Faultr
Self-hosted code quality analysis — SonarQube-grade, without the SonarQube server.
Faultr clones your repositories, builds them, and runs real analyzer plugins inside its own process. On top of static analysis it layers AI code review, a five-dimension audit suite, two adversarial review gates, architecture diagrams and an eleven-method codebase valuation. Every run is a permanent snapshot; any two can be compared.
11Pipeline phases
5AI subsystems
10Dependency ecosystems
99%Instruction coverage
The problem
Code quality tooling is either a server estate or a data-egress decision.
The established option is a separate analysis server with its own database, its own upgrade cycle and a licence that scales with lines of code. The modern option sends your source to somebody else's cloud. Neither answers the question a head of engineering actually has, which is not “how many code smells” but “what is the state of this codebase, what is it worth, and can I prove it.”
01
Server estate
A second platform to run, patch and license — plus a scanner in every pipeline.
02
Source egress
Cloud analysis means your intellectual property is analysed on infrastructure you do not control.
03
Rules without judgement
Static rules never see the design problem — the god object, the missing boundary, the wrong abstraction.
04
No commercial answer
No quality tool tells you what the codebase would cost to rebuild — the number the board actually asks for.
The solution
Faultr is the scanner.
01
No server to deploy
Faultr implements the analyzer plugin interface itself and drives industry-standard analyzer JARs directly, in its own process, against a working tree it clones and builds. Drop in a plugin JAR, or pull one from the public catalogue, and it runs.
02
The build is the first gate
If the code does not compile, that is the finding — everything downstream is skipped rather than reported against stale artefacts.
03
Runs air-gapped
One Spring Boot application against one PostgreSQL database, installed by a browser wizard, with no telemetry and no call home. Point the model layer at a local endpoint and the entire platform runs air-gapped.
Built to fail honestly.
01
Absent is not zero
A missing vulnerability report produces no metrics rather than zeroes, so a project cannot pass a vulnerability gate by never having been scanned.
02
Cancellation is real
Stop kills the entire build process tree, checkpoints at every phase boundary, and refuses the final save — a stopped run stores nothing and never becomes “the latest analysis.”
03
Faults are isolated
A plugin that throws becomes a recorded warning with its stack trace, and the analysis continues — one bad analyzer never costs you the run.
Capabilities
01Repositories & the quality model
- A project is one Git repository, with its own branch, build command, test command, timeout and environment.
- Provider integration with GitHub, GitLab, Gitea, Forgejo and Codeberg — including self-hosted instances — with token-based cloning.
- Per-project polling schedule, with head-ahead detection when the branch moves past the last analysis.
- Quality profiles per language, inheritable, with severity and parameter overrides, snapshotted into every run so a report stays reproducible.
- Quality gates with metric conditions on overall or new code, and three curated presets: strict, balanced and lenient.
- Suppressions on three combined axes — rule, file pattern and severity band — with a live preview of matches, and staleness measured rather than guessed.
02Five AI subsystems
- Code review of only the files changed since the last analysed commit — summary, risks, naming, design and suggestions per file, plus an overall risk verdict.
- An audit suite across security, performance, compliance, quality and functional dimensions, each scored out of a hundred with a letter grade and individual findings.
- Two review gates — a constructive architectural peer review, and an adversarial red-team pass over authorisation, concurrency, database safety, data integrity and input validation.
- Custom AI sensors you author yourself, which become first-class rules participating in profiles and gates like any static rule.
- AI-generated analyzer plugins: describe a rule in plain language, review the generated source, compile it, and have the rule active in your profile.
- Thirteen model providers, seven of them local or self-hosted, with encrypted keys, connectivity tests and monthly token and cost reporting.
03Architecture visualisation
- Five diagram types — class, sequence, state, entity-relationship and dependency.
- Per-project configuration of included packages, depth, detail and limits.
- Architectural rules such as no-circular-packages, with violations listed under the dependency diagram.
