From codebase to reachability verdict in minutes
Three stages: connect your repositories, build the execution graph, and get every finding labeled with its real exposure status.
Connect your repositories
Install the Cybret AI GitHub App or configure the CLI token for GitLab or Bitbucket. The agent requests read access to repository contents and, optionally, CI/CD pipeline configuration. No code is stored; the agent processes structure metadata in-flight and discards it after graph construction.
Initial graph construction for a repository under 500k lines typically completes within four minutes. You can connect multiple repositories and the agent builds an inter-service graph automatically when imports and dependency references cross repository boundaries.
Import your existing findings
Push SARIF or JSON output from your current scanners directly via the API, or configure the CI step to automatically ship scan results after each pipeline run. Cybret AI accepts output from Semgrep, Snyk, Trivy, GitHub Advanced Security, and any tool that emits standard SARIF format.
Each finding is matched to a specific function or code location within the graph. If a finding cannot be matched to a graph node, it is flagged as unresolvable with the raw scanner output preserved for manual review.
Get reachability verdicts for every finding
The platform performs a directed traversal from your defined application entry points to each finding's code location. Findings are classified as reachable, unreachable, or conditionally reachable depending on whether a valid execution path exists and whether runtime data confirms or contradicts the static result.
Results are surfaced in the Cybret AI dashboard, via the API, and optionally pushed as labels directly to the source scanner's ticket or the connected Jira project. Your existing workflow gets an extra column: reachable or not.
Try it on your own codebase
The free Early Access plan covers one application. Connect, import your scan results, and see reachability verdicts within minutes.