AI SOFTWARE COMPOSITION ANALYSIS

Know what's
actually
exploitable.

Most SCA tools hand you a list of CVEs and leave you to figure out which ones are real. 00felix scans your full dependency graph, traces every vulnerability back to whether your code can actually reach it, then validates each finding with AI before it becomes a ticket. The result: a short list of confirmed, reachable, actionable vulnerabilities, not hundreds of alerts your team can't act on.

scanning: acme-corp/payments-service
dependencies scanned2,847
CVEs matched312
reachable in your code41
AI-validated findings23
zombie CVEs dismissed289
DEPENDENCY GRAPH SCANNING

Every dependency.
Every transitive edge.

00felix builds your full dependency graph natively, not by reading what another tool reported. It resolves direct dependencies, their transitive dependencies, and the full chain of relationships between them, across Java, JavaScript, Python, and .NET, across every repository in your fleet simultaneously.

Most vulnerabilities don't live in the package you declared. They live three layers down in something you have never heard of that got pulled in transitively. 00felix finds those too.

dependency graph · payments-service
// direct dependencies: 48
spring-boot-starter-web 3.2.5
jackson-databind 2.17.1
log4j2 2.22.1
 
// transitive depth 2: 214 packages
spring-webmvc 6.1.12 via spring-boot-starter-web
netty-codec-http 4.1.108 via reactor-netty
 
// transitive depth 3+: 2,585 packages
full graph resolved · 2,847 total nodes
reachability analysis
netty-codec-http
REACHABLE
commons-text
NOT REACHED
spring-webmvc
REACHABLE
jackson-databind
NOT REACHED
snakeyaml
NOT REACHED
41 reachable 271 not reached 87% noise cut
REACHABILITY ANALYSIS

Most CVEs in your tree will never touch your code.

A CVE only matters if the vulnerable code path is reachable from your application. A package can be in your dependency tree while none of your code ever calls the function that contains the vulnerability. Traditional SCA tools flag it anyway. 00felix doesn't.

00felix traces every call path from your first-party code into your dependency graph and maps which CVEs sit behind reachable code and which sit in branches your application never enters. The packages you're not calling can't exploit you, and your engineers shouldn't be spending time on them.

AI-VALIDATED FINDINGS

Reachable doesn't always mean exploitable.
AI validates the difference.

Reachability tells you whether your code calls into a vulnerable code path. It doesn't tell you whether an attacker can trigger it from the outside. 00felix runs an AI validation pass on every reachable finding to assess real-world exploitability: does the vulnerability require input your application exposes? Is it behind authentication your threat model assumes is intact? Is there a compensating control already in place?

Findings that clear AI validation become confirmed, actionable vulnerabilities. Findings that don't are dismissed with a reason, not silently dropped. Every decision is visible and auditable.

ai validation pass
CVE-2024-38819 AI reviewed
spring-webmvc 6.1.12 · path traversal
● CONFIRMED
CVE-2024-22243 AI reviewed
spring-web 6.1.3 · open redirect
● CONFIRMED
CVE-2023-46589 AI reviewed
tomcat-embed-core 10.1.13 · request smuggling
✕ DISMISSED · unexposed endpoint
CVE-2022-1471 AI reviewed
snakeyaml 1.33 · deserialization
✕ DISMISSED · input not user-controlled
THE SCAN PIPELINE

From repo to confirmed
finding in one pass.

01
Build the dependency graph
00felix connects to your GitHub repositories and resolves every dependency natively, walking the full transitive graph to map every node, version, and relationship. No agent installed, no production access required.
02
Match against vulnerability databases
Every resolved package and version is matched against NVD, OSV, and GitHub Advisories. Matches are recorded with CVSS scores, severity, and advisory metadata.
03
Run reachability analysis
00felix traces your first-party call paths into the dependency graph to determine which vulnerable functions are actually called by your code. Unreachable CVEs are deprioritized immediately, cutting the list by up to 87%.
04
AI validates every reachable finding
Each reachable CVE goes through an AI validation pass that evaluates real-world exploitability in the context of your application: exposed attack surface, input control, existing mitigations. Findings are confirmed or dismissed with a visible, auditable reason.
05
Deliver a short, confirmed list
What comes out is a prioritized list of confirmed, reachable, AI-validated vulnerabilities, ranked by real risk. No noise. No zombie CVEs. No alert fatigue.
WHAT HAPPENS NEXT
00felix confirmed it.
Now it fixes it.
Verified Upgrade takes every confirmed finding and resolves it automatically: root cause traced, first-party code rewritten if needed, fix verified against your build, PR opened for your team to approve.
SEE HOW VERIFIED UPGRADE WORKS →
GET STARTED TODAY · FREE ON ANY REPO

Find out what's actually
exploitable in your code.

Run 00felix on any GitHub repo in minutes.
No setup. No sales call. No credit card.

