CodeMarine is a desktop IDE tool

CodeMarine CodeMarine
EDGE-FIRST SECURITY

Every feature runs locally, catches threats in <50ms

22,000+ signed patterns. 35+ languages. 15+ AI assistants.Your code never leaves your environment.

22K+
Signed Patterns
35+
Languages
<50ms
Detection Speed
100%
Local / Offline
🛡️ Edge‑first ✅ Signed rule packs 🧠 AI behavior guardian 📊 Audit‑ready

Three‑tier detection engine

Layered defense - from regex speed to deep semantic analysis - triggered on every file save. AI assistants save dozens of files per session. CodeMarine watches every one.

Critical

<50ms

Compiled pattern matching for the most dangerous vulnerabilities. Fires instantly on every file save.

● SQL injection
● Command injection
● Hardcoded secrets
● Disabled TLS
● Dangerous eval/exec

Semantic

<200ms

Context-dependent analysis for logic flaws and config missteps.

● JWT verification bypass
● CORS misconfiguration
● CSRF gaps
● Auth logic flaws
● Privilege escalation

Background

Async

Deep analysis running asynchronously for architectural-level threats.

● Supply chain correlation
● Dependency confusion
● Architectural anti‑patterns
● Cross‑file vuln chains
● Hallucinated packages

Built for the AI‑assisted workflow

Purpose‑built for the realities of modern AI‑assisted development.

Edge‑first & Offline

On-device analysis with <50ms response. Nothing leaves the laptop - works air-gapped, on planes, behind VPNs.

Sub‑50ms real-time feedback in IDE
No internet required after initial sync
Zero cloud copy‑outs of source code

15+ AI Assistants Tracked

Each vendor only sees their own tool. You use three in one session. CodeMarine watches the entire chain and knows which tool suggested what.

Claude Code → auth logic
Copilot → autocomplete
Cursor → refactor
CodeMarine → full chain

Signed Patterns

Curated, signed rule packs - predictable, reviewable, hot-reloadable. No black-box AI making security decisions.

22K+ patterns Versioned Human‑curated

Emergency Updates

Hot reload pipeline pushes critical rules globally in minutes - like AV definitions for AI code.

Instant reload Zero downtime

Secrets Guard

63+ secret patterns across IDE, pre-commit and CI. Catches exposed credentials before they hit the repo.

IDE + pre‑commit SARIF export

Supply Chain

7+ package ecosystems. Detects hallucinated packages (slopsquatting), known CVEs and dependency confusion.

npm, pip, cargo Slopsquat detect

35+ Languages

Unified analysis across every major language with consistent detection and the same pattern library.

JS TS Python Go Java +28

Compliance Ready

SOC 2 / SSDF alignment, complete audit trails and exportable reports for AI governance.

SOC 2 / SSDF Audit trails SARIF

Dual Guardrail Engine

Monitors AI suggestions AND human edits. Tracks who suggested what, when and builds compliance-ready audit trails automatically.

Human + AI attribution tracking
Inline warnings + instant rollbacks (TimeWarp)
Audit‑ready telemetry & SARIF export
Vibe Score tracks your security reputation

One engine, every surface

The same detection engine runs everywhere you write code.

VS Code

Inline diagnostics & quick‑fixes

CLI

Standalone linter & pre‑commit

Guardian

Background file watcher daemon

TimeWarp

Sub‑100ms file rollback

SHIFT LEFT, THEN SHIFT LEFTER

CI/CD Pipeline Integration

CodeMarine doesn't stop at the IDE. The same 22K+ pattern engine runs as a pre‑merge gate in your pipeline - catching anything that slipped past the developer's machine.

Where CodeMarine fits in your pipeline

1
Developer writes code with AI
Copilot, Cursor, Claude Code, Codex CLI, etc.
2
Guardian catches issues in real time
<50ms on every file save - most vulns never leave the IDE
3
Pre‑commit hook (optional)
codemarine scan --staged blocks commits with critical findings
4
CI pipeline scan
codemarine scan --ci --sarif runs full Tier 1-5 analysis
5
SARIF results → GitHub / GitLab
Findings appear as PR annotations. Block merge on critical/high.

Supported platforms

GitHub Actions
GitLab CI
Jenkins
Azure DevOps
CircleCI
Any CI with shell
.github/workflows/security.yml
- name: CodeMarine Security Scan
uses: codemarine/scan-action@v1
with:
sarif-output: results.sarif
fail-on: critical,high
tier: 5 # Full CI scan
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: results.sarif
Tier 5 deep scan - runs all 5 tiers including cross-file analysis
PR annotations - findings appear inline on the diff
Merge gating - block PRs with critical/high findings
SARIF export - standard format for GitHub Advanced Security, SonarQube, etc.
BUILT FOR TEAMS

Teams & Enterprise

Individual developers get real-time protection. Teams get visibility, policy enforcement and compliance evidence across every developer and every AI tool in the org.

Team Dashboard

Aggregated findings, Vibe Scores and trend data across every developer. See who's shipping clean code and where the hotspots are - without reading anyone's source.

Org overview Trend graphs Leaderboard

Policy Enforcement

Define org-wide security policies: which severity levels block commits, which patterns are mandatory and which AI tools are approved. Push policies to all seats instantly.

Severity gates Custom rules Push to all

Centralized Licensing

One admin manages seats, billing and onboarding. Add or remove developers without touching their machines. SSO integration for enterprise identity.

Seat management SSO / SAML Volume pricing

How it works for teams

Every developer runs CodeMarine locally - their code never leaves their machine. Anonymized telemetry (finding counts, severity, Vibe Score) flows to the team dashboard so security leads get visibility without accessing source code.

Developer - real-time IDE scanning, Vibe Score, instant fixes
Security Lead - team dashboard, policy config, audit exports
CI/CD - pre-merge gate catches anything that slipped past the IDE
Compliance - SARIF exports, audit trails, SOC 2 evidence
Team Overview - Platoon Plan
A
alice@team.dev
92
B
bob@team.dev
71
C
carol@team.dev
88
Team avg Vibe Score 83.7
Critical findings this week 3
Blocked at CI 1
AI assistants active 4

Air‑gapped Deployment

Run CodeMarine entirely on-prem with no outbound connections. Pattern packs delivered via signed bundles for classified environments.

API & Webhooks

Integrate findings into Jira, Slack, PagerDuty or your internal tooling. Webhook events fire on new critical findings for instant triage.

Executive Reporting

Automated weekly/monthly reports for CISOs: AI tool usage, vulnerability trends, compliance posture and ROI metrics. PDF and API export.

Ready to secure your AI workflow?

Free 14-day trial. No credit card. Code stays on your machine.

Fixing bugs during coding is ~100× cheaper than in production. At $5/mo, CodeMarine pays for itself on the first catch.

Download Free → How It Works