MAGDOX · security for software and connected devices
Find vulnerabilities, understand your components and give the people shipping a release the context to act. Magdox brings you two focused products: Code Security for source repositories and FDIE for firmware.
Self-service for both products. Enterprise deployment and contract options.
MAGDOX Code Security
The magdox CLI examines source, dependencies, secrets and configuration on the developer machine or CI runner, so engineers investigate without sending the repository away. Upload findings only when the team needs shared triage; matched source snippets stay off by default.
Illustrative investigation
01 / Input
Where the application receives the value
02 / Transformation
How it is changed, checked or passed onward
03 / Operation
The security-sensitive use the reviewer must inspect
Location
File & line
Assessment
Severity & confidence
Coverage
Method & limits
Conceptual example. Flow evidence is available only for supported analysis paths.
Local SAST with affected locations, supported flow evidence, severity, confidence and explicit analysis coverage.
Review known vulnerabilities, malicious-package indicators and unresolved dependency versions from the repository's own manifests and lockfiles.
Review source, infrastructure definitions and delivery configuration locally, with redacted secret findings and file-level context.
Build software, cryptographic and AI inventories locally, then find recognised components across the repositories you choose to upload.
Group repositories into applications, prioritise uploaded findings, define SLA policies and keep risk decisions with their evidence.
Let a configured coding assistant request local scans through MCP, and optionally review findings using a model your team chooses.
Languages and frameworks
Languages
Frameworks named in selected rules
Infrastructure, configuration and templates
Published source inventory. Installed bundle versions and per-language analysis coverage can differ.
Inspect the coverageAI support
Each capability stays separate from detection: the scanner remains responsible for its findings, and a model verdict never removes a finding or changes its severity.
AIBOM
Recognised AI SDK and model patterns in supported source and dependency files, exported as JSON or CycloneDX ML-BOM.
Pattern-based risk labels do not establish actual data transfer, model versions or complete coverage. Run aibom separately.
Explore the inventoriesMCP
Let a configured coding assistant request local scans through MCP, inspect the findings, work on a correction and rescan. Setup guidance covers Claude Code, Codex and other MCP-capable hosts; Claude Code is the end-to-end validated host.
A secure-coding prompt guides behaviour; it is not an enforced merge control.
Explore agent workflowsOptional, opt-in
Bring your own provider key (Anthropic, OpenAI-compatible services such as Groq, Gemini, Azure or a local Ollama, or AWS Bedrock). For each finding the model adds an advisory verdict, likely real, likely false positive or needs review, with a reason, and can propose a fix that the engine re-scans before it is marked verified.
Off until you approve a repository. Code excerpts go only to the provider you chose, with recognised secrets redacted first. A verdict never removes a finding or changes its severity, and a verified fix still needs your review before it is applied.
Read the AI integration guideFDIE · Firmware Delta Intelligence Engine
FDIE analyses supported firmware images, identifies components and candidate vulnerabilities, and compares each release with the last. Start with an image you are authorised to assess; source code is not required.
Recover components and security evidence from authorised images.
Bring static, runtime and vulnerability context into one review.
Follow release changes and retain the analyst's decision.
Compare identified components and available functions across releases. Reuse an earlier investigation with the analyst's approval.
Inspect supported emulation and fuzzing observations with their inputs, failures and coverage.
Organise technical checks, manual review and component exports for a wider product-security assessment.
Frameworks and images
Images and containers
Filesystems
Assessment views
MCU and RTOS images yield recoverable metadata and supported static checks. Recognition does not establish complete extraction.
Mappings identify technical references, not certification. Assess the edition and product applicability separately.
Inspect the mapped checksChoose the workflow
Application engineers, product-security teams and device manufacturers need different inputs and deliverables. Our solution pages explain the practical workflow for each, from the first evaluation to the evidence handed to a release owner.
CODE SECURITY
Review source, dependencies and configuration before a release leaves the pipeline.
CODE SECURITY
Track risk across every service, not just individual repositories.
CODE SECURITY
Assess applicability once, record the reasoning, and keep it when the code changes.
FDIE
Component identification, vulnerability matching and release-to-release delta intelligence for supported firmware images.
FDIE
Review embedded components and release changes before a device update.
FDIE
Make firmware evidence part of each connected-product release.
Access and evaluation
Code Security offers a 14-day self-service trial with a card; cancel before it ends to avoid the first charge. FDIE is paid at checkout, and its first payment is refunded in full on request within 14 days if your organisation has analysed three or fewer new images. Enterprise evaluations, on-premises requirements and procurement terms can be arranged with our team.
Start a Team or Business subscription from the Code Security console, with a 14-day trial through Dodo Payments. A card is required; cancel before the trial ends to avoid the first charge. Downloading the public CLI launcher does not itself grant private engine or rule access. Contact us for Enterprise or offline deployment.
Analysis runs on your machine or CI runner. Results stay local unless you request --upload. Code snippets are off by default and require --include-code plus permission on the receiving repository. --show-payload prints a redacted preview, not the exact upload body, and prevents sending it. Authentication, rule downloads and the vulnerability database download can still contact the platform. The optional AI review sends code excerpts only to the provider you configured, and only for repositories you approved.
Choose an authorised representative firmware image and, where possible, a related release pair. Inspect extraction, identified components, findings and unassessed work before using the result in a release decision.
No. Magdox supplies two products with distinct applications, subscriptions and evidence stores. Their product information, pricing, documentation and legal documents are combined on this website.
Choose your starting point
Review code and configuration locally, then decide what your organisation should see in the console.
Get Started with MagdoxAnalyse a supported firmware image and follow the components, findings and changes behind a release.
Go to FDIE