AI SOFTWARE COMPOSITION ANALYSIS

Know what's
actually
exploitable.

Most SCA tools hand you a list of CVEs and leave you to figure out which ones are real. 00felix scans your full dependency graph, traces every vulnerability back to whether your code can actually reach it, then validates each finding with AI before it becomes a ticket. The result: a short list of confirmed, reachable, actionable vulnerabilities, not hundreds of alerts your team can't act on.

scanning: acme-corp/payments-service
dependencies scanned2,847
CVEs matched312
reachable in your code41
AI-validated findings23
zombie CVEs dismissed289
DEPENDENCY GRAPH SCANNING

Every dependency.
Every transitive edge.

00felix builds your full dependency graph natively, not by reading what another tool reported. It resolves direct dependencies, their transitive dependencies, and the full chain of relationships between them, across Java, JavaScript, Python, and .NET, across every repository in your fleet simultaneously.

Most vulnerabilities don't live in the package you declared. They live three layers down in something you have never heard of that got pulled in transitively. 00felix finds those too.

dependency graph · payments-service
// direct dependencies: 48
spring-boot-starter-web 3.2.5
jackson-databind 2.17.1
log4j2 2.22.1
 
// transitive depth 2: 214 packages
spring-webmvc 6.1.12 via spring-boot-starter-web
netty-codec-http 4.1.108 via reactor-netty
 
// transitive depth 3+: 2,585 packages
full graph resolved · 2,847 total nodes
reachability analysis
netty-codec-http
REACHABLE
commons-text
NOT REACHED
spring-webmvc
REACHABLE
jackson-databind
NOT REACHED
snakeyaml
NOT REACHED
41 reachable 271 not reached 87% noise cut
REACHABILITY ANALYSIS

Most CVEs in your tree will never touch your code.

A CVE only matters if the vulnerable code path is reachable from your application. A package can be in your dependency tree while none of your code ever calls the function that contains the vulnerability. Traditional SCA tools flag it anyway. 00felix doesn't.

00felix traces every call path from your first-party code into your dependency graph and maps which CVEs sit behind reachable code and which sit in branches your application never enters. The packages you're not calling can't exploit you, and your engineers shouldn't be spending time on them.

AI-VALIDATED FINDINGS

Reachable doesn't always mean exploitable.
AI validates the difference.

Reachability tells you whether your code calls into a vulnerable code path. It doesn't tell you whether an attacker can trigger it from the outside. 00felix runs an AI validation pass on every reachable finding to assess real-world exploitability: does the vulnerability require input your application exposes? Is it behind authentication your threat model assumes is intact? Is there a compensating control already in place?

Findings that clear AI validation become confirmed, actionable vulnerabilities. Findings that don't are dismissed with a reason, not silently dropped. Every decision is visible and auditable.

ai validation pass
CVE-2024-38819 AI reviewed
spring-webmvc 6.1.12 · path traversal
● CONFIRMED
CVE-2024-22243 AI reviewed
spring-web 6.1.3 · open redirect
● CONFIRMED
CVE-2023-46589 AI reviewed
tomcat-embed-core 10.1.13 · request smuggling
✕ DISMISSED · unexposed endpoint
CVE-2022-1471 AI reviewed
snakeyaml 1.33 · deserialization
✕ DISMISSED · input not user-controlled
THE SCAN PIPELINE

From repo to confirmed
finding in one pass.

01
Build the dependency graph
00felix connects to your GitHub repositories and resolves every dependency natively, walking the full transitive graph to map every node, version, and relationship. No agent installed, no production access required.
02
Match against vulnerability databases
Every resolved package and version is matched against NVD, OSV, and GitHub Advisories. Matches are recorded with CVSS scores, severity, and advisory metadata.
03
Run reachability analysis
00felix traces your first-party call paths into the dependency graph to determine which vulnerable functions are actually called by your code. Unreachable CVEs are deprioritized immediately, cutting the list by up to 87%.
04
AI validates every reachable finding
Each reachable CVE goes through an AI validation pass that evaluates real-world exploitability in the context of your application: exposed attack surface, input control, existing mitigations. Findings are confirmed or dismissed with a visible, auditable reason.
05
Deliver a short, confirmed list
What comes out is a prioritized list of confirmed, reachable, AI-validated vulnerabilities, ranked by real risk. No noise. No zombie CVEs. No alert fatigue.
WHAT HAPPENS NEXT
00felix confirmed it.
Now it fixes it.
Verified Upgrade takes every confirmed finding and resolves it automatically: root cause traced, first-party code rewritten if needed, fix verified against your build, PR opened for your team to approve.
SEE HOW VERIFIED UPGRADE WORKS →
GET STARTED TODAY · FREE ON ANY REPO

Find out what's actually
exploitable in your code.

Run 00felix on any GitHub repo in minutes.
No setup. No sales call. No credit card.