What is installed?
seeWhich AI coding tools are running inside the company.
Agents, harnesses, IDE plugins, MCP servers: an inventory taken from the machines themselves, not from the procurement list.
cto
Tools and courses for the work a fractional CTO actually does.
See it. Govern it. Report it in language a founder can act on.
AI coding tools are already inside the company. The CTO line is one product family for seeing what is running, governing what it may touch, and reporting on it with evidence: a read-only toolkit, the Fractional CTO audit packet, and the courses that teach the practice.
In build; nothing is published yet. The tools are a scaffold, every
subcommand currently exits with not implemented, and the repository is not yet
public. What is written here is the design, stated as constraints.
questions
Three questions most founders cannot answer
About their own company, today. d7r sweep
answers the first read-only in one command; the rest of the suite gives a
structure for answering the other two.
What can it read?
governWhat those tools are allowed to touch.
Repository access, file scopes, environment secrets, network reach: the permissions as they are, against the permissions as intended.
Where do transcripts go?
reportWhere the record of everything they read ends up.
Session logs, telemetry, cloud retention: the evidence trail of the tooling itself, reported in language a board can act on.
toolkit
One product line, three surfaces
The tools
cliThe d7r binary and its detector catalog.
A Rust core for detection, redaction, and evidence; official plugins for coding agents and harnesses; adapters for log sinks, compliance platforms, and security tools. Read-only by design.
The audit packet
practiceThe Fractional CTO packet: steering, scaffolds, templates, examples.
The working documents of an engagement, branded under the Academy document kit (forest and gold, severity ledgers, evidence-first reporting), so a finding arrives as something a founder can act on.
The courses
academyCourse material distributed with the tools.
The D7R Frontier Academy curriculum teaches the practice the tools instrument: how to see, govern, and report on AI tooling as the CTO the company doesn't have yet.
constraints
What these tools will never do
Constraints on the design, not a roadmap.
| Commitment | What it means |
|---|---|
| Observe, never remediate | No command changes the system under audit. |
| No account, no network, no phone home | Every core command completes offline. |
| Credentials excluded by construction | Not filtered out afterwards. |
| "Unknown" is a legal answer | Recorded with its reason. Guessing destroys a re-audit product. |
| No compliance claim | Evidence-backed recommendations. No badge, no pass mark, no certification. |
| No scoring of people | The unit of analysis is a system, a repository, or a harness; never a developer's output. |