The quality gate for
AI-generated code
Catch broken packages, phantom imports, and code drift before they reach production — and keep a signed record of what was checked.
Never ship broken code again.
Five checks that catch what AI code breaks — before a human ever reviews.
Phantom import detection
AI hallucinates packages that don't exist. ZurixAI finds imports missing from your manifest, then asks the npm or PyPI registry whether the package exists. Not in the registry at all? That's a phantom, and it fails the check.
Supply-chain intelligence
Registry outage? Missing package? ZurixAI distinguishes 'unavailable' from 'doesn't exist' and flags suspicious typosquatting patterns.
Code drift detection
Finds orphaned functions and stale files that accumulate during AI-assisted refactors. Know exactly what's dead code.
Custom rules as contract
Define quality rules in .zurix/rules.md. The engine classifies and loads them. Rules display in PR results today; enforcement against code is coming.
One command, no setup
`zurix check .` scans a repo in seconds and exits 1 on critical findings, so it drops into any CI. No account and no API key.
Signed audit trail
Team tier: every check run is Ed25519-signed, hash-chained, and stored. Prove to clients and auditors that agent-written PRs were gated.
Three steps. Zero config.
No API keys required for the deterministic core.
Install the GitHub App
One click. ZurixAI connects to your repo and runs on every new PR automatically.
Push a PR
ZurixAI scans imports, supply chain, drift, and rules. Runs in seconds, not minutes.
Get a quality gate
A pass/fail check run with details and fix suggestions. Team tier: results join a signed, hash-chained audit log.
Start free. Scale when you ship.
A task is one analysis against a PR: import validation, supply-chain scan, stack-trace parse, drift diff, or rules pass.
- 10 PR runs/month per account
- Import validation
- Supply chain scan
- Drift detection
- Local .zurix/rules.md
- Inline results (unsigned)
- 200 PR runs/month per repo
- Everything in Free
- Org-wide rules from your .github repo
- Signed audit log, entry on every check run
- Full audit log export on request (JSONL)
- Everything in Team
- Bring your own API key
- Unlimited tasks
- MCP server + pre-commit
- LLM-powered patching
Security & data
What we store, what we don't, and how to verify it yourself.
What we store
Check results, verdicts, and signed audit entries — not source code. Shallow clones are deleted after every run. Error telemetry may incidentally include code snippets from exception messages.
GitHub permissions
contents:read (clone and read files), pull_requests:write (post review comments, dismiss stale reviews), checks:write (create check runs), metadata:read (repo info). We do not request admin access.
Retention & deletion
Audit data is retained while your account is active. Uninstall the GitHub App to stop new data. Contact us to request deletion of existing data.
How to verify
Run `zurix verify` on one entry or on an exported log. It checks each Ed25519 signature and hash, and for a log that every entry links to the previous one by hash with no gaps. The public key is published at zurixai.com/.well-known/zurixai-pubkey.
Hosting & providers
Backend hosted on Render (US). Signed audit entries are stored in Supabase (Tokyo). Error tracking via Sentry. No code is sent to any LLM provider.
Report a vulnerability
Report security issues through GitHub private vulnerability reporting on HuziM/zurixai (Security tab, then Report a vulnerability).
Last reviewed: September 2026 · SECURITY.md
Frequently asked questions
What shipped
Recent changes to the CLI and the hosted service.
Team: signed log you can check yourself
Every Team check run carries its signed entry. Ask for the full log and zurix verify checks each signature and every link in the chain. Private repos supported.
CLI 0.2.0: fewer false alarms
Phantom means missing from the registry. Guarded imports, alternate PyPI names and monorepos handled. New zurix verify command.
Terminal dashboard
A first Textual dashboard (zurix tui). Minimal for now.
Supply-chain registry intelligence
Distinguishes registry outages from missing packages. Suspicion scoring on every dependency.
Ship code that works.
Install the GitHub App or run the CLI. ZurixAI catches what the linter misses.