Reachability first. Policy second. Noise last.
Arbor focuses on the security evidence reviewers can actually verify: reachable call paths, sensitive surfaces with category classification, required proof before merge, and known limitations where the engine acknowledges uncertainty.
The core engine is deterministic — graph analysis, call-path reachability, and weighted evidence scoring. No LLM in the analysis path.
Built for the security review bottleneck AI created.
Arbor does not try to be another all-purpose reviewer. It is the deterministic evidence layer for PRs that touch security-critical paths.
10 surfaces. 4 verdicts. Structural evidence.
Every PR is analyzed against a deterministic security surface taxonomy with evidence-based verdicts.
High-centrality security code modified. Requires security team sign-off.
Reachable security paths detected. Manual review by code owner.
Proximity to sensitive code. Informational evidence provided.
No high-priority reachable security path detected. Evidence packet still shows limitations.
Scanners flag. LLMs speculate. Arbor proves.
The missing layer between noisy static analysis and vague AI suggestions: structural proof that a PR creates a reachable security path.
14 languages. Real AST parsing.
Syntax-accurate parsing for every supported language. The graph is built from actual function definitions, call sites, and imports.
The comment is evidence, not theater.
Arbor posts the reachable paths, sensitive surfaces, required proof, and limitations in the place reviewers already make the merge decision.
Block only when path is reachable
Arbor separates reachable risk from noisy static findings. A vulnerability in dead code is noise; one reachable from POST /checkout is a gate.
Reviewer-ready evidence
Every finding names the exact route, the sensitive sink, each hop in the call path, and the specific action required before merge.
Honest uncertainty
Dynamic imports, reflection, and unresolved edges become limitations in the comment, not hidden gaps or false green lights.
The graph engine is open. Inspect what Arbor sees.
Parsing and graph construction are open-source Rust crates. Read the code, run it locally, verify the call graph.