KeelenScans
Scans that end in merged fixes, not PDFs.
Keelen ships three project scans: a Security scan (a deep whole-repo security audit), a Legal scan (an engineering review of legal exposure), and a Controls scan (a gap review against Cyber Essentials and CMMC). All three run read-only in an isolated VM, report honestly bounded findings, and share one superpower: any finding can be sent to the autonomous loop, which fixes it and ships a tested pull request.
Run them from the project dashboard whenever you want, or on a daily, weekly, or monthly rhythm through the MCP server. Re-runs reconcile against previous findings instead of duplicating them. Included on every paid plan, from Indie at $29/month. CMMC Level 2 controls are an Enterprise feature.
Security scan
Keelen's Security scan is a deep, whole-repository security audit run by an AI agent in an isolated single-use VM with a read-only, single-repo token.
About the Security scan →Legal scan
Keelen's Legal scan is an automated engineering review that reads your repository and maps what the code actually does — what it collects, stores, sends, and shows — to commonly cited legal obligations under GDPR, CCPA/CPRA, COPPA, TCPA, and others.
About the Legal scan →Controls scan
Keelen's Controls scan is a security-control gap review that reads your repository — plus the stack facts you declare, like cloud and identity provider — for evidence against three frameworks: Cyber Essentials (NCSC requirements v3.3), CMMC Level 1 (the fifteen FAR 52.204-21 safeguards), and CMMC Level 2 (NIST SP 800-171 Rev.
About the Controls scan →FAQ
What are Keelen's scans?
Three read-only reviews that run against your repository in an isolated VM: the Security scan audits code, secrets, dependencies, and infrastructure; the Legal scan maps code observations to commonly cited legal obligations; the Controls scan inventories evidence against Cyber Essentials and CMMC. Each produces ranked findings you can dismiss or send to Keelen's autonomous loop, which ships the fix as a tested pull request.
Are the scans read-only?
Yes. Every scan runs in an isolated single-use VM with a read-only token scoped to one repository. Nothing is executed against your live systems and nothing is written. Changes happen only when you send a finding to the loop — and then they arrive as normal pull requests through Keelen's verification gates.
How often should I run them?
They are built for repetition: findings are fingerprinted and re-runs reconcile, so nothing floods. A common rhythm is the Security scan weekly and before releases, the Legal scan monthly and before entering a new market, and the Controls scan each remediation cycle. Trigger them from the dashboard or schedule them through the MCP tools.