Skip to main content

Audit tools & languages

A full audit is broad: Hyrax runs a large catalog of checks across your whole repository. You don't pick tools or build a profile — breadth is the point, because the value of catching the thing you weren't looking for is high. How much of the catalog an audit runs depends on the depth you pick (see Audit depth below).

For how an audit runs, see How Hyrax works. For what it produces, see Findings & Code health.

What an audit covers​

A full audit checks your code across six categories; the Standard audit covers four of them fully, plus the dependency checks from Operations (see Audit depth). A finding's page shows the category that produced it. On Code health you filter by domain instead: seven groupings of the same checks, listed in Findings & Code health.

  • Security — auth and access control, vulnerabilities, leaked secrets, supply-chain exposure, PII handling, and compliance gaps (GDPR, SOC 2, HIPAA).
  • Correctness — concurrency bugs, test coverage, state handling, resilience, accessibility, internationalization, and wasteful resource use.
  • Maintainability — code structure and naming, duplication, dead code, deprecated APIs, error handling, and stalled migrations.
  • Performance — slow queries and hot paths, frontend render and Core Web Vitals, and JavaScript bundle size.
  • Architecture — API contracts and documentation, versioning, input validation, database and schema risks, and isolation between your own customers' data.
  • Operations — observability, logging, configuration, deployment safety, dependency vulnerabilities and licenses, stale feature flags, monorepo health, and docs that have drifted from the code.

Dependency checks go beyond pattern matching: Hyrax runs your ecosystem's native package-audit commands and queries package registries for real vulnerability data, then layers on license, lockfile, and supply-chain checks.

Supported languages​

Hyrax classifies and audits these languages:

PythonJavaScriptTypeScriptGo
RustSwiftRubyJava
KotlinC#C++C
PHPScalaDartElixir
ShellLua

A few things to know:

  • HCL / Terraform is not supported.
  • MDX is recognized, not audited. Hyrax classifies .mdx files so docs- and Storybook-heavy repos aren't read as unsupported, but no audit tooling targets MDX itself.
  • Polyglot repos still get audited. A repo that mixes supported and unsupported languages is audited fine — the unsupported parts are skipped, and the reasoning agents bring useful judgment even to languages without bespoke rules.

Audit depth​

The catalog above is what the Full audit runs. The audit comes in two depths, and both are available on every plan — depth is a choice about how much you want to spend on a given run, not something your plan unlocks:

  • Standard audit — the same engine as the Full audit over a focused 24-tool subset: all of security, correctness, maintainability, and performance, plus dependency checks. It drops the architecture group and the rest of operations.
  • Full audit — the complete ~39-tool catalog described above, including architecture analysis and the full operations set. The Standard audit's tools are a strict subset of it.

In the app, you pick the depth each time you run an audit:

  • The Run audit button on Activity and Code health opens a dialog with a Depth choice: Standard (The usual audit. Faster and cheaper.) or Full (Every audit tool. Slower, and costs more.).
  • On a repository's page, the Run Standard Audit button runs a Standard audit in one click. The menu next to it lets you choose Full audit, which runs after a quick confirmation because it takes longer and costs more. The same menu ends with Re-check findings, which re-checks the open findings without auditing for new ones (see Revalidate).

See Running audits and Workflows.

Audits never start on their own — the first audit on a repository is always yours to trigger. What does run automatically is Discovery: it starts when you add a repository on the web or through the REST API, unless something holds it back, such as your workspace's usage limits, but not when you add one through the MCP server or chat. Auditing a repository requires its Discovery to have completed.

Where to go next​