From requirements
to verified software
Qualyx converts your requirements and security policies into executable verification plans. Runs deterministic and AI-assisted tests, collects evidence, and produces auditable quality gates.
$ pip install qualyxMost security scanners produce noise, not signal
You've seen the output. Hundreds of findings. Half are duplicates. A quarter are false positives from scanning test files or documentation. The rest are generic recommendations that don't apply to your codebase.
The result: developers stop trusting security tools, and real issues get lost in the noise.
Duplicate findings across scanners
Semgrep finds it, SonarQube finds it, Snyk finds it. Three tickets for the same issue.
Findings with no evidence
A scanner says 'potential SQL injection' but doesn't show the data flow or confirm it's reachable.
Documentation scanned as code
Secrets detectors flag example.env, test fixtures, and commented-out placeholders as critical findings.
Checklist text dressed up as detections
Generic recommendations that don't relate to your actual codebase: 'Consider implementing rate limiting' on an internal admin tool.
False positives you have to explain away
Security reviews become debates about whether a finding is real, slowing down every PR.
Capabilities
Everything you need to verify software
Built-in tools, techniques, and AI reasoning — connected into a single verification pipeline.
25 Built-in Tools
File inspection, document analysis, project discovery, security scanning, git operations, and test execution — all wired in.
28 QA Techniques
Test design, test types, security analysis, non-functional testing, and quality techniques across 5 categories.
AI Cross-Validation
AI analyzes findings against actual code context — determines reachability, filters false positives, excludes test fixtures.
Evidence-Based Findings
Every finding includes file:line references, code snippets, data flow, content hashes, and timestamps for audit trails.
Quality Gates
Configurable scoring with pass/fail thresholds for critical, high, and medium findings. CI/CD exit codes included.
Policy Enforcement
Load security policies from Markdown, PDF, or DOCX. Map findings to SOC 2, OWASP, NIST, ISO 27001, PCI DSS.
5 Report Formats
Terminal, JSON, Markdown, HTML, and SARIF output. Reports saved to .qualyx/reports/ with structured data.
CI/CD Integration
GitHub Actions, GitLab CI, Jenkins, CircleCI. Run qualyx check in any pipeline with --no-ai for deterministic results.
How It Works
Scan. Validate. Fix. Gate.
A real sequence, not a black box. Every step is deterministic and auditable.
Scan
Scan
Run SAST (Semgrep), SCA (pip-audit/npm audit), secrets detection (TruffleHog), IaC security (Checkov), and AI code review in parallel.
$ qualyx check . Running 5 scanners in parallel...
Cross-validate
Cross-validate
AI analyzes each finding against your actual code context: Is this reachable? Is this test code? Is this a placeholder?
Cross-validating 47 findings... ✓ 12 duplicates merged ✓ 8 false positives filtered ✓ 3 test fixtures excluded
Evidence
Evidence
Each remaining finding includes file:line reference, the vulnerable code snippet, data flow (if applicable), and why it's a real issue.
Finding QLY-001: SQL Injection
File: auth/login.py:42
Evidence: User input 'username' flows
directly into SQL query stringRemediate
Remediate
Get specific fixes with code examples, not generic advice. AI generates patches tailored to your codebase.
Remediation:
Use parameterized query:
cursor.execute(
"SELECT * FROM users WHERE id=?",
(user_id,)
)Quality gate
Quality gate
Block commits that fail your quality bar. Configure what passes and what requires human review.
┌─────────────────────────┐ │ QUALITY GATE: FAIL │ │ │ │ Security: 2 critical │ │ Tests: PASS │ │ Policies: PASS │ └─────────────────────────┘
What it checks
Integrates with real scanners, not toy implementations. AI cross-validates results.
SAST
Semgrep- •SQL injection, command injection, XSS
- •Insecure deserialization
- •Path traversal, SSRF
- •Authentication bypasses
- •Cryptographic weaknesses
SCA
pip-audit, npm audit- •Known CVEs in dependencies
- •Transitive vulnerabilities
- •Outdated packages with security fixes
- •License compliance issues
Secrets
TruffleHog- •API keys, tokens, passwords in code
- •Database credentials
- •Private keys, certificates
- •Cloud provider secrets
IaC / Docker
Checkov- •Terraform misconfigurations
- •CloudFormation security gaps
- •Dockerfile best practices
- •Kubernetes pod security
AI Code Review
LLM + custom rules- •Logic errors and race conditions
- •Missing error handling
- •Policy violations (your org's rules)
- •Incomplete implementations
QA / Requirements
Test analysis- •Uncovered requirements
- •Missing test cases
- •Broken tests
- •Coverage gaps
A real finding, end-to-end
See the detection, evidence, and remediation before you install anything.
def authenticate(username, password):
query = f"SELECT * FROM users WHERE username='{username}' AND password='{password}'"
cursor.execute(query)
return cursor.fetchone()Evidence
- →User input 'username' received from request.form
- →Flows directly into f-string SQL query at line 42
- →No sanitization or parameterization applied
- →Query executed via cursor.execute()
Why this is real
Login endpoint is externally accessible. Username field has no length validation, allowing arbitrary SQL injection.
# Use parameterized queries
def authenticate(username, password):
query = "SELECT * FROM users WHERE username=? AND password=?"
cursor.execute(query, (username, password))
return cursor.fetchone()AI + Tools
AI that can verify, not just review
Qualyx doesn't rely solely on an LLM. It combines AI reasoning with deterministic tools, automated tests, security scanners, and repository analysis — all backed by evidence.
The Problem
Software quality shouldn't depend on manual inspection
Modern software is complex. It has requirements, policies, code, tests, dependencies, APIs, security controls, and infrastructure. Most teams check these in isolation — if at all.
Qualyx connects them into one verification pipeline, powered by AI reasoning and deterministic tools.
Feed in your org's security policies
Qualyx doesn't just run generic OWASP checks. Drop in your actual security policy documents (markdown, PDF, DOCX), and it will verify code against your specific rules.
Map findings to compliance frameworks your auditor actually cares about.
Built-in compliance mappings
# Authentication Policy
All authenticated endpoints must:
- Validate identity via JWT or session
- Verify authorization for the requested resource
- Reject expired tokens (max 24h lifetime)
- Log all authentication failures
Rate limiting required on:
- Login endpoints: max 5 attempts per minute
- Password reset: max 3 per hour
- API endpoints: per-plan limits12 requirements extracted. Qualyx will now check:
- • JWT expiration on all auth endpoints
- • Rate limiting configuration
- • Auth failure logging
Comparison
The difference Qualyx makes
Without Qualyx
With Qualyx
CLI Experience
Built for the terminal
Qualyx provides a comprehensive CLI for managing your quality engineering workflow. Run verification, inspect projects, and manage providers — all from your terminal.
Developer Workflow
Verify on every push
Integrate Qualyx into your CI/CD pipeline for continuous quality verification.
Developer
Writes code and pushes
git push
Triggers verification
Qualyx
Runs full verification
Tool registry and extensibility
Plug in new scanners via the tool registry. Configure providers for your stack.
Scanners
Providers
CI/CD Integration
Add custom scanners via the tool registry API. Write Python plugins for domain-specific checks.
Documentation
Everything you need to get started
From installation to CI/CD integration. Real commands, real config, real output.
Install Qualyx and run your first verification in under 5 minutes.
01Install
Requires Python 3.12+. For AI features: pip install "qualyx[ai]"
pip install qualyx02Initialize
Creates .qualyx.yaml config and .qa/ directory structure.
qualyx init --name my-project .03Add Requirements
Write requirements in Markdown with optional severity and verification hints.
# Create requirements.md
## REQ-001
All API endpoints must require authentication.
Severity: CRITICAL04Run Verification
Runs the full pipeline: scan, plan, execute, evaluate, report.
qualyx check .Pricing
Start free. Add your team when you need collaboration features.
Open Source
For individual developers and open source projects
- ✓25 built-in tools
- ✓28 QA techniques
- ✓AI code review (your API key)
- ✓Local execution only
- ✓Community support
- ✓CLI + interactive mode
Team
For engineering and security teams
- ✓Everything in Open Source
- ✓Shared AI credits
- ✓CI/CD integration
- ✓Custom policies
- ✓Quality gates
- ✓Team dashboard
- ✓Email support
Enterprise
For organizations with advanced requirements
- ✓Everything in Team
- ✓SSO / SAML
- ✓Self-hosted option
- ✓Unlimited policies
- ✓Custom scanner integration
- ✓SLA guarantee
- ✓Dedicated support
For Every Team
Qualyx adapts to your workflow
Whether you're a solo developer or an enterprise engineering org, Qualyx fits into your existing process.
For Development Teams
Catch regressions before merge. Every push runs a full verification pipeline — requirements, security, policies, and tests.
For QA Teams
Automate requirement-driven verification. Map every finding back to a specific requirement with structured evidence.
For Security Teams
Combine SAST, SCA, secrets detection, and IaC scanning with AI cross-validation. Reduce noise by filtering false positives.
For Enterprise
Enforce organization-wide policies across all teams. Map findings to SOC 2, OWASP, NIST, ISO 27001, PCI DSS frameworks.
Use Cases
For every team
Whether you're a solo developer or an enterprise engineering org, Qualyx adapts to your workflow.
Development Teams
Catch regressions before merge. Every push runs a full verification pipeline.
QA Teams
Automate requirement-driven verification with structured evidence.
Security Teams
Combine security tooling with AI-assisted analysis to reduce noise.
Enterprise
Enforce organization-wide engineering policies across all teams.
Open Source
Add automated quality gates to public repositories.
Make software verification continuous
Give every requirement, policy, and security rule a path to verification.
$ pip install qualyx