Pre-engagement triage.
Any codebase, any language, any platform.
Ghost Architect™ reads the whole codebase and tells you what is in it: the risks, the conflicts, the files that break if you touch them. Before you sign. Before you inherit it.
One finding pays for a year of Ghost.
// field report · October 2026
A maintainer's own AI checked our report. All five fixes held.
Ghost Architect™ Local scanned CodeExam on our own hardware with local models. Its author had his own Claude Code check our Ghost Brief™ against his current code.
Read the field report →// two ways to run Ghost Architect™
Free for one person. Ghost Architect™ Local for your team and your own model.
Ghost Open™ · free for one person
Install from npm, bring your own Anthropic API key, and run every Ghost Open™ mode with no limits: no license key, no trial clock, no quotas. Your code goes to Anthropic on your key and nowhere else; we have no servers.
Ghost Architect™ Local · your model, your hardware
Runs on your machines, on a model you own, inside your network. macOS, Linux and Windows. Air-gapped if that is how you work. A hub and spokes for the whole team, one monthly licence, no per-token bill, and reports that tell you what they did not examine.
// the scan
Everything hiding in the codebase before you sign the contract.
Ghost Architect™ analyzes the entire codebase and surfaces architectural risks, conflicts, and vulnerabilities before they become production incidents. One pass. Every file it touched, every file it did not.
- 01
Points of Interest Scan
Auto-map red flags, dead zones, fault lines, and landmarks across the entire codebase. Know what matters before you touch it.
- 02
Recon, engagement sizing
Walk into the scoping call with data. Recon counts files, gauges complexity, projects scan cost, and proposes a multi-pass plan before you spend a cent on analysis.
- 03
Inheritance Audit
Four analyzers, one deal-grade PDF in about 60 seconds for about $0.02. Stack reality, key-person risk, hidden deps, and a 90-day modernization roadmap. See the audit →
// one finding, and every file it can break
Ghost Triple Crown™
Three passes. One complete picture.
- 01
Blast Radius™
Maps every file that breaks if you change something. Know the impact before you touch the code.
- 02
Conflict Detection™
Finds where two sides of the codebase expect different things. Catches contract mismatches before they hit production.
- 03
Ghost Brief™
Generates a developer-ready remediation prompt for every finding. Paste directly into Claude Code, Cursor, or Copilot. Surgical fixes first. Broad changes last.
In Ghost Architect™ Local, the Ghost Triple Crown™ checks every commit: a pre-push hook on the developer's machine, Ghost Watcher™ Local on a webhook from your own git server, or your own CI runner. How it runs →
// security
Your code never touches our servers. We don't have any. Every scan runs on your machine, with your own API key. Nothing is stored, logged, or retained outside your own filesystem. Ghost is the only codebase intelligence tool with nothing to breach.
Need the model inside the building too? Ghost Architect™ Local runs on your machines, on a model you own, inside your network. Air-gapped if that is how you work.
// proof of concept
Real analysis. Real findings.
Ghost Architect™ analyzed 658 files in a real eCommerce extension and surfaced 18 architectural findings, conflict mismatches, security risks, and integration vulnerabilities, in under 10 minutes.
Download the full report ↓ PDF · 7 pages · real eCommerce codebase · 18 findings
After every scan, Executive Brief™ turns the findings into one page for the person who signs the check: a health score, a plain-language risk summary, and what remediation costs by hand versus with AI. 24 hours at $4,800 becomes 3 hours and $3.60. That table closes deals.
// ghost architect™ local
Ghost Partner™
your methodology, your branding, your rates.
Ghost Partner™ profiles are the consultant side of Ghost Architect™ Local. Load a profile that injects your audit methodology, billing rates, and branding into every scan. The findings are still Ghost's. The framing, the priorities, and the dollar estimates are yours.
Drop a partner profile YAML at scan time.
Ghost picks up your firm's methodology, severity weighting, and remediation framework automatically.
Override the default tiered billing ($85 / $125 / $200) with your own rates.
Junior, mid, and senior dollar estimates reflect what you actually charge clients.
Your firm's logo on the PDF header. Your brand colors.
Your methodology signature in the executive summary. Hand it to the client without re-skinning anything.
OWASP, SANS Top 25, your own internal checklist.
If your firm runs every audit through a specific framework, the partner profile makes it part of every scan output.
Part of Ghost Architect™ Local. Ghost Partner™ profiles and white-label reports come with Ghost Architect™ Local. Ghost Open™ reports always carry Ghost Architect™ branding. See Local pricing →
// common questions
Common questions.
What exactly does Ghost Architect™ do?
Ghost Architect™ scans your codebase and produces a structured triage report, categorizing every finding by severity (Critical, High, Medium, Low), flagging architectural risks, security vulnerabilities, and conflict mismatches. It gives your team a prioritized map of where to start, not a raw dump of everything that could conceivably be wrong.
Does Ghost Architect™ upload my code anywhere?
No. Ghost Open™ runs on your own machine, with your own API key. Ghost has no servers. Analysis calls go directly from your machine to the model provider you chose using your own API key. With Ghost Architect™ Local, the model runs inside your network as well, and nothing leaves the building.
What is Ghost Brief™?
Ghost Brief™ is the governed AI remediation pipeline built into Ghost Architect™. After any scan, Ghost converts your findings into a validated, blast-radius-aware prompt pack. Each prompt tells your AI coding agent exactly what to fix, which files to touch, and which files to leave alone. Ghost never writes or modifies code. Ghost scans, Ghost briefs, the AI fixes.
What languages and platforms does it support?
Any codebase, any language, any platform. PHP, JavaScript, TypeScript, Python, Ruby, Java, it doesn't matter. Ghost is framework-aware and analyzes code structure, dependency relationships, configuration files, and integration patterns regardless of what stack you're running.
How is this different from a linter or static analysis?
Linters catch syntax errors and style violations. Static analysis tools find known vulnerability patterns. Ghost Architect™ reasons about your codebase architecturally: how components relate to each other, where integrations are fragile, what the blast radius of a change is, and what a senior architect would flag on day one.
Can I use it on a client's private repository?
Yes. Ghost Architect™ supports private GitHub, GitLab, and Bitbucket repositories. You authenticate with a personal access token, Ghost clones the repo locally, runs the scan, and removes the local clone when done. Your client's code never touches any third-party infrastructure beyond your own.
// start