Agentic code review · from Bonham Technologies
Companies are full of tools that nobody reviewed: the expense bot a manager built with an AI assistant, the spreadsheet macro that became a web app, the script that quietly runs payroll. Unvarnish reads them the way a careful engineer would, finds what a rushed reviewer misses, and says so plainly, with a file and line for every claim.
Who it's for
Run it unattended across every internal tool at a client. Each tool gets an architecture document, a findings document and a requirements document; across tools you get a comparison and a consolidation proposal to start your own architecture work from.
Before you rely on a tool someone generated, find the embedded secrets, the hardcoded servers, the 300-line functions, the missing tests and the single person who understands it.
It works on code in any language: a repository with its full git history, or a pile of files copied off a shared drive.
What it finds
Ten scanners run before any model sees the code. Their findings are reproducible and carry their evidence. Without a model configured, Unvarnish still writes the scanner-based findings document.
| Scanner | Finds |
|---|---|
secrets | Keys, tokens, passwords, connection strings and private keys, in the working tree and the full git history, plus gitleaks results when it is installed. Always redacted. |
dependencies | Published advisories through osv-scanner (offline by default), and unpinned dependencies without a lockfile. |
hardcoded_infra | URLs, internal hostnames, IP addresses, absolute paths and emails, with credentials masked. |
oversized_files | Files and functions over size thresholds, and large inline scripts in HTML. |
hygiene | Missing tests, CI, README, licence or linter config; TODO density; swallowed errors. |
bus_factor | Code concentrated in a single author. |
vendored_bulk | Dependency or build directories and large binaries committed with the source. |
generated_bulk | Single commits over a line threshold, noting AI co-author trailers. |
client_exposure | What AI-built web apps ship to the browser: service-role keys and secret-named public variables in client code, database tables without row level security, CORS open to any origin with credentials, credentials in committed .env and MCP config files, and route handlers with no authentication check nearby. Values redacted. |
end_of_life | Runtimes, base images and frameworks past their end of life or close to it, checked against a dated offline copy of endoflife.date. |
How it works
Each tool goes through nine phases. Every phase writes a JSON artifact with a hash of its inputs, so a rerun skips finished work and resumes after a stop. Every number, table and diagram in the documents comes from those artifacts; the model writes only the prose.
unvarnish compare groups every tool's capabilities into one
matrix, maps their shared data and integrations, compares their risk, and
proposes a consolidation, listing every place it conflicts with the
constraints you give it.
unvarnish ask "Which tool talks to Stripe, and from where?"
answers from the analysis with cited sources. An answer that cites
nothing is printed with an "unverified" warning.
unvarnish run --baseline ../acme-2026-04 compares a follow-up
review with the last one. Each findings document opens with what was
resolved, what is new and what changed since then, without another
model call.
Run it
Unvarnish is a command-line tool you run yourself; there is no hosted service. The code under review stays on the machine that runs it, and goes only to the model backend you configure.
Use Anthropic's models with your own API key, read from an environment
variable or the keychain and never written to disk. Set a token budget;
run --dry-run estimates spend first.
Point it at any OpenAI-compatible model server: vLLM, Ollama, LM Studio or a gateway. Per-phase models, timeouts and context sizes are configurable for slow CPU-only servers.
A site kit carries the Docker image with gitleaks, osv-scanner, pandoc, Graphviz and dated offline advisory databases, plus checksums and a runbook, to a network with no internet access.
$ unvarnish init acme-2026-10 --client "Acme Corp" --consultant "Your Firm"
$ cd acme-2026-10
$ unvarnish add expense-bot --repo https://github.com/acme/expense-bot.git
$ unvarnish add receipt-ocr --files ~/Downloads/receipt-ocr
$ unvarnish run
$ unvarnish compare
$ unvarnish export --format docxRequires Python 3.13+ and git; exports also need pandoc, Graphviz and weasyprint, or use the Docker image, which bundles them.
Licence
Unvarnish will be published under the Apache License 2.0 when its repository goes public. Until then the source is private; ask Bonham Technologies for early access.