# Symbolia: Assure

> Your AI writes the code. Assure checks it before it merges. Every page on this site is also Markdown at the same path plus .md; the full text is at https://symbolia.ai/llms-full.txt.

- The skill an agent follows to set Assure up: https://symbolia.ai/skills/assure.md (raw: https://symbolia.ai/skills/assure/SKILL.md)
- OpenAPI: https://symbolia.ai/openapi.json
- Search index: https://symbolia.ai/search-index.json

## Measured

- 0 false alarms on ten real Flask apps. A broken rule reported on code that keeps it, on Free and on Premium. On the same clean code Bandit raised 275 findings and CodeQL 11 while catching 0 planted flaws. [See the repo](https://github.com/Symbolia-Assurance/assure-benchmark) Source: /figures#false_alarms (LAUNCH-FIGURES row 4, 9).
- Planted auth flaw caught: Free 5 / 10. Bandit 0. CodeQL 0. One unguarded route planted in each app. [Extend it yourself](#assure-improves-continuously). Semgrep is not published (rules licence); run it with run.sh. [See the repo](https://github.com/Symbolia-Assurance/assure-benchmark) Source: /figures#bench_assure (LAUNCH-FIGURES row 9).
- Checked on real, public code. [microblog](https://github.com/miguelgrinberg/microblog) ([PR](https://github.com/Symbolia-Assurance/setup-qual-microblog/pull/5)), [flasky](https://github.com/miguelgrinberg/flasky) ([PR](https://github.com/Symbolia-Assurance/setup-qual-flasky/pull/5)), [flask-base](https://github.com/hack4impact/flask-base) ([PR](https://github.com/Symbolia-Assurance/setup-qual-flask-base/pull/5)), [realworld](https://github.com/gothinkster/flask-realworld-example-app) ([PR](https://github.com/Symbolia-Assurance/setup-qual-realworld/pull/5)), [Flask-User starter](https://github.com/lingthio/Flask-User-starter-app) ([PR](https://github.com/Symbolia-Assurance/setup-qual-flask-user-starter/pull/5)), [cookiecutter-flask demo](https://github.com/jamescurtin/demo-cookiecutter-flask) ([PR](https://github.com/Symbolia-Assurance/setup-qual-cookiecutter-demo/pull/39)), [flask-jwt-auth](https://github.com/oleg-agapov/flask-jwt-auth) ([PR](https://github.com/Symbolia-Assurance/setup-qual-jwt-restful/pull/5)), [REST-tutorial](https://github.com/miguelgrinberg/REST-tutorial) ([PR](https://github.com/Symbolia-Assurance/setup-qual-rest-tutorial/pull/5)), [flaskr](https://github.com/pallets/flask/tree/main/examples/tutorial) ([PR](https://github.com/Symbolia-Assurance/setup-qual-flaskr/pull/7)), [flask-bones](https://github.com/cburmeister/flask-bones) ([PR](https://github.com/Symbolia-Assurance/setup-qual-flask-bones/pull/5)). Pinned commits and plants in the benchmark repo. Source: /figures#free_setup_qual (LAUNCH-FIGURES row 1).
- First PR comment in 3.6 minutes. Fresh agents, from the one-liner, ten apps. [See the install demo](https://github.com/Symbolia-Assurance/assure-install-demo) · [the live demo](https://github.com/Symbolia-Assurance/assure-demo) Source: /figures#time_to_first_comment (LAUNCH-FIGURES row 5).
- 66x internal development acceleration. Reviewed changes merged a day: from 1 to a median of 66 (peak 130). Source: /figures#dev_acceleration (LAUNCH-FIGURES row 15).

## Start here

- [Assure by Symbolia](https://symbolia.ai/index.md): Your AI writes the code. Assure checks it before it merges.

## Product

- [How it works](https://symbolia.ai/how-it-works.md): Collect, check, read. The Action and the API. Three outcomes, and every reading names its evidence.

## Pricing

- [Pricing](https://symbolia.ai/pricing.md): Free to start. Premium USD 20 a month. Pro USD 200 a month. Enterprise for larger codebases. One monthly pool of usage.

## Get started

- [Get started](https://symbolia.ai/get-started.md): One line to your agent. No key to store. The first comment on your next pull request.

## Docs

- [Docs](https://symbolia.ai/docs.md): The Assure documentation, rendered from the Assure repository at a pinned commit.
- [Quick start: the GitHub Action](https://symbolia.ai/docs/quickstart-action.md): Known-vulnerability scanners check your code against a list of what has broken before. Assure checks whether the way your code meets the foundational software it runs on stays inside a regime that can be shown safe and r
- [Quick start: the API](https://symbolia.ai/docs/quickstart-api.md): The API runs the checker on Symbolia's server. The Assure GitHub Action is a client of this API. You send collected files. You get back a verdict.
- [First run: the Action](https://symbolia.ai/docs/first-run-action.md): This page gets a first run to a verdict. The full reference is QUICKSTART-ACTION.md.
- [First run: the API](https://symbolia.ai/docs/first-run-api.md): This page takes you to a first verdict from the HTTP API with the postgresql-observed-baseline profile, which needs no declaration. The full reference is QUICKSTART-API.md.
- [Declarations](https://symbolia.ai/docs/declarations.md): A declaration is to your database's access rules what a Playwright test is to your UI — a file in your repo, run on every PR.
- [Reading a verdict](https://symbolia.ai/docs/verdicts.md): A check writes one JSON file. The Action writes it at its output path. The API returns it as the response body.
- [Your data](https://symbolia.ai/docs/data.md): The collector runs in your runner. It connects as your collection role and runs a fixed, published set of SELECT queries. The collector asks for a read-only session. A pooler may not pass the request on. The collector ru
- [What a verdict claims](https://symbolia.ai/docs/scope.md): This page describes the claims of postgresql-observed-baseline; the declared profile is below, the HTTP profile's scope notes are in the Action quick start, and what each served profile never detects is listed per profil
- [First-line samples](https://symbolia.ai/docs/first-line-samples.md): The first line of the job summary, word for word, as the serving path writes it for each case, and the sentence under it that says what it means. Each line comes from recorded readings, or from recorded readings changed 
- [MCP](https://symbolia.ai/docs/mcp.md): The Assure API as five tools. An agent — Claude Code, Codex, Cursor, or your own — calls them the way it calls any tool and reads the verdict as JSON. One command installs it. Your key stays in a file on your machine.
- [The Action README](https://