Services · The 14 services we provide today

14 services.
One engine.

Every workflow on this page is backed by the same deterministic, local-first, structural retrieval engine — sub-millisecond P99, $0 per query, no LLM in the read path. Pick the service that solves your most expensive fire this week. Click in for the side-by-side math, the auditor-grade evidence pack, and the install commands you can paste into your repo today.

Sign in — free key → How it works Read the papers
New · v0.26.0 — slash-command deliverables

Two skills, two branded PDFs, one slash command each.

Type the slash command in your AI agent. Get a branded, A4-paginated PDF in 5-15 minutes. Standards-aligned (arc42 / IEEE 1016 / AICPA TSC 2017 / C4 / MADR). $0 retrieval, file:line citations, re-runnable on every release.

NEW
/code-documentation →

Code documentation in minutes, not weeks.

Type /argos-corporate-delivery in your AI agent. Get an arc42-compliant, branded PDF documenting architecture, APIs, operations, security, code map, and project closure — produced from your repo in 5-15 minutes. Standards: arc42, IEEE 1016, ISO/IEC/IEEE 26515, C4, MADR, OpenAPI 3.x.

Sounds familiar?
  • "Acquirer's M&A diligence team asked for our architecture docs. We had three days. The team spent two weekends rebuilding the C4 diagrams from scratch."
  • "New CTO wants 'a real architecture doc by end of quarter'. Last attempt was a 40-page Confluence page that was 30% correct on day 30."
  • "Tech-writer agency quoted $35K for a delivery package. The output ages in 90 days. We need it re-runnable on every release."
Buyer: Eng Lead / CTO · Severity 8/10 · Cycle: per-release
NEW
/soc-2-compliance →

SOC 2 evidence from your code, in 5 minutes.

Type /argos-soc2-prep in your AI agent. Get a 13-bucket SOC 2 evidence package mapped 1:1 to AICPA Trust Services Criteria 2017 (CC1-CC9 + A/C/PI/P) — file:line citations, structural proof of every control. Pairs with Vanta, Drata, SecureFrame.

Sounds familiar?
  • "Auditor said our CC6.1 evidence was 'narrative-heavy'. They wanted the actual code paths every authenticated route flows through. The team grep-walked it for 11 days."
  • "SOC 2 Type II in 8 weeks. Last cycle: 4-6 weeks of evidence collection, $80K external auditor, three exceptions because two paths were missed."
  • "Vanta tracks our policies. Drata collects our checkboxes. Neither walks our call graph. The auditor still asks for code-path proof."
Buyer: CISO / GRC · Severity 9/10 · Cycle: 6-12 months

All 14 services at a glance.

Scroll for one-line plain-English explanations + tier + ship status. Drill into any service below for the side-by-side math, the auditor-grade evidence pack, and the install command.

# Service Status What it does for you
1 SAST Triage Live Cuts your scanner noise from 47,000 alerts to 89 actually exploitable findings. Plug-in to Snyk / Checkmarx / Semgrep — keeps your tool, removes the false positives.
2 Compliance Audit Prep Partial Auditor-ready evidence packs for HIPAA, SOC 2, PCI-DSS audits. Core mechanism live; per-framework export templates ship Q3 2026.
3 Agent Token Burn Live Cuts your AI coding agent's monthly token bill by 73%. Same agent, same model — just zero re-grep / re-read loops between turns.
4 M&A Code Due Diligence Live Code DD on a one-week clock. Tech debt mass, dead code, security posture, architecture clarity — all polyglot, workspace-aware, repeatable per deal.
5 Refactor Safety Live See every caller of any function in 47 ms across any codebase >100k LOC. Stop the "we touched chargeUser() and prod broke" cycle.
6 New-Hire Onboarding Live Day-zero to first PR in days, not 6 weeks. Code tour, naming conventions, hub-function map — delivered straight into the new dev's IDE.
7 Safety-Critical Certification Partial Reachability proofs for DO-178C, ISO 26262, IEC 62304. Core layer live; format-ready DO-178C reports + MC/DC coverage hooks ship Q4 2026.
8 Smart Contract Reachability Live Re-entrancy, tx.origin auth, untrusted external calls — flagged on every Solidity contract. Vyper / Move / FunC on roadmap.
9 Pen Test Triage Live Take your 200-page pen-test report, attach reachability proofs to every finding, drop the unreachable ones. Days, not weeks of remediation.
10 Agent Hallucinations Live Stops your AI agent from inventing function names. Symbol existence checked in 0.4 ms before the agent commits to a hallucinated identifier.
11 Dead Code Detection Live Find every symbol with zero callers across your monorepo. Workspace-aware (Nx / Turborepo / Cargo) so cross-package callers don't trip you up.
12 Monolith → Microservices Live See where your monolith actually has natural seams before you cut. Lists every cross-boundary call so you know exactly what becomes an API.
13 dbt Column Lineage Roadmap Trace every column through every dbt model. File-level lineage today; full column-level + manifest parsing ship Q4 2026.
14 OSS Backdoor Detection Live Catches XZ-style supply-chain attacks. Diffs your local OSS clone against the upstream tarball, classified Low / Medium / High / Critical.

