Source modes#

Two modes analyze code you own without sending any traffic. Both share the platform's code graph, triager and report writers.

White-box#

offat-whitebox /path/to/your/repo                 # AI triage when a provider is available
offat-whitebox /path/to/your/repo --no-ai         # offline heuristic only
offat-whitebox /path/to/your/repo --fail-on high  # CI gate

recon -> code graph + patterns -> chain -> verify (triage / agent) -> report

• recon - detect the stack, inventory manifests, generate an SBOM and dependency CVEs when syft / grype / trivy / osv-scanner are installed.
• code graph - prove source-to-sink flows and attach routes (details).
• patterns - secrets, weak crypto, TLS-off and misconfiguration. Injection hits the graph cannot connect to a source are kept, but demoted.
• verify - the shared triager assigns verdict, CVSS and remediation; --agent N re-verifies the top findings with graph tools.
• report - JSON, JSONL, SARIF (with code flows), Markdown, HTML and JUnit.

semgrep is no longer part of the default pipeline; pass --semgrep to add it.

Gray-box#

offat-graybox /path/to/your/repo --fail-on high
offat-graybox /path/to/your/repo --no-ai -o out/report

recon -> map endpoints -> code graph + patterns -> reachability -> analyze (AI) -> report

White-box can adopt the same token-discipline policy with --reachable-only. Gray-box makes it the default and adds the full endpoint inventory. Gray-box judges every finding by reachability: which exposed endpoint reaches it through the call graph. Only reachable findings are sent to a model, batched, cached and model-tiered; unreachable ones are triaged offline at zero token cost.

Which mode#

Deep dives#

White-box design · Gray-box design