01 Current
Code Integrity
Local-first scanning, shared rule execution, structural confirmation and graph context across the workspace.
Platform
One control plane around the AI development lifecycle.
CodeMarine protects the shared environment where agents write code, add dependencies and act with developer authority. Each layer has a clear job and a clear proof boundary.
Current, beta and planned capabilities are labelled throughout this page.CLAUDECODEXCURSORHUMAN
CODEMARINEPolicy + evidence
CodeSupply chainActions
EDITORTOOLSCIINFRA
Six connected planes
A security system, not a collection of scanners.
The planes share normalized findings, policy and evidence. This lets CodeMarine move from a saved file to a package decision, an agent action or a frontier investigation without losing context.
02 Current
Supply Chain
Package identity, provenance, manifests, lockfiles, install behavior and AI tool configuration.
03 Beta
Runtime Policy
Deterministic action evaluation and provider adapters for defined pre-execution paths.
04 Planned
Tool and Authority
Governed MCP and API paths with scoped credentials and trusted target context.
05 Planned
Evidence
Revision-bound proof, action receipts, operational health and explicit coverage gaps.
06 Planned
Frontier Intelligence
Focused escalation, model investigation, isolated remediation and deterministic patch validation.
The decision path
Fast checks first. Deeper intelligence by policy.
The continuous path does not need frontier tokens. A model call happens only when a finding, policy or user decision justifies deeper investigation.
- 01EVENTA file, dependency or action changes
CodeMarine records the workspace and revision context.
- 02LOCAL DECISIONDeterministic engines evaluate it
Known policy produces a reproducible result.
- 03BRANCHAct now or escalate
Clear findings warn or block. Ambiguous cases can move to an approved model.
- 04VALIDATECodeMarine checks the outcome
A patch must pass the deterministic gate and match the expected revision.
- 05RETAINEvidence becomes durable
Verified discoveries can become regression fixtures and new controls.
Deployment model
Local-first by default. Connected when the workflow needs it.
CodeMarine separates local deterministic work from optional managed intelligence and model calls. A team can choose the right privacy and cost boundary for each workspace.
Local-first does not mean every product capability is offline. Frontier investigation, managed intelligence and future team controls can involve approved external services. The sharing scope must remain explicit.
Local deterministic path
High-frequency code, dependency and policy checks run without sending every change to a model.
Managed intelligence
Signed updates and service-backed features can extend local checks where configured.
Optional specialist models
Small local security models can help narrow candidate files. Their output remains probabilistic evidence.
Frontier investigation
Approved models receive bounded context for novel or high-impact cases.
Built for mixed toolchains
The author changes. The security contract does not.
CodeMarine watches the resulting code and trust boundary across tools. Provider integrations add earlier interception where each host supports it.
Quiet during normal work
Continuous checks stay close to the workspace. High-confidence catastrophe policy can intervene on supported paths without turning every command into a permission ceremony.
One view across agent choice
Teams can adopt different frontier tools while code, dependency and action evidence converge on one policy model.
Coverage you can challenge
The product direction is explicit per-surface status with proof, health and limitation details instead of one global protected state.
Early access
Put one security contract around your AI toolchain.
Start with continuous deterministic protection. Add provider-specific controls as each surface becomes proof-backed.
