.svg)
One graph. Six dimensions. Every decision.
Heeler is a context engine, not a scanner. Connect your repos, registries, and cloud. Six dimensions of context assemble automatically. Every Prevent, Fix, Audit, and Automate decision the platform makes reads from the same shared model.
Context is how you secure AI-speed development.
AI coding agents produce code — and vulnerabilities — faster than any team can review, and adversaries chain and weaponize them in minutes. Manual triage and severity queues can't hold that pace; only automation can. And automation is only as good as its context: a CVE in a test file is noise, the same CVE in an internet-facing, Tier-1 service is a P0. Get that wrong at machine speed and you've just automated the mistakes.
Legacy platforms bolt context onto a scanner as an afterthought — a tag here, an ownership CSV there — then still drop a queue on a human. Heeler is built context-first: one shared graph of code, cloud, business, ownership, threat, and agent data decides what matters, so every automated action downstream is safe to take.
Not a data warehouse. An active graph.
It assembles the moment you connect your first repo and cloud, and never goes stale — updating as code ships and services deploy, re-evaluating the instant new threat intelligence lands.
Every automated decision reads from that one graph, not its own silo:
the coding agent reads it before suggesting an upgrade, a PR guardrail reads it to block or warn, a workflow reads it to route a new finding to the owning team.
One source of truth — the reason Heeler can prevent, fix, and route at machine speed without a human checking every call.
Six dimensions of context, assembled once.
Each dimension is a first-class citizen of the graph. Each reads from the same connections. All six are queryable by every layer of the platform — the same context that a PR guardrail evaluates is what the code-generation agent sees.
The AI agent supply chain, inventoried.
Every skill your AI agents load is a new class of dependency — with the same supply-chain risk profile as npm or Maven.
- →Skill catalog inventories every skill file in use: skills.md, CLAUDE.md, AGENTS.md, and equivalents
- →Per-skill inspection: external binaries invoked, shell commands run, secrets embedded, outbound network calls
- →MCP config inventory across the environment
- →Security score per skill, with risky patterns flagged and mapped to MITRE ATLAS and the OWASP LLM Top 10
- →Governance: filter and search across skills as a first-class dependency class
Every repo, module, and dependency — resolved.
Build-emulation resolution — lockfiles optional, no pipeline integration, no manual manifest curation.
- →Full dependency tree: direct and transitive, first-party and third-party — including dependencies vendored inside CI/CD actions
- →Monorepo auto-decomposition into modules — reactor and workspace layouts (Maven, Gradle, Cargo, uv) resolved as separate units
- →Proprietary Symbol Property Graph engine — not pattern matching. Cross-function, cross-file, source-to-sink taint.
- →First-party library lineage traced back to source repo for transitive remediation
- →CI/CD modeled as a peer ecosystem: workflows walked transitively at depth 10
Deployment state, mapped to code.
Sensor-less inventory means every container, VM, and serverless function is fingerprinted — no agents installed.
- →Each deployment mapped to the exact running changeset — reachability grounded in what actually shipped
- →Running container images fingerprinted and matched back to the exact source commit
- →Service-to-service connections with directionality, data flows, identity relationships
- →Internet accessibility (including CDNs) detected automatically
- →Environmental boundaries auto-classified: production, corporate, DR, staging, test, dev, sandbox
Applications, tiers, and criticality.
The business layer of the graph is what turns a CVE score into a real risk decision.
- →Service tier classification (Tier 1–4) captures data sensitivity, regulatory scope, and customer-trust impact
- →Tier set at the application level cascades to every service in that application
- →Precedence rule: repos shared across applications inherit the highest tier (Tier 1 wins over Tier 4)
- →Applications group services that deliver a shared business outcome — the unit for ownership, tier, and reporting
- →Production identification is automated — no manual labeling required
Who owns what, down to the dependency.
Routing work correctly is the difference between an autonomous fix pipeline and a ticket that sits open for 90 days.
- →Automated ownership — Tech Lead, Security Lead, Assignee — cascading from application to repo, service, and finding
- →Tech Lead and Security Lead designations propagate from app down to individual dependency
- →Team import and sync from Port, GitHub Teams, GitLab groups, and GitHub custom properties
- →Contributor de-duplication across multiple emails and SCM identities
- →Highest-contributor fallback when explicit team mapping is absent
Every feed, resolved and reconciled.
