THE ARKO PLATFORM
ARKO connects your organisation’s policies, code checks and review evidence across the tools your teams use to build.
INSIDE THE WORKFLOW
Understand what drives your Code Health Score: follow the underlying findings, the checked scope and the proposed change. Explore the complete example workspace: five findings, code changes, verification, agent activity and the Control Plane.
The demonstration uses sample code and data. It does not scan a live project.
Try it on a project
arkoINTERACTIVE WORKSPACEAdd an AI assistant that can look up a customer’s orders. Follow our approved services, protect credentials and keep the request bounded.
The coding agent proposes the change. ARKO supplies the independent check. Follow the same findings across both views.
The local change, policy and recheck belong to the same record. This view updates as you use the demo.
FROM THE FIRST EDIT TO THE RELEASE DECISION
Different stages expose different risks. Follow the workflow to see where checks, gates and evidence fit—and what each integration needs.
CONTEXT & POLICY
Bring application context, approved patterns and organisational policies into the review. Make the intended architecture visible before judging the change.
Supply and maintain the context relevant to the application and team.
Explore system contextDEVELOPER WORKFLOW
Find risks, inspect the explanation and review a proposed fix without leaving the supported editor. Recheck the updated source with the scope kept clear.
Available background checks follow the extension settings and organisation configuration.
Install the extensionMCP WORKFLOW
Connect ARKO to your coding agent through MCP. The agent can submit source and dependencies, explain findings and check the changes it makes.
MCP supplies tools. An agent’s completion behaviour also depends on its instructions and configured hooks.
Connect MCPREPOSITORY GATES
Use repository checks and configured hooks to make the policy part of the development workflow. Choose how a failed or incomplete check should affect the next action.
Review the generated gate configuration; different clients have different enforcement points.
Explore repository gatesPULL REQUESTS
Connect repository and CI checks to the change under review. Keep findings, proposed remediation and the checked scope visible to the people approving the merge.
A failed check blocks merging only when the repository’s required-check policy enforces it.
Explore delivery checksDEPENDENCIES & ARTEFACTS
Inspect dependency and supply-chain risk, review software inventory and carry evidence about the checked source or artefact into the release decision.
Source, dependency and artefact checks cover different things. Confirm the available integrations for your pipeline.
Explore evidence scopePRODUCT DIRECTION
Simulation exercises a running application in an isolated environment, looking at routes, boundaries and behaviour. Its value is evidence from execution alongside findings inferred from source.
Future-direction overview. Confirm current availability and requirements with ARKO before planning this part of your rollout.
Explore the simulation workflowPRODUCT DIRECTION
Evidence from a deployed system answers different questions from a source scan. Bring the intended observation scope, data boundaries and review responsibilities into the rollout discussion.
Future-direction overview. Confirm current availability and requirements with ARKO before planning this part of your rollout.
Discuss your environmentWorkflow overview. Controls and availability depend on the integration, deployment and agreed scope.
HUMANS. AGENTS. THE SAME STANDARD.
Inspect the finding, its context and the proposed change. Stay in control of what is applied.
Set up the IDE ↗Give your agent ARKO tools through MCP. Bring the independent result back into its next action.
Connect your agent ↗Use supported hooks and repository checks to apply your policy. Enforcement depends on the integration and configuration.
Explore gate setup ↗FROM FINDING TO REVIEWED CHANGE
Keep remediation close to the finding, whether the change starts in the editor, an agent session or a repository review.
Understand the change and its context before applying it. Keep the developer involved in the decision.
Use supported remediation and pull-request workflows. Your review and merge policies still govern what ships.
Recheck the updated source and retain the finding, change, scope and decision in the shared view.
FROM INFERENCE TO EXECUTION EVIDENCE
Walk through an example customer-isolation check: from a source finding to a reproduced behaviour, then a recheck of the changed application.
A source finding suggests that an authenticated customer may be able to request another customer’s order. It has not been reproduced yet.
Interactive illustration of the product direction. No application or security test runs here. Confirm current simulation availability, prerequisites and scope with ARKO.
Discuss simulation for your environment ↗THE ORGANISATION BEHIND THE CODE
A line of code is only part of the picture. Connect it to the application, approved patterns and the standards your organisation needs to uphold.
arkoShared contextPolicies ⇄ EvidenceBring the route, authentication boundary and data flow into the finding. Judge it against the application’s actual responsibilities.
Your team’s decisions and updated policies inform subsequent checks across connected work.
INSIDE THE CHECK
Deterministic checks, relevant context and configured model perspectives contribute to the assessment. ARKO Core evaluates the findings and proposed changes.
Use deterministic checks for recognised risks. Keep the finding and its supporting source visible before adding further analysis.
ONE PLATFORM, CONNECTED PERSPECTIVES
01 / SECURITY
Find vulnerabilities, exposed secrets, dependency risks and infrastructure misconfigurations in the context of your code.
ARCHITECTURE · THREATS · EXPOSURE
Look beyond the line of code. Bring the application’s shape and the organisation’s priorities into the decision.
Review components, routes, data flows and dependencies alongside the finding. Application context helps explain why the same code pattern can matter differently in different systems.
Illustrative system map. No customer application is shown.
Bring threat modelling into the review: entry points, trust boundaries, sensitive data and the controls intended to protect them. Keep assumptions and supporting evidence visible.
Example review questions: who can reach this route, and what should they be allowed to access?
Inspect exposed entry points and cross-repository context, including shared dependencies and recurring weaknesses. Distinguish an inferred connection from a path reproduced through execution.
