Everything you need to ship AI code you can trust
Learn the full Plan -> Build -> Verify workflow: plan what you build, verify what your AI writes, and keep the project readable for humans and agents.
Getting started
Sign in with GitHub
Connect your account so scans and Drift Check can read the repositories you choose.
Pick a tool
Start with a Blueprint for a new idea, or run a Security Scan on a repo you already have.
Use your free credits
Every account starts on the Free plan with monthly credits. Upgrade when you ship more.
Two ways to use BeforeBuild
Use Launchpad for one guided run across all phases, or open the standalone tools from Toolkit when you need just one step.
Core concepts
The Agent Dossier
An Agent Dossier is the documentation that travels with a project so people and AI agents can extend it without guessing. It contains:
- RUNBOOKhow to set up and run the project
- ARCHITECTUREthe system map, data model, and key decisions
- AGENTSthe rulebook and task playbooks for your coding agent
- SECURITYtrust boundaries, threat model, and forbidden patterns
- SPECrequirements, acceptance criteria, ordered tasks, and tests
Each pack gets a Pack Completeness Score so you can see at a glance how ready it is to hand off.
Security badges
Scans produce badges that summarize a project's health at a glance:
- Web App Security. OWASP Top 10 coverage, secret detection, and authorization checks on the codebase.
- Maintainability. Signals on structure, dead code, and how cleanly the project can be extended.
- LLM / Agent Risk. Checks aimed at the failure modes specific to AI-written and agent-driven code.
- Deep Scan. Optional layer adding Semgrep, Trivy, Gitleaks, and Bearer for deeper findings.
- Verified Runs. Optional runtime check that boots the repo in an isolated sandbox to confirm it runs.
Trust badges and public verification
When a repository passes, it earns a trust badge backed by a public verification page at /verify/owner/repo. Anyone can open that page to see what was checked and when, so the result is something you can share rather than just claim.
Readable for humans and agents
BeforeBuild turns AI output into shared artifacts - journey maps, architecture canvases, plain-language findings, and agent-ready docs so everyone works from the same context.
Runtime verification: does it run?
Beyond static checks, runtime verification can boot your repo in an isolated sandbox and exercise routes to prove it starts and responds.
The tools
Validate the idea and design the solution before writing production code.
Wire everything up so your coding agent can build with full context.
Confirm the code is secure, understandable, and still true to the plan.
Security Scan
Find vulnerabilities AI tends to introduce. Optional runtime verification answers: does it run?
Open Security ScanArchitecture Analysis
SoonCatch architecture risks and weak boundaries before they become expensive.
Open Architecture AnalysisDrift Check
See where implementation has drifted from intended design and what to fix first.
Open Drift CheckConnect your coding agent
BeforeBuild ships an MCP server, so you can run its blueprint, scan, runtime-verify, and drift tools directly inside Cursor, Claude Code, or Windsurf. The first run opens a browser to securely connect your account.
{
"mcpServers": {
"bb": {
"command": "npx",
"args": ["-y", "@beforebuild.io/mcp"]
}
}
}claude mcp add bb -- npx -y @beforebuild.io/mcpnpx -y @beforebuild.io/mcp loginYou can also manage this from Settings, which includes a one-click install link for Cursor.
FAQ and troubleshooting
Do I need to install anything to start?
No. Sign in with GitHub and use any tool from the browser. Installing the MCP server is only needed if you want the tools inside your AI coding agent.
How do credits work?
Each plan includes a monthly allowance of blueprints, scans, and Agent Dossiers. Credits refresh every month, and you can upgrade at any time for higher limits.
Is my code stored?
Scans read what they need to analyze the repository and return results. See the privacy policy for exactly what is processed and retained.
The MCP login says it failed. What do I check?
Make sure you are on the latest version with npx -y @beforebuild.io/mcp, then run the login command again. The first run opens a browser to approve access for this account.
Ready to start?
Map your next idea or scan a repo you already have.