We don't read the label. We read the code.
Earnie is new, but the knowledge base is not. Policy, surfaces and record are built for code written by humans and agents alike. Underneath sits a proven knowledge base and an improved matching engine.
Four datasets. Each one held to your policy.
AI models
Detection over declaration. AI SDKs, model files and API keys found, matched against known models and held to your policy. Documented in an AIBOM with provenance and licence. What's really there, in writing.
Cryptography & PQC
Every cryptographic algorithm in your estate, inventoried and checked against policy, with flags on what won't survive the post-quantum transition. The migration starts with an inventory. Earnie keeps it standing.
OSS licence compliance
Components, licences, obligations, down to the snippet someone pasted. Policy applied before it ships. Attribution and notice files generated, SBOMs versioned and retrievable. The record, ready before anyone asks.
Security vulnerabilities
Known vulnerabilities in what you actually ship, found where they live, tied to remediation at AI speed. The fix arrives with the finding, usually one click away.
Your rules. Written once. Checked everywhere.
Findings on their own are a to-do list. Policy decides what happens to them: what's allowed, what warns, what blocks.
Policies in clicks or code.
Central policies across licence, crypto, AI and security, expressed in CEL and compatible with the policy systems you already run. Build them point-and-click, the way you'd build an advanced search, or manage them through the API and MCP. Natural language is coming next.
Your organisation thinks in projects. So does Earnie.
Assign repos, people and policies to a project. Different projects, different rules. Estate-level roll-up for the people who answer for all of them.
One policy, wherever code enters.
The coding agent · MCP
Asks Earnie what's allowed before it writes a line, and checks its own work after. On every task.
Works with: Claude Code · Cursor · OpenAI · any MCP client
The developer · CLI
One CLI for all of Earnie: scan, policy check, SBOM export. Run it pre-commit and findings show up before the code leaves your machine. Runs in any CI system we don't integrate with natively.
The developer · CI/CD
Connect a repository once. Earnie scans everything, then every commit and every pull request after it. Most rules warn, a few block.
Works with: GitHub · GitLab
The operator · UI
The AppSec or platform lead, in the browser. Policies, projects, posture and the whole estate.
14 cryptographic algorithms.
Same finding ID, same evidence, whichever surface caught it.
If you're not writing code, you can review and remediate from the UI, without opening a console.
Work from your browser.
Two ways in. Upload a package, a directory or a ZIP and see the results on your screen in minutes. No pipeline integration required. Or connect a repository once: Earnie runs the initial scan, then scans every commit after it. Policy violations become events, not archaeology.
Scans started here produce the same findings, with the same finding IDs and the same evidence, as scans triggered from MCP, CLI or CI/CD. One-shot scans still matter (due diligence has deadlines), but the record they write is the same record everything else writes to.
- Upload & scan:
Packages, directories, ZIP, results in minutes - Connect a repo:
Initial scan, then continuous on every commit
The record writes itself.
As the team works on any surface, findings are recorded and the record is always up to date.
Split-screen view: See the match, not just the claim.
Any finding opens into a side-by-side comparison of your code against the identified source: match percentage, line by line, in the same UI where the finding lives. Findings you can defend because you can show them.
The dashboard: The whole estate at a glance.
Traffic-light status across every project. Developers see deltas; leadership sees posture. Single sign-on, role-gated: developers, engineering leadership, counsel and policy owners see the same truth at the depth their role requires.
Get your BOM: Ready before anyone asks.
SBOM, CBOM and AIBOM, notice files, versioned, retrievable, and always current. Exported on demand in open standards: CycloneDX 1.6 and SPDX. Evidence towards CRA, procurement and EU AI Act obligations.
Your server either way. Same record.
Earnie runs on your server in both models, with your code and your record. On SaaS it sends only fingerprints to the knowledge base we host. On-prem the knowledge base runs alongside it, air-gapped if you need it.