- Pan and zoom, source copy, SVG and PNG export, and comparison against the previous snapshot with an optional plain-English summary of changes.
- An ad-hoc sequence explorer that traces any method against the live working tree — and states explicitly what it could not resolve.
04Snapshots, comparison & valuation
- Every completed run is an immutable snapshot with commit, branch, author, phase timings and gate verdict.
- Compare any two runs: metric deltas, issues classified as new, resolved or persisting, and changes to build status, gate status and the AI summary.
- Chart any metric across a project's entire history, with a click-through to the snapshot behind any point.
- Eleven valuation methods — two COCOMO variants, four function-point methods, reproduction cost, an AI-assisted delivery model, a documentation model and a headline pre-revenue asset figure.
- Every figure explains itself: measured inputs, formula, substituted numbers and intermediates are recorded as the number is computed.
- Export as PDF with a full derivation appendix, or as a spreadsheet where every derived cell is a live formula over named assumption cells.
05Audit trail & administration
- Append-only by construction and by database trigger — an update or delete attempt is refused at the database, not merely discouraged in code.
- A SHA-256 hash chain over a canonical encoding, with a gapless sequence guaranteed by a database lock, and nightly verification that distinguishes tampering from a broken chain.
- Cursor-paged export for a security information and event management system, plus correlation identifiers grouping a whole run, request or poll.
- Two-level tenancy with a superadmin context switcher across tenants and organisations, and per-tenant concurrency fairness.
- Plugin administration: discovery, enable, reload, update check, upgrade, redownload and catalogue sync with checksums.
- A six-step first-run wizard that tests the database, installs the schema, creates the first account, generates secrets and writes a service unit — in fourteen languages.
06Security & governance
- Three roles with method-level authorisation across the whole surface
- Tenant and organisation isolation checked in every service — with cross-organisation reads answered as not found rather than forbidden, so an identifier is never confirmed by a refusal
- AES-256-GCM encryption at rest for repository credentials, provider tokens and model keys
- Passwords hashed with bcrypt; sessions persisted so logins survive a restart, capped per user
- Production boot refuses a shipped default encryption key or signing secret
- Strict content security policy, frame denial, cross-site request protection, trusted-proxy allow list
- Outbound request validation blocking private and loopback ranges
- Hash-chained, trigger-protected audit trail with nightly verification and event-management export
- Dependency vulnerability scanning wired into the build and gated at score seven
- Build fails on any package dependency cycle
■Java 21 on Spring Boot 4, single JAR or system service; PostgreSQL 15 or later with 60 versioned migrations.
■Analyzer plugin interface implemented in-process, one isolated class loader per plugin, cached across runs.
■Works with any build tool — Maven, Gradle, npm, dotnet, Python and anything else that runs in a shell.
■REST API with OpenAPI, a uniform response envelope, and typed request/response objects throughout.
■Native metrics across 18 file types, dependency parsing across 10 ecosystems, analyzer plugins for Java, JavaScript, TypeScript, Python and XML out of the box.
■Roughly 66,000 lines of application code, 55 entities, 243 test files; 99% instruction and 98% branch coverage on the in-scope bundle.
Industries
Who it works for
Engineering & platform teams
Continuous quality, AI review and architecture diagrams without running a second server estate or sending source code to a hosted analyser.
Banking, fintech & insurance
Tamper-evident audit, SIEM export and full self-hosting for code that is a regulated asset, and diagrams of long-lived core systems.
Government & defence
Air-gapped deployment with local models: no call home, no content delivery network, every dependency inside the artefact.
Healthcare software
Compliance-dimension auditing of your own code, alongside a hash-chained record of who analysed what and when.
Critical infrastructure
Vulnerability ingestion and gate conditions that cannot be satisfied by simply never running a scan.
Managed service providers
Tenant and organisation hierarchy with per-tenant concurrency fairness and per-organisation retention for teams analysing code for many clients.
