Eleven scanners. One verdict you can actually act on.
Every scanner has a job. The platform runs all eleven, deduplicates findings across them, and lets Eagle and Griffin reason about the combined output — instead of leaving developers to triage eleven disjoint queues.
Best-of-breed coverage across every surface.
Containers, source, secrets, manifests, infrastructure, dependencies, advisories, maintainer signals — one platform reads them all.
Grype
Package vulnerability scanning across distros and language ecosystems.
Trivy
Multi-target scanner for containers, filesystems, git repos, IaC, and Kubernetes.
License scanner
SPDX-aware open-source licence detection and policy enforcement.
Gitleaks
Secret detection in source, git history, and commit messages.
OSV scanner
OSV.dev-backed vulnerability matching for open-source packages.
GHSA
GitHub Security Advisory feed lookup and matching.
OpenSSF Scorecard
Supply-chain hygiene scoring for OSS dependencies.
Hipcheck
Heuristic risk scoring for upstream maintainers and repositories.
SonarQube integration
Pull-through of SAST findings from your existing SonarQube.
Malicious-package detection
Typosquat / dependency-confusion / known-malicious package matching.
SCC (Source Code Complexity)
Code complexity + churn metrics, used as a triage signal.
Seven feeds turn raw matches into ranked signal.
NVD + OSV
Authoritative vulnerability records and open-source advisory matching, joined by CPE and PURL.
EPSS + KEV
Exploit Prediction Scoring and CISA's Known Exploited Vulnerabilities — the signal that ranks the queue.
GitHub Advisory
GHSA enrichments with ecosystem-specific fix ranges and curated descriptions.
VirusTotal + VulnCheck
File-level reputation and curated exploit-intel feeds for high-stakes triage decisions.
Two formats. Signed at build time.
Every SBOM ships with an in-toto attestation pinned to the commit and image digest — so what you scan is what you ship.
CycloneDX
OWASP-maintained, exhaustively populated with component, vulnerability, and service metadata.
SPDX
Linux Foundation standard, ideal for licence-heavy compliance audits and regulator submissions.
Eleven queues collapse into one verdict.
Six stages from raw matches to a single, evidence-backed finding in your review queue.
Grype, Trivy, Gitleaks, OSV, GHSA, Scorecard, Hipcheck, SonarQube, malicious-package, License, SCC fire in parallel.
Findings collapsed across scanners by (component, CVE, location). One row per real issue.
NVD, OSV, EPSS, KEV, GHSA, VirusTotal, VulnCheck join in. Each finding gets a context bundle.
Wide-angle model scores reachability, blast radius, and exploitability — top candidates surface first.
Heavy-reasoning pass hypothesises exploit chains, runs adversarial disproof, attaches a patch suggestion.
One row, one verdict, full evidence bundle. SBOM attestation regenerated on each build.
One row, one verdict, one ranked evidence bundle — every finding is replayable from raw scanner output forward.
Eleven scanners. One queue worth working.
Run the suite against your repo and see the deduplicated, enriched, model-ranked verdict the disjoint queues never give you.