Parity

Reviews the diff for the bug rather than the style, and tells you which advisory in the dependency tree actually reaches your code.

290 tokens/s Throughput

97.4% Accuracy

480ms Median latency

9.3M Calls per month

Reads a change against the surrounding code, traces whether a published vulnerability is reachable from your call graph, and stays quiet when it has nothing useful to say.

Scope

Reads a change against the surrounding code, traces whether a published vulnerability is reachable from your call graph, and stays quiet when it has nothing useful to say.

Capabilities

Reachability analysis on advisories
Diff-aware review
Licence obligation checking
Test gap identification
No comment when there is nothing to say

Runs on

Claude 3.7 Sonnet Nexus-Dense-70B

Deployed in

DevOps and cloud-native operations General enterprise AI platform

Calling it from the SDK

const reviewer = new NexusAgent({ role: 'code_review' });

const notes = await reviewer.review({
  diff: pr.diff(),
  advisories: 'reachable_only',
  silentWhenClean: true
});

Recorded exchanges

Published examples, reproduced verbatim. This page does not call a model.

Which of these 47 advisories matter

Asked

The scanner reports 47 vulnerabilities in our dependency tree. Which ones can actually be exploited here?

Returned

Three, by reachability from your own call graph.

• The XML parser advisory is reachable — you call the affected entry point directly in the import handler, with input that comes from an uploaded file. This is the one to fix today.

• Two are reachable through a transitive path in the reporting job. Both are denial-of-service rather than execution, and the job runs on a schedule rather than on request, so the exposure is real but bounded.

The other 44 are in code paths nothing in this repository calls — 31 are in test-only or build-time dependencies, and 13 are in unused modules of packages you do import.

That is not a claim they are harmless; a future change could make one reachable. It is a claim about what is reachable from the current tree, which is what a triage decision actually needs.

Code review Dependencies Supply chain Licences

All agents