The security reviewer that runs after every change

Atmos finds vulnerabilities on your machine before they reach CI. Fast enough to run on every save.

Start in seconds

Atmos installs with one command on macOS, Linux and Windows. The scan runs the full managed ruleset with nothing to set up.

curl -fsSL https://atmoslab.dev/install.sh | bash

Sign in with GitHub

The installer opens a link in your browser. Sign in, approve, and your terminal is signed in.

Run the first scan

atmos scan . checks code and dependencies in one run. Findings show in your terminal and on your dashboard.

Under a second

Atmos rescans only what changed and usually returns the findings in under a second, a rescan on a repository with 2 million LoC finishes in less than 3 seconds.

Benchmarks →

atmos · scan

For coding agents

Coding agents write more code than most teams can read. Atmos rescans after every agent turn and hands the findings back to the agent that fixes what it just wrote before moving on.

Agent skills and the scan hook →

Agents write insecure code

Code written by AI that came back with a security flaw

Lower is safer

Java

71%

JavaScript

43%

42%

Python

38%

Atmos analyzes the three languages at the top of this chart, with Python next.

Published industry study, March 2026

Traced across files

Untrusted input enters in one file and the dangerous call may sit in another file. Atmos follows the input across every file and reports each step with file and line, in JavaScript, TypeScript, Java and C#.

SAST docs →

api/checkout.tsTS

12 export async function getOrder(req: Request) { 13 const id = req.query.id; // ← input enters 14 return findOrder(id); 15 }

untrusted data crosses the file boundary

db/orders.tsTS

41 export function findOrder(oid: string) { 42 return db.query(`SELECT * FROM orders WHERE id=${oid}`); 43 } // ← dangerous call · sql-injection

call path from your code reachable vulnerability unreachable · low priority

Only reachable vulnerabilities

Most known vulnerabilities in your dependencies sit in functions your code never calls. Atmos reads your npm, Maven and NuGet lockfiles with your source and checks whether your code can reach each vulnerable function.

SCA docs →

One dashboard

Findings from every developer machine and every CI run land in one place. Your team triages them there and sees what each pull request changed.

The Atmos dashboard listing findings for a workspace, with severity, rule and repository for each one. — The workspace dashboard at app.atmoslab.dev.

Your data

Atmos is rule based, with no AI model anywhere in the scan, so the same code gives the same result, every scan. Atmos never sends your code or the findings to an AI company.

a scan uploads

findingsrule ids, file paths, line numbers

repositoryidentity and branch

developershashes of committer emails

snippetsonly with --snippets

only checkswith --no-upload

Put your codebase under Atmos

Get started