All services backed by the same engine: deterministic structural retrieval, sub-millisecond P99, $0 per query, runs locally. How it works →

The three services we lead with.

FLAGSHIP
#1 · SAST Triage →

Kill 70% of your SAST queue.

Snyk and Checkmarx return 47,000 findings. Reachability proofs cut that to 89 actually exploitable. Without replacing your existing SAST tool.

Sounds familiar?
  • "You opened Snyk Monday morning. 47,212 alerts. Same volume as last quarter. Same 3 actually exploitable hidden in the noise."
  • "Your security engineer just resigned. 'I can't read another 200 false positives this week.' Audit cycle in 30 days."
  • "Board's quarterly security review is Friday. You can't honestly say which findings actually matter without 2 weeks of triage."
Buyer: CISO · Severity 10/10 · Audit cycle 30-60 days
#2 · Compliance Audit Prep →

Audit prep in 5 minutes, not 5 weeks.

HIPAA · SOC 2 · PCI-DSS · FedRAMP · SOX 404. Deterministic data-flow proofs auditors accept as-is. Complement to Drata / Vanta / SecureFrame.

Sounds familiar?
  • "Your HIPAA Type II auditor emailed: 'Send me the PII data flow diagrams by Friday.' You don't have them; the codebase moved twice since the last attempt."
  • "Last SOC 2 cycle: 7 weeks of senior engineer time, $80K external auditor. Q3 is in 8 weeks. The team hasn't recovered yet."
  • "Auditor asked: 'Can PatientRecord data reach an unsanitized log?' You answered 'we think no.' That doesn't ship a SOC 2 attestation."
Buyer: GRC / CISO · Severity 9/10 · Audit cycle 6-12 months
#3 · Agent Token Burn →

Stop burning $1,350/month per agent.

~150× token reduction on grep+read+summarize loops. Sub-millisecond. MCP-native. Drop-in for Claude Code, Codex CLI, Cursor, GitHub Copilot Chat / Agent / Workspace, plus LangChain, OpenAI Agent SDK, Anthropic SDK.

Sounds familiar?
  • "Cursor billed your team $4,800 last month. Same 5 engineers, same codebase, agent re-grepping the same files every session."
  • "Your Copilot Pro+ team blew through the monthly premium-request quota on day 17. Last 13 days = throttled tier with the slow model."
  • "Your agent took 12 LLM round-trips to find where processPayment is defined. You watched the token meter climb."
  • "Finance Slack: 'Why are agent costs up 380% this quarter?' You don't have a clean answer."
Buyer: Dev / AI eng · Severity 10/10 · Self-serve install

The next three services we close in 2026.

#4 · M&A Code Due Diligence →

Deal-defining DD on a one-week clock.

Tech debt quantification, dead code, security posture, architecture clarity for any acquisition target. Engagement-priced, repeatable, no permanent presence required.

Sounds familiar?
  • "Deal closes Monday. Your DD analyst is on day 12 of a 14-day window. They've read 4 of 47 packages. They're guessing the rest."
  • "Last acquisition, 6 months post-close: 23% dead code, 3 unfixable security holes you didn't price in. Buyer's regret."
  • "Quoted $144K for DD on a 250K LOC target. Deal team wants it in 5 days, not 3 weeks. You either compromise or pass on the deal."
Buyer: PE fund / Big4 advisor · Severity 9/10 · $25-50K / engagement
#5 · Refactor Safety →

Know every caller before you rename anything.