Due diligence & IP valuation
A printed diligence dossier and an independent, reproducible valuation of a codebase, with every figure derived and every assumption adjustable.
Cost-driven migrations
Organisations reconsidering a per-line-of-code analysis licence who want the same analyzer plugins without the server or the meter.
Use cases
Example scenarios
01 · Government & defence
Code quality analysis on a network with no way out
- Challenge
- A development team on an isolated network cannot use a hosted analyser, and running a separate analysis server with its own database and upgrade cycle is one more system to accredit. Reviews therefore depend on whoever has time to read the diff.
- Approach
- Faultr is installed through its browser wizard as one application against PostgreSQL, with the analyzer plugins running in-process and the AI model layer pointed at a local model endpoint. Each project polls its internal Git server, builds, and is judged by a quality gate with the strict preset.
- Result
- Every change gets static analysis and an AI review of the changed files, and neither source code nor telemetry leaves the network.
02 · Due diligence & IP valuation
A defensible codebase figure for an acquisition
- Challenge
- An acquirer needs to know what the target's software would cost to rebuild and how healthy it is. Technical diligence usually means interviews and a spreadsheet estimate whose assumptions nobody can trace.
- Approach
- Faultr analyses the target repositories, runs the audit suite across security, performance, compliance, quality and functional dimensions, and computes the eleven valuation methods. The result is exported as a PDF with a full derivation appendix and as a spreadsheet whose derived cells are live formulas over named assumption cells.
- Result
- Every figure in the dossier can be traced back to measured inputs, and both sides of the negotiation can adjust the assumptions themselves instead of arguing about a single number.
03 · Banking, fintech & insurance
Code quality evidence an auditor can verify
- Challenge
- In a regulated financial institution, auditors ask which code was analysed, when, and whether vulnerabilities blocked a release. The answers live in pipeline logs and screenshots, and a project that was never scanned looks the same as a clean one.
- Approach
- Faultr records every run in its append-only, SHA-256 hash-chained audit trail and exports it to the SIEM. Quality gates include vulnerability conditions that a missing report cannot satisfy, and the adversarial red-team gate reviews authorisation, concurrency, database safety, data integrity and input validation.
- Result
- Audit questions are answered from a record the database itself refuses to alter, and no project can pass its gate simply by skipping the scan.
Licence
Per deployment. Never per seat.
Licensed per installation or per tenant — analysing a hundred repositories or a thousand does not change the price. It runs against your own model keys with no code leaving your network, priced as an annual fee on your own turnover (from €900 minimum, with yearly increases capped at 25%). Every tranche includes unlimited users, projects and organisations in one tenant, plus self-hosting and support; hosting, hardware and AI model costs are your own, and consultancy is quoted separately.
Annual licence by turnover, ex VAT
| Turnover | Per year |
|---|
| Up to €500k | €900 |
|---|
| €1M | €1,500 |
|---|
| €5M | €2,500 |
|---|
| €25M | €5,500 |
|---|
| €100M | €13,000 |
|---|
| €500M | €37,000 |
|---|
| €1B | €52,000 |
|---|
Illustrative: a per-developer analysis subscription at €30 a month bills a sixty-person team €21,600 a year; at €5M turnover this is €2,500.
What it does
- 01No analysis server to deploy — Faultr drives real analyzer plugins itself, in its own process, against a build it clones and runs.
- 02Five AI subsystems on top of static analysis: code review, an audit suite, two adversarial review gates and AI-generated rules.
- 03An eleven-method codebase valuation with a live spreadsheet, so a reviewer can change an assumption and watch the number move.
At a glance
CategoryCode Quality Platform
LicencePer deployment, unlimited users, from €900 a year
For whomRegulated IT · Defence · Due Diligence · Platform Teams
Give us one repository.
We will build it, analyse it, review it, diagram it and value it — and hand you the dossier, whatever it says.Start the conversation →