01
Discover
Map dependencies and known vulnerabilities across supported ecosystems. Use available evidence of package usage to prioritize what deserves attention.
Inventory · advisories · usage evidence
The Resolve platform
One workflow.
A clearer dependency picture.
From the packages your software uses to the change your team can review, Resolve connects dependency analysis, targeted remediation, and validation in a single guided workflow.
Built for decisions your security and engineering teams can inspect.
01 / Current pilot capabilities
Follow the dependency
from finding to decision.
The current pilot includes a guided scan-to-report flow and scheduled watch runs. Together they cover five practical capabilities, while change decisions stay with your team.
02
Reduce
Surface likely unused Python dependencies for engineering review. Removal is an explicit option after the candidate and its supporting signals are inspected.
Review candidates before removal
03
Repair
Plan targeted upgrades or parent and transitive changes, then prepare them in a separate working copy with a branch, patch, and draft change summary.
A proposed change your team can review
04
Verify
Compare baseline and changed-branch findings and run available project tests. A breaking upgrade can be isolated and left out of a rebuilt branch.
Test gaps and baseline failures remain visible
05
Respond
Re-scan watched packages on a schedule, record observed health, and surface alerts when risk rises. Supported Python replacement cases can produce a review branch.
Scheduled watch runs · alerts · history
A reviewable record of what was found, what changed, and what the available checks show.
02 / Ecosystem coverage
A shared workflow.
Clear analysis depth.
Mixed repositories can be scanned in one workflow. The level of usage analysis differs by ecosystem, and pilot scoping should confirm what applies to your codebase.
Discuss your repository| Ecosystem | Current analysis |
|---|---|
| Python | Inventory, advisories, import and usage analysis, with function-level reachability where supported. Likely unused direct dependencies and limited replacement cases can be reviewed. |
| JavaScript / TypeScript | Inventory, advisories, and import-level or package-call evidence. Vulnerable-function analysis is not part of the current implementation. |
| Java | Inventory, advisories, and import-level or package-call evidence. |
| .NET | Inventory, advisories, and import-level or package-call evidence. |
Static analysis has limits, including reflection and values stored before use. Findings help focus review; they do not prove exploitability or complete coverage.
03 / Evidence for review
The work comes
with a record.
Resolve generates artifacts that let teams inspect a finding, understand a proposed change, and compare the result with the baseline. They support technical review; they are not a certification of production safety.
01
Findings and context
HTML, Markdown, and JSON reports; dependency and advisory details; a data-flow page where available.
02
Change proposal
Plan JSON, a separate branch, patch, package-oriented commits, and PR draft text for your team's review process.
03
Comparison and sharing
Before/after dashboard, available test results, CycloneDX 1.5 SBOM with VEX analysis, and a shareable report bundle.
04 / How to read the results
Useful evidence includes
its limits.
AI assistance is optional.
Optional AI calls assist Python function-level adjudication. Static analysis remains available without them. This is a bounded aid to analysis, not an autonomous repair agent.
Validation reflects available tests.
Resolve records when tests are absent or already failing. A passing run covers the checks that ran; it does not establish behavioral equivalence or production readiness.
Your process owns the merge.
Resolve prepares a branch, patch, reports, and PR draft text. Your existing repository review and approval process determines what ships.
05 / Platform direction
Built from a working engine.
Designed for a broader view.
The current implementation is a dependency-focused CLI workflow. The wider platform architecture is a direction for development, to be scoped and validated with design partners.
Dependency workflow
Guided scan, plan, apply, validate, and report steps; scheduled watch runs for configured packages; reviewable change and evidence artifacts.
Connected resilience view
The proposed architecture explores advisory-driven monitoring across repositories, shared evidence, pipeline events, and a broader decision interface. These are future concepts, not current pilot capabilities.
Start with one meaningful scope
See what the workflow reveals
in your environment.
Bring a representative repository. We can define the questions, inspect the output, and evaluate the change together.