Assure
Every time an engineer or their AI agent commits a change, Caliber checks it in multiple layers. The audits run on the engineer’s machine. The result goes to GitHub, Bitbucket or GitLab as passed or blocked, and only passed changes can merge.
Audits on engineers’ machines
Static analysis and white-box security audits, which read the source code itself, run on the engineers’ machine before a pull request is created. Caliber receives the findings, the problems the audits found, and never the source code. Each finding has a severity, a file and a line number, so the agent can fix it before the change is committed.
The quality check
Caliber reports the result to GitHub, Bitbucket or GitLab as a required status check, so a blocked change cannot be merged around it. Each project sets its own thresholds. Only a project owner can accept the risk on a finding, and only with a written reason. The record shows who, when and why.
The check applies the same rules to every change, whatever tool or model wrote it. It addresses two risks on the OWASP Top 10 for LLM Applications: excessive agency and supply chain.
Typical problems
Missing input validation
Hallucinated packages
Hardcoded secrets
Missing access controls
How Caliber solves them
Pre-commit static analysis with AST-aware scanning.
Package registry validation before installation.
Local secret scanning, enforced by the required check.
Implementation is checked against the constraints in the approved spec.
