254 reachable HIGH
× No rate limit on tool calls1000 calls / 30s accepted MED
✓ Auth header validationbearer token enforced PASS
✓ Prompt-injection patterns blocked~80 signatures PASS
OPEN SOURCE Apache 2.0 · runs locally

Shipping an MCP server? Audit it first.

MCP server quality is a wild west. Our open-source MCP Security Scanner audits any server — yours or a dependency’s — for tool enumeration leaks, broken auth, prompt-injection sinks, SSRF and missing rate limits. No account, runs offline.

Scan now → Get the scanner GitHub
Fix as PR
Every confirmed finding ships as a reviewable patch.
Reachability-first
CVEs scored against your actual call graph.
2-minute install
GitHub app, CLI or MCP server — pick one.
SOC 2 Type II
Audit-grade evidence, exportable any time.