When an agent fixes a security finding, Dvalin decides whether it worked — re-scanning, running your tests itself, and reading the exit codes. Whoever wrote the repair is recorded and never consulted.
Everyone is racing to find vulnerabilities and to fix them. Almost nobody is answering the next question: how do you know the fix worked?
In most tools the answer comes from the model that wrote the fix — directly, or by parsing its own account of what it did. That is the one question a model is least able to answer against its own interest, and no amount of prompt wording changes it.
Dvalin takes the decision away from the repairer entirely:
| Who edits the code | Any agent, or a person. Recorded as metadata. |
| Who decides it worked | Dvalin: it re-scans, and runs your project's own checks itself. |
| What the verdict rests on | Exit codes read from processes Dvalin started. Never a report it was handed. |
| What you get | A record anyone can re-derive offline, with no workspace and no network. |
A repair no check could confirm does not pass — "there was nothing to run" is not a pass. And every record carries what the scan actually covered, so a clean result from a run where half the engines were missing never reads like a complete one. The open profile →
Don't take the claims on trust — verify them on your own machine:
curl -fsSL https://raw.githubusercontent.com/arthurpanhku/dvalincode/main/scripts/install.sh | bash
dvalincode trust
dvalincode dvalin . --scanners builtin,semgrep,trivy,osv-scannerThe Dvalin command runs the built-in rules and any supported open-source engines installed on PATH. Use --fix --verify --record fix-record.json to prepare focused repairs, run the tests, and write out the record. Hand that record to anyone:
dvalin verify-fix fix-record.jsonFix record 2c9d71ac03e0 · VERIFIED · scan-and-checks
executor: claude-code (recorded, not consulted)
targets: 1 before · 0 remaining
coverage: complete → complete
✓ test: npm run test (exit 0)
audit: run verify-36509f42 @ 414644c75af0The same check runs on a pull request — pass fix-record: to the GitHub Action and it re-derives the record on the runner before posting it beside the diff. A record edited after it was issued fails there, and fails the job.
The real case shown above is adapted from OWASP NodeGoat. It moved from 10 findings and 22/F to 0 findings and 100/A after the three eval call sites were replaced by a constrained numeric parser and an injection regression test was added. The score is a triage heuristic, not certification.
Dvalin combines the MIT-licensed DvalinCode pipeline with open-source Semgrep CE, Trivy, OSV-Scanner, and SARIF 2.1 interoperability. Scanner evidence guides the configured model; DvalinCode records the diff, runs project tests, re-scans, and keeps PR publication explicit. Specialist agents such as Codex Security can export SARIF into the same case and gate workflow without Dvalin taking ownership of their credentials or sealed scan artifacts. Dvalin can also run the complete discovery, remediation, and verification loop itself; interoperability is an option, not the product boundary.
Prove what the agent did after the fact:
dvalincode report verify # re-derive the hash chain of the last run's audit logWindows builds and manual downloads for every platform are on the releases page, with SHA256SUMS.txt and build provenance attestation for each archive.
Run dvalincode bare for an interactive terminal agent with streaming output, inline approvals, and red/green diffs — or dvalincode serve to host the web GUI for browser and remote use. An experimental desktop app ships on a separate pre-release track. All three drive the same agent core. CI, schedulers, and external agents can drive that core through the headless dvalincode run command or the task-level stdio dvalincode mcp-serve surface, with the same policy and audit chokepoint.
The redesigned Dvalin panel keeps the model review, project-check report, deterministic re-scan, scanner coverage, security gate, and offline-record status together. A clean score is only one piece of evidence: advisory gates, missing fix records, and Git publication blockers remain visible beside it.
DvalinCode is an agent-compatible security runtime that can run alone, compete in security discovery and remediation, or interoperate with specialist systems. It does not try to replace every general coding agent. The product is the discovery, evidence, remediation, and enforcement layer a security, compliance, or platform team needs before human- or agent-written code can merge:
dvalincode trust makes the posture self-verifiable.Start with the threat model to see the full attack surface — malicious AGENTS.md, poisoned MCP servers, prompt-injection escalation, egress, audit tampering — each mapped to the control that defends it and the honest residual gap.
An honest fit check — we compete on measurable security outcomes and approvability, not on being everything.
Choose DvalinCode when…
Look elsewhere when…