What It Does ⚠ EOL Warning Security For Agencies Pricing Plan Details FAQ Blog
Ghost Architect™
v4.7.5 — Now Available

Your codebase has secrets.
Ghost Architect™ finds them first.

Built for architects and agencies who inherit codebases they didn't write and need to know what's in them — fast.

See Plans → Try Ghost Open Free →
$ npm install -g ghost-architect-open FREE
568
Weekly Downloads
18
Findings Surfaced
<10
Minutes
100%
Local Execution
Senior architects on inherited codebases
Agencies managing 3+ client projects
CTOs doing pre-acquisition due diligence
Greenfield projects on modern stacks
// last scan caught
OAuth access tokens exposed in window.facebookBusinessExtensionConfig
Readable via DevTools by any attacker. Est. impact: full Facebook Business account takeover.
// capabilities

Everything hiding in your codebase.
Surfaced in minutes.

Ghost Architect™ analyzes your entire codebase and surfaces architectural risks, conflicts, and vulnerabilities — before they become production incidents.

🗺

Points of Interest Scan

Auto-map red flags, dead zones, fault lines, and landmarks across your entire codebase. Know what matters before you touch it.

Conflict Detection

Find contract mismatches, schema conflicts, config errors, and constant disagreements — across any language or platform.

💥

Blast Radius Analysis

Before you make a change, understand the full impact. Every dependency, every affected flow, with a rollback plan included.

📑

Client-Ready Reports

Every scan produces a branded PDF your clients can read, a TXT your developers can act on, and a MD your team can commit. Immediately actionable.

"Your client's code stays yours."

Ghost Architect™ runs entirely on your local machine. Your codebase is never uploaded, never stored, and never transmitted to Ghost Architect™ servers — because there are no Ghost Architect™ servers.

Analysis calls go directly from your machine to Anthropic's API using your own key, under your own data agreement. No SaaS. No upload. No data retention.

🖥

Runs Locally

Ghost Architect™ is a CLI tool that runs entirely on your machine. Zero cloud dependency.

🔑

Your API Key, Your Agreement

You bring your own Anthropic API key. Ghost Architect™ is never in the middle.

🚫

No Persistence

Nothing is stored, logged, or retained outside your own filesystem. Ever.

Zero Vulnerabilities

Ghost Architect™ has been audited with npm audit and contains zero known vulnerabilities across all dependencies. Verifiable by anyone.

🌐

Any Repo, Any Platform

GitHub, GitLab, Bitbucket — public or private. Authenticate with a personal access token and scan. No ZIP download required. Any language. Any framework.

Built for how agency teams
actually work.

Your developers aren't pulling client codebases to their laptops. They're working from repos. Ghost Architect™ works the same way. Point Ghost at any GitHub, GitLab, or Bitbucket repository — public or private — authenticate with a personal access token, and run your scan. The entire analysis happens on your local machine. No code is uploaded. No third party ever sees your client's codebase.

🔗

Private Repo Support

Authenticate with a personal access token. Ghost clones the repo locally, scans it, and removes the clone when done. Your client's code never touches our infrastructure — because there is no our infrastructure.

📁

Selective Path Scanning

Point Ghost at a specific directory within a large repo. Scan the module you're working on, not the entire monorepo.

📑

Same-Day Client Deliverables

Every scan produces a branded PDF for stakeholders, a TXT for developers, and a MD for your team to commit. Hand it to the client the same day.

💰

Per-Seat Cost Visibility

Each developer runs Ghost with their own Anthropic API key — giving your agency complete visibility into usage and cost at the individual seat level. No black box billing.

Agency-tier plans available. Ghost Architect™ offers plans designed for multi-client portfolios, team access, and enterprise delivery workflows. See pricing →

Solo developer or independent architect? Ghost Architect™ works just as well for individuals. Start with Ghost Open free, upgrade when you need more.

// proof of concept

Real analysis. Real findings.

Ghost Architect™ analyzed 658 files in a real Meta Magento extension and surfaced 18 architectural findings — conflict mismatches, security risks, and integration vulnerabilities — in under 10 minutes.

