How Solidability Works
Working product name. SOLIDABILITY is a working brand; trademark clearance is pending. These pages describe a product under development. They do not claim the product is released, universally compatible, legally certified, or ready for public sale. Capabilities described as planned are not yet implemented.
The core idea
An AI reviewer needs to see code to help with it. Traditionally, that means handing the AI broad access — API keys, server logins, repository clones. Solidability replaces that with a purpose-built inspection gateway: the AI sees exactly what the owner allows, nothing more.
How it works, step by step
- Configure source access. The owner defines which files and directories the gateway can serve, using an allowlist (default-deny) and a blocklist for sensitive paths.
- Authenticate reviewers. Each authorized AI system receives a unique API credential. Credentials are independently revocable — removing one reviewer's access does not affect others.
- Redact secrets. Before any source code leaves the server, it passes through pattern-based redaction and a high-entropy detection net. API keys, tokens, passwords, and private keys are replaced with redaction markers.
- Navigate and inspect. Reviewers use a documented API to list files, search code, view function indexes, and read source in bounded chunks — all read-only.
- Produce findings. Reviewers return structured, evidence-backed findings: which files were examined, what was found, what evidence supports it, and what tests were performed.
- Owner decides. Findings go to the website owner (or their authorized engineer), who decides what to fix, how, and when. Solidability does not apply changes itself.
Audit and accountability
Every API request is logged against the reviewer's credential: what was accessed, when, and what was returned. Findings identify which AI produced them, which source versions were examined, and whether the claims were independently verified.
What stays with the owner
- Credential issuance and revocation
- Source access configuration
- Repair authorization and deployment
- All production systems and data
Planned capabilities (not yet implemented)
- Multi-language source parsing (currently JavaScript/TypeScript)
- MCP (Model Context Protocol) compatibility
- Temporary time-limited credentials
- Fine-grained per-reviewer path scoping