Find-all-callers and blast-radius proofs across any codebase >100k LOC. Local-first, deterministic, auditable. The fix for "we touched chargeUser() and three downstream services broke in prod."

Sounds familiar?
  • "You renamed chargeUser() last sprint. Three weeks later, analytics is silently dropping events — grep missed an aliased import."
  • "Your team avoids touching BillingService. Nobody knows who calls what. Tech debt compounds quarterly."
  • "PR reviewer: 'Did you find every caller?' You: 'I think so.' The senior engineer's silence said the rest."
Buyer: Senior dev / Tech lead · Severity 9/10 · Pro / Enterprise tier
#6 · New-Hire Onboarding →

From day-zero to first PR, in days.

Code-tour, naming conventions, architecture briefing, hub-function map — all delivered to the new engineer's IDE on day one. Cuts the typical 6-month ramp to under 6 weeks.

Sounds familiar?
  • "Your new senior engineer spent 4 weeks reading the wiki. Half of it is from 2024. They still can't find where billing actually lives."
  • "Median time-to-first-PR for the last 5 hires: 6 weeks. Team velocity dropped 25% during onboarding."
  • "Senior engineers spend 8h/week answering 'where is X?' Slack pings. You're paying senior rates for orientation work."
Buyer: Eng manager / VP Eng · Severity 8/10 · Enterprise tier

Services 7-9 — specialised verticals.

SOON
#7 · Safety-Critical Certification →

DO-178C · ISO 26262 · IEC 62304.

Avionics, automotive, medical-device firmware. Regulator-driven traceability matrices, requirement-to-code mappings, and reachability proofs that satisfy DAL-A / ASIL-D / Class C audits.

Sounds familiar?
  • "DO-178C audit is in 4 months. The traceability matrix is half-done; the codebase moved twice since the last revision."
  • "TÜV auditor asked: 'Prove no sensor read can reach the actuator without crossing the safety monitor.' 47 manual code walks to write."
  • "Last qualification cycle ate 30% of total engineering effort. Management is asking if there's a better way before the next program."
Buyer: Safety engineer · Severity 9/10 · $200K-2M / program
#8 · Smart Contract Reachability →

Brand-amplifying. Million-dollar exploits prevented.

Solidity / Vyper / Move / FunC reachability proofs for audit firms, DeFi protocols, exchanges. Each prevented exploit becomes a viral case study.

Sounds familiar?
  • "You audited a lending protocol last year. Re-entrancy in a function 'nobody called from external.' $40M drained 3 weeks after deploy."
  • "Quoted $80K for a 2-week audit. Client asks: 'Can you do it in 1 week?' You can't — every external call needs a manual walk-through."
  • "Protocol deploy is in 5 days. Your auditor read 8 of 12 contracts. They're tired. They sign off on the report anyway."
Buyer: Audit firm / DeFi protocol · Severity 10/10
#9 · Pen Test Triage →

Pen-test report → triaged action list in one pass.

Engagement-priced, recurring annually. Take a 200-page pen-test report, attach reachability proofs to every finding, drop the unreachable ones. Same workflow as Anti-SAST applied to manual pen tests.

Sounds familiar?
  • "Pen test report just landed: 247 findings, '90-day SLA.' Half are non-issues in dev paths. You can't prove which without manual review."
  • "You spent 2 sprints last year fixing pen-test findings. Team asks: 'Was that actually the right priority?'"
  • "Auditor wants written response per finding. 'We think this is unreachable' isn't acceptable. You need proof."
Buyer: AppSec lead · Severity 7/10 · $5-15K per engagement

Services 10-13 — adjacent territories.

#10 · Agent Hallucinations →

Stop your agent inventing function names.

Bundled with #3 (Token Burn). The Precision Layer (symbol_exists, resolve_member) gives the agent zero-cost facts before it commits to a hallucinated identifier. See /for-agents for the full pitch.

Sounds familiar?
  • "Cursor suggested userService.getUserById(). Actual method is User.findById(). You merged it. CI red on next push."
  • "Agent imported parseISO from a library that doesn't ship that export. Third time this week."
  • "Code review feedback: '60% of agent-generated code has at least one hallucinated reference.' You're the reviewer catching them."
Bundled feature · Severity 8/10 · rolled into #3
#11 · Dead Code in Monoliths →

Find what's safe to delete. With proof.

Functions with zero callers. Configs nobody reads. Routes nobody hits. Reachability-graded so deletion is fearless. Bundles cleanly with Anti-SAST and Refactor Safety.

Sounds familiar?
  • "Build takes 12 minutes. You suspect 30% of the code is unused. Can't confidently delete because of cross-package imports."
  • "You deleted a 'dead' function last quarter. Two days later, the analytics dashboard broke — referenced via a runtime registry."
  • "Team asks: 'Why does our codebase have 280K LOC?' Honest answer: 'I don't know which 60K we could delete safely.'"
Buyer: Tech lead / Eng manager · Severity 7/10 · $20-100K per cleanup
#12 · Monolith → Microservices →

Where to draw the seams.

Community detection over the call graph proposes service boundaries. Lists every cross-boundary call so you know exactly what becomes an API. One-shot decision.

Sounds familiar?
  • "Committed to extracting BillingService last quarter. Half-done. 47 unexpected callers across 8 other services."
  • "Two extraction attempts failed. Each cost a quarter of velocity + 1 production incident. Team morale tanked."
  • "Board asks for a microservice migration plan. You can't actually point at where the seams are."
Buyer: VP Eng / Architect · Severity 8/10 · $15-30K per assessment
SOON
#13 · dbt Column Lineage →

SQL transformation graph for data teams.

Trace every column through every dbt model, view, and downstream BI tool. Compete-against-the-incumbents play (Atlan / Alation / Collibra) — we win on local-first determinism and zero-cost queries.

Sounds familiar?
  • "Stakeholder: 'If I rename total_amount in order_events, what breaks downstream?' Honest answer: 'Some unknown subset of 800 dbt models.'"
  • "Your DAG has 800 models. PII flows through 200 of them. You can't prove to compliance which ones."
  • "Atlan quoted $120K/year. CFO asks: 'There's no cheaper way?' You don't have an answer."
Buyer: Data eng / Analytics lead · Severity 7/10

Service 14 — open source supply chain.

#14 · OSS Backdoor Detection →

XZ-style supply-chain attacks. Caught.

Diff your local clone against the upstream tarball. Calibrated against CVE-2024-3094, the tj-actions backdoor, and Trivy attack vectors. Run before every CI build. Free for OSS, paid for foundations & large orgs.

Sounds familiar?
  • "XZ happened. SecOps asks: 'How do we verify the 120 OSS packages we depend on?' You don't have a process."
  • "An upgrade landed in main last week. Tarball was 30 KB bigger than the git diff suggested. You can't tell if that's normal."
  • "CTO: 'Are we exposed to the next CVE-2024-3094?' You said 'probably not.' That's not an answer."
Buyer: OSS maintainer / SecOps · Severity 9/10
02Or pick by role

Same engine, framed for who's asking.

Each link below opens an opinionated install + tooling guide written for that role. Same engine, same MCP server, same $0/query — different lead-in.

For AI agent builders →
MCP-native · 51 tools · drop-in for LangChain / OpenAI / Anthropic.
For Security engineers →
Attack-surface mapping, dead-code reduction, living memory for Semgrep / CodeQL.
For Claude Code · Codex · Cursor →
One install. Your agent remembers the repo across sessions.
For GitHub Copilot →
Cut Copilot Pro+ premium-request burn 73% on Chat / Agent / Workspace. Honest scope: inline Tab stays Microsoft's.
For MCP developers →
Drop-in MCP memory server. Rust core, stdio transport, zero-panic.
For Enterprise & Regulated →
Air-gapped deployment. HIPAA · GDPR · PCI-DSS reachability proofs.
For Shopify agent builders →
Liquid + Dawn memory so your agent stops re-reading sections on every turn.
03Next

Free key, one repo, paste-and-go.

Sign in with GitHub → · How it works · Read the three papers · All 44 skills · 51 MCP tools · Talk to engineering