Illustrative exposure path. A connected path is not a claim of reproduced exploitation.
CONTROL LAYER ≠ CODING MODEL
The coding model helps produce the change. ARKO brings the surrounding policy, independent checks, remediation workflow and evidence together.
Connect through supported IDE, MCP and delivery integrations. Keep your governance decisions separate from the coding tool your team chooses.
If you need customer-managed inference or a particular deployment boundary, discuss the supported options with ARKO.
Discuss models and deploymentACROSS YOUR ORGANISATION
Bring your policies to every connected workflow. Bring findings, changes and review evidence back into one shared view.
Your team owns the standards.
ARKO connects them to the work.
GOVERNANCE ACROSS YOUR ORGANISATION
Teams use different editors, agents and repositories. ARKO connects their work to centrally managed policies, then brings the findings, fixes and review context back.
arkoBring your organisation’s approved package choices into connected coding workflows.
POLICIES OUT
A common baseline reaches each connected workflow through ARKO.
Select a team to follow its connection. Select it again to return to the whole organisation.
Illustrative organisation and policies. Available controls depend on your integration and organisation configuration.
ACROSS THE CODE YOU ALREADY OWN
New agent-generated code joins an existing system. Bring findings across repositories into one view and configure how checks keep up with change.
Run checks from your editor or agent. Available automatic checks and hooks follow the integration and organisation configuration.
Connect your workflowFollow repository findings and exposure context centrally. Configure change-triggered checks and scheduled re-scans for connected repositories.
Discuss repository coverageChoose advisory or blocking behaviour where supported. Keep the scope, completed checks and remaining findings visible to the people deciding.
Explore MCP gatesTHE CONTROL PLANE
See which repository was checked, which workflow submitted it and what still needs attention. Keep the source and scope of each result visible.
| Repository | Check source | Analysed scope | Completion | Review context |
|---|---|---|---|---|
| example-api | Agent | Edited files · revision A | Complete | Query finding needs review |
| example-web | CI | Submitted change · revision B | Complete | Policy exception needs a decision |
| example-worker | Repository | Full checkout · revision C | Incomplete | Await a completed result |
Follow shared dependencies and recurring findings across repositories. Review inferred relationships alongside their supporting evidence.
READ THE FINDINGS BEHIND THE SCORE
Use the Code Health Score as a starting point, then inspect the findings, revision and completed scope. Where available, known-exploited indicators and exploit-probability signals add context to dependency prioritisation.
KEEP THE LENSES DISTINCT
Review security risk separately from advisory code-health, cost and strategy signals. Apply the policy appropriate to each finding rather than treating every perspective as the same gate.
THE DECISION LEDGER
Follow the finding, the change, the reviewer’s decision and the result of the next check. Give the next person a record they can inspect.
Keep human, agent and pipeline activity distinguishable. Follow decisions to fix or accept a finding, with the relevant context and responsibility visible.
A check of edited files, a full repository review and a running-system observation establish different things. Preserve that distinction in the evidence.
Discuss your evidence requirementsWhat the check found in the code submitted from that session.
Other files and subsequent changes need their own coverage.
The findings and completion status for the reviewed change and configured check.
Required-check policy determines whether that result blocks a merge.
A broader view of repository findings, dependencies and recurring exposure.
Coverage is tied to the revision, included files and completed checks.
What the relevant artefact and dependency checks establish about that build.
An artefact result does not by itself demonstrate a running exploit or operational behaviour.
The proposed workflow would record what was reproduced or observed within an agreed running environment.
Executable simulation and runtime availability need confirmation before rollout.
START WITH A WORKFLOW. GROW INTO ORGANISATION CONTROL.
FOR DEVELOPERS
Get ARKO into the tools you use to build.
FOR SECURITY & ENGINEERING TEAMS
Bring policies, repository coverage and evidence into one organisation view.
Confirm enterprise capabilities, usage limits, identity requirements and commercial terms with ARKO.
DEPLOYMENT & DATA BOUNDARIES
Start with where your code, inference and evidence may run. Review the supported configuration with ARKO before committing to a rollout.
Illustrative architecture boundary. Select a mode to compare; the supported configuration is agreed with ARKO.
Connect supported tools and repositories to ARKO’s managed service. Agree organisation access, policies and the evidence your stakeholders need.
Discuss this deploymentDiscuss the right workspace and integration setup.
If your organisation requires an approved model provider or customer-owned inference, start with those constraints. Confirm the supported provider, account boundary and operating responsibility before rollout.
Discuss this deploymentEnterprise architecture discussion; not a self-service availability claim.
Discuss which workloads need to run within your infrastructure, the connectivity they require and how findings return to the Control Plane.
Discuss this deploymentConfirm supported runner and deployment options with ARKO.
For restricted or isolated environments, define network, identity, inference and evidence requirements together. Establish what is supported and what requires additional work.
Discuss this deploymentRequirements-led discussion; air-gapped availability is not assumed.
Findings and minimal snippets retained. Your full source is not retained after scanning, and your code is not used to train models. Read the processing details ↗
YOUR TOOLS, CONNECTED
Inspect findings and remediation guidance in the editor. Run an explicit first scan and configure available automation with your organisation.
Install the extensionGive your coding agent access to ARKO tools. Source checks and dependency checks become part of the task.
Set up MCPDiscuss repository and CI workflows, policy controls, access requirements and the deployment approach your organisation needs.
Plan your rolloutCOMMON QUESTIONS
CORRECT BY DESIGN
Start with one workflow. Bring its checks, policies and evidence into the organisation.