So you build with AI, but is it ready?
We check what your AI can actually do against what it should do, before it touches real customers, money or data. Built it yourself with Claude Code, or never opened a terminal? Either works.
Agent Readiness Review. One agent or one workflow, $1,200 incl. GST, 10 business days, and a written verdict: go, go with changes, or not yet.
Not ready for a review yet? Start with the free Role Card.
AI can write the plan. Execution is where it breaks.
A coding assistant will produce an app, an agent or a business plan in an afternoon. The tutorials stop there. What they skip is whether the thing will hold up once paying customers start using it.
Generated code often ships with known weaknesses. In testing across more than 100 models, 45% of AI-generated code samples introduced a vulnerability from the OWASP Top 10, the standard list of the most common web security flaws.1
The failures are rarely in the plan. In early 2026 an app built entirely by AI exposed 1.5 million API tokens through one missing database setting.2 In 2025 an AI coding agent deleted a live production database during an explicit code freeze.3 Neither problem would have shown up in a description of the system; both only showed up once it was running.
Start free. Pay when there is something real to check.
Scope Check
Free
Six questions and an instant answer on whether we can help.
Run the Scope CheckRole Card
Free
Write down the job you want AI to do, what it may touch, and what it must never do.
Get the Role CardAgent Readiness Review
$1,200 incl. GST
We check that plan against your real system and give you a written verdict.
See what’s includedBuild, Secure, Monitor
Quoted from the review
Fix it, build it, keep it bounded, and check it again on a schedule once it is live.
What comes after
We use the same tools. The difference is what we check them against.
- An independent reviewer. Grading your own work with your own AI shares your blind spots. You only ask about the risks you already know exist.
- We check the system that’s running. Live permissions, keys, data access and what your agent can actually reach. A description of what it’s supposed to do can’t show you those.
- Fixed rules do the checking. A rule either matches or it doesn’t, so there’s no second model’s opinion to talk round. Watch shows the same method running in public on open-source packages.
- Willing to say “not yet”. AI tends to agree with whoever is asking. We will tell you if it is not ready, or not worth doing.
- We use the same tools. Frontier models are part of how we work every day. The difference is what we check them against.
What handing a job to AI can look like.
Three illustrations of the kind of work we mean, to make it concrete. They are examples, not case studies.
Quote follow-ups for a trade business. When a quote has sat unanswered for a week, the assistant drafts a follow-up using your scheduling tool and inbox. You decide what gets sent, and a price never changes without you.
An agent inside a startup’s app that handles customer data. It answers account questions using the customer’s own records. It can read one customer at a time, never the whole table, and it cannot issue refunds or change a plan on its own.
A weekly summary for an owner. Every Monday, one plain page: what was invoiced, what is overdue, which jobs are booked. It reads from your accounting and job tools and cannot change anything in either.
The review tells you what to do next. We can do it with you.
Build. Fix what the review found, or build the agent properly into the tools you already use. We quote it from what the review finds.
Secure. For agents that have been live a while: check they still only do what was approved, not what they have quietly drifted into.
Monitor. Once it is live, we check it again on a schedule against its Role Card and the review findings, and send you a one-page report. We install nothing and keep no standing access.
You don’t have to take our word for how we work.
We publish our methods, including what is unfinished. The Adversarial Issues Register is a full Pressure Test of our own open-source gateway, every finding included. Watch shows fixed-rule checks running live on public open-source packages. About has the rest.
What we won’t do.
We say no when the honest answer is no. That is what the Scope Check, and a conversation after it if one is needed, is for: finding out before any paid work begins whether we can actually deliver real advancement on your project.
We will not misrepresent your capability to your own customers, and we will not build something we find ideologically objectionable. Those are automatic declines, not a negotiation.
We won’t promise your product will make money, or that it is perfectly safe. We will do the review properly and tell you honestly what we found.
The same standard applies to what we build and what we say about it: if something cannot be verified, we say so rather than asserting it.