Automatize
Products · 07 · Code Quality Platform
← All products

Faultr

Self-hosted code quality analysis — SonarQube-grade, without the SonarQube server.

Faultr clones your repositories, builds them, and runs real analyzer plugins inside its own process. On top of static analysis it layers AI code review, a five-dimension audit suite, two adversarial review gates, architecture diagrams and an eleven-method codebase valuation. Every run is a permanent snapshot; any two can be compared.

Request a demo →Download brochure (PDF, EN) ↓
11Pipeline phases
5AI subsystems
10Dependency ecosystems
99%Instruction coverage
The problem

Code quality tooling is either a server estate or a data-egress decision.

The established option is a separate analysis server with its own database, its own upgrade cycle and a licence that scales with lines of code. The modern option sends your source to somebody else's cloud. Neither answers the question a head of engineering actually has, which is not “how many code smells” but “what is the state of this codebase, what is it worth, and can I prove it.”

01
Server estate
A second platform to run, patch and license — plus a scanner in every pipeline.
02
Source egress
Cloud analysis means your intellectual property is analysed on infrastructure you do not control.
03
Rules without judgement
Static rules never see the design problem — the god object, the missing boundary, the wrong abstraction.
04
No commercial answer
No quality tool tells you what the codebase would cost to rebuild — the number the board actually asks for.
The solution

Faultr is the scanner.

01
No server to deploy
Faultr implements the analyzer plugin interface itself and drives industry-standard analyzer JARs directly, in its own process, against a working tree it clones and builds. Drop in a plugin JAR, or pull one from the public catalogue, and it runs.
02
The build is the first gate
If the code does not compile, that is the finding — everything downstream is skipped rather than reported against stale artefacts.
03
Runs air-gapped
One Spring Boot application against one PostgreSQL database, installed by a browser wizard, with no telemetry and no call home. Point the model layer at a local endpoint and the entire platform runs air-gapped.

Built to fail honestly.

01
Absent is not zero
A missing vulnerability report produces no metrics rather than zeroes, so a project cannot pass a vulnerability gate by never having been scanned.
02
Cancellation is real
Stop kills the entire build process tree, checkpoints at every phase boundary, and refuses the final save — a stopped run stores nothing and never becomes “the latest analysis.”
03
Faults are isolated
A plugin that throws becomes a recorded warning with its stack trace, and the analysis continues — one bad analyzer never costs you the run.

Capabilities

01Repositories & the quality model
  • A project is one Git repository, with its own branch, build command, test command, timeout and environment.
  • Provider integration with GitHub, GitLab, Gitea, Forgejo and Codeberg — including self-hosted instances — with token-based cloning.
  • Per-project polling schedule, with head-ahead detection when the branch moves past the last analysis.
  • Quality profiles per language, inheritable, with severity and parameter overrides, snapshotted into every run so a report stays reproducible.
  • Quality gates with metric conditions on overall or new code, and three curated presets: strict, balanced and lenient.
  • Suppressions on three combined axes — rule, file pattern and severity band — with a live preview of matches, and staleness measured rather than guessed.
02Five AI subsystems
  • Code review of only the files changed since the last analysed commit — summary, risks, naming, design and suggestions per file, plus an overall risk verdict.
  • An audit suite across security, performance, compliance, quality and functional dimensions, each scored out of a hundred with a letter grade and individual findings.
  • Two review gates — a constructive architectural peer review, and an adversarial red-team pass over authorisation, concurrency, database safety, data integrity and input validation.
  • Custom AI sensors you author yourself, which become first-class rules participating in profiles and gates like any static rule.
  • AI-generated analyzer plugins: describe a rule in plain language, review the generated source, compile it, and have the rule active in your profile.
  • Thirteen model providers, seven of them local or self-hosted, with encrypted keys, connectivity tests and monthly token and cost reporting.
03Architecture visualisation
  • Five diagram types — class, sequence, state, entity-relationship and dependency.
  • Per-project configuration of included packages, depth, detail and limits.
  • Architectural rules such as no-circular-packages, with violations listed under the dependency diagram.
  • Pan and zoom, source copy, SVG and PNG export, and comparison against the previous snapshot with an optional plain-English summary of changes.
  • An ad-hoc sequence explorer that traces any method against the live working tree — and states explicitly what it could not resolve.
04Snapshots, comparison & valuation
  • Every completed run is an immutable snapshot with commit, branch, author, phase timings and gate verdict.
  • Compare any two runs: metric deltas, issues classified as new, resolved or persisting, and changes to build status, gate status and the AI summary.
  • Chart any metric across a project's entire history, with a click-through to the snapshot behind any point.
  • Eleven valuation methods — two COCOMO variants, four function-point methods, reproduction cost, an AI-assisted delivery model, a documentation model and a headline pre-revenue asset figure.
  • Every figure explains itself: measured inputs, formula, substituted numbers and intermediates are recorded as the number is computed.
  • Export as PDF with a full derivation appendix, or as a spreadsheet where every derived cell is a live formula over named assumption cells.
05Audit trail & administration
  • Append-only by construction and by database trigger — an update or delete attempt is refused at the database, not merely discouraged in code.
  • A SHA-256 hash chain over a canonical encoding, with a gapless sequence guaranteed by a database lock, and nightly verification that distinguishes tampering from a broken chain.
  • Cursor-paged export for a security information and event management system, plus correlation identifiers grouping a whole run, request or poll.
  • Two-level tenancy with a superadmin context switcher across tenants and organisations, and per-tenant concurrency fairness.
  • Plugin administration: discovery, enable, reload, update check, upgrade, redownload and catalogue sync with checksums.
  • A six-step first-run wizard that tests the database, installs the schema, creates the first account, generates secrets and writes a service unit — in fourteen languages.
■Java 21 on Spring Boot 4, single JAR or system service; PostgreSQL 15 or later with 60 versioned migrations.
■Analyzer plugin interface implemented in-process, one isolated class loader per plugin, cached across runs.
■Works with any build tool — Maven, Gradle, npm, dotnet, Python and anything else that runs in a shell.
■REST API with OpenAPI, a uniform response envelope, and typed request/response objects throughout.
■Native metrics across 18 file types, dependency parsing across 10 ecosystems, analyzer plugins for Java, JavaScript, TypeScript, Python and XML out of the box.
■Roughly 66,000 lines of application code, 55 entities, 243 test files; 99% instruction and 98% branch coverage on the in-scope bundle.

What it does

  • 01No analysis server to deploy — Faultr drives real analyzer plugins itself, in its own process, against a build it clones and runs.
  • 02Five AI subsystems on top of static analysis: code review, an audit suite, two adversarial review gates and AI-generated rules.
  • 03An eleven-method codebase valuation with a live spreadsheet, so a reviewer can change an assumption and watch the number move.

At a glance

For whomRegulated IT · Defence · Due Diligence · Platform Teams
LicenceLicensed per installation or per tenant — analysing a hundred repositories or a thousand does not change the price. It runs against your own model keys with no code leaving your network, priced as an annual fee on your own turnover (from €900 minimum, with yearly increases capped at 25%). Every tranche includes unlimited users, projects and organisations in one tenant, plus self-hosting and support; hosting, hardware and AI model costs are your own, and consultancy is quoted separately.

Faultr in your organisation?

Start the conversation →