Alias-aware, ecosystem-native, exploit-informed. The threat layer is what turns EPSS-plus-CVSS into a real exposure verdict.
- →Advisories: GHSA (alias-aware GHSA↔CVE resolution), OSV (ecosystem-native), NVD/CVE with CVSS v3 and v4
- →Compromised & malicious: OSSF Malicious Packages, OSV malicious-package stream, Heeler package-risk intelligence, behavioral-SAST backstop
- →Exploit & weaponization: CISA-KEV, VulnCheck-KEV, EPSS (score + percentile), CVSS v4 ExploitMaturity, known-ransomware-campaign flag
- →Supply-chain hygiene: OSSF Scorecard
- →Continuous re-evaluation — an advisory that switches identifier doesn't break remediation
Connect three things. The graph builds itself.
No scanner to install, no data to pipe in. Heeler assembles the entire graph from three read-only connections — and connecting all three takes under 15 minutes. No pipeline integration, no build changes, no tagging, and no sensors in your environment.
Your SCM
GitHub, GitLab, Bitbucket, or Azure DevOps — code, dependencies, CI/CD workflows, contributors, and history.
What you actually ship
Container and package registries — the built artifacts Heeler fingerprints back to their source commit.
Your CSP
AWS, GCP, and Azure control planes, read-only via API — what's deployed, where it runs, and how it's exposed.
SERVICE MODELING
Every running service, mapped to the code behind it.
Connect your clouds, registries, and SCM, and Heeler fingerprints what's actually deployed and correlates it back to the exact source behind it — a patent-pending method that needs no agents, no sensors, and no build-pipeline changes. It's the differentiator: automation can only be trusted if it knows precisely what it's acting on.
Every workload — serverless functions, containers, and VMs — inventoried straight from your cloud APIs across AWS, GCP, and Azure.
Heeler matches each running artifact to your source using signals like Go symbol hashes, Java class signatures, and file and dependency checksums — resolving the exact running commit with a confidence score. Image and build labels verify the match; they're never required.
Each deployment is keyed to its source changeset and stores the correlation evidence. A new commit is a new deployment — so you always know exactly what's live.
Every deployment is placed on its real boundary — production, staging, dev, test — automatically, so risk scoring and enforcement apply where code actually runs, not where a spreadsheet says it does.
Once a service is modeled, everything Heeler knows attaches to it
- Deployments
- Dependencies
- SCA findings
- SAST findings
- Compromised dependencies
- Secrets
- Endpoints
- License violations
- Service-to-service relationships
That's the jump from a list of findings to a picture of your real, running risk.
One shared model. Four operational outcomes.
When every decision reads from the same context engine, downstream capabilities become qualitatively different. This is what buyers evaluate against on a real POV — not "do you have SAST?" but "what happens when the SAST finding lands?"
Precise, not theoretical.
Runtime exposure, reachability, business tier, and threat maturity feed one score — Heeler Risk (Urgent / Plan / Defer), not just CVSS + EPSS from advisory metadata. A CVE in a test-only Tier 4 path never drowns out a live one on a Tier 1 internet-facing endpoint.
Deterministic, not suggested.
Heeler analyzes the dependency graph, changelog, breaking changes, and reachability of called methods, then picks the version — the agent executes, Heeler decides. Sandboxed CI validates before the PR opens, so the result is a merge-ready patch with evidence, not a suggestion with caveats.
Surgical, not blanket.
PR guardrails scope by service runtime context, branch, and diff-only net-new violations — so developers aren't penalized for inherited debt and policies aren't blunted to avoid noise. Block / Warn / Observe lets AppSec roll out policy without an outage.
Autonomous, not campaign-scoped.
Event-driven triggers fire the moment a finding, secret, or malicious dependency lands, and because ownership and ticketing already live in the graph, the work routes itself — a Jira/Linear ticket or Slack/Teams message to the owning team, or an auto-remediation PR. No manual assignment, no triage queue.
See the Context Engine across your environment.
A demo connects Heeler to your repos and cloud. Six dimensions come together in minutes, not weeks. From there, prioritization, remediation, and workflows all read from the same shared model — with none of the sensors, tagging, or build changes typical of legacy platforms.