658
Files
18
Findings
<10
Minutes
7
PDF Pages
Download the Full Report ↓  // PDF · 7 pages · real codebase · 18 findings
// Finding #1 · Critical

Client-Side Credential Exposure

Meta OAuth access tokens stored in window.facebookBusinessExtensionConfig — readable by any XSS attack or DevTools inspection. Full Facebook Business account takeover via browser.

Est. fix: 8–12 hrs · Complexity: HIGH
// Finding #9 · Critical

Ad Spend Inflation Race Condition

Event ID deduplication race condition causing 10–20% duplicate Conversion API events. Ghost flagged this as the most expensive bug in the codebase — inflating Meta ad spend by thousands monthly.

Est. fix: 10–14 hrs · Complexity: CRITICAL
// Finding #3 · High

Mass Assignment Config Vulnerability

Arbitrary POST parameters saved directly to core_config_data with no validation or allowlist. Combined with missing CSRF protection — any system configuration value is writable by an attacker.

Est. fix: 6–8 hrs · Complexity: HIGH

These are 3 of 18 findings from a real public extension. Download the full report ↓

Adobe stopped patching
your platform.
Your codebase didn't
get the memo.

Extended support is available to Adobe Commerce customers only. If you're running Magento Open Source — you're on your own. No patches. No safety net. Just you, your extensions, and whatever is hiding in your code.

Version End of Support Status
Magento 2.4.4 April 14, 2026 ⚠ CALCULATING...
Magento 2.4.5 Aug 12, 2025 ✕ EXPIRED
Magento 2.4.6 Aug 11, 2026 ⚠ THIS YEAR
Magento 2.4.7 Apr 9, 2027 ↑ UPGRADE NOW
🔴

No More Patches

Every vulnerability discovered after EOL is yours to find, yours to fix — with no help from Adobe.

The Clock Is Running

2.4.4 ends April 14, 2026. If you haven't audited your codebase yet, you are already behind.

👻

Ghost Architect™ Can Help

Know exactly what security risks are hiding in your codebase before the window closes. Triage first. Migrate with a map.

Know what's in your codebase before Adobe's clock runs out.

Run a Free Scan → See Pricing
// frequently asked

Common questions.

What exactly does Ghost Architect do?

Ghost Architect scans your codebase and produces a structured triage report — categorizing every finding by severity (Critical, High, Medium, Low), flagging architectural risks, security vulnerabilities, and conflict mismatches. It gives your team a prioritized map of where to start, not a raw list of every issue. Output is a branded PDF for stakeholders, a TXT for developers, and a Markdown file your team can commit.

Does Ghost Architect upload my code anywhere?

No. Ghost Architect runs entirely on your local machine. Your source code is never uploaded to any Ghost Architect server — because there are no Ghost Architect servers. Analysis calls go directly from your machine to Anthropic's API using your own API key. Anthropic deletes API inputs and outputs within 7 days per their data retention policy.

What languages and platforms does it support?

Ghost Architect works on any codebase, any language, any platform. PHP, JavaScript, TypeScript, Python, Ruby, Java — it doesn't matter. It's framework-aware and analyzes code structure, dependency relationships, configuration files, and integration patterns regardless of what stack you're running. Adobe Commerce and Magento are common use cases, but they're not requirements.

How much does an Anthropic API key cost to run?

A typical Ghost Architect scan costs $0.23 in Anthropic API usage. Most Pro users run 10–20 scans per month, putting their total API cost at $2–5/month on top of the subscription. You can verify this yourself — Ghost prints the exact cost of every scan in the terminal output. There are no hidden fees or usage caps imposed by Ghost Architect.

How is Ghost Architect different from running a linter or static analysis tool?

Linters catch syntax errors and style violations. Static analysis tools find known vulnerability patterns. Ghost Architect does something different — it reasons about your codebase architecturally. It identifies how components relate to each other, where integrations are fragile, what the blast radius of a change would be, and which findings represent real business risk versus noise. It's triage intelligence, not a rule-based scanner.

Can I use Ghost Architect on a client's private repository?

Yes. Ghost Architect supports private GitHub, GitLab, and Bitbucket repositories. You authenticate with a personal access token, Ghost clones the repo locally, runs the scan, and removes the local clone when done. Your client's code never touches any third-party infrastructure beyond your own Anthropic API key. This makes it safe to use under NDA with enterprise clients.

👻 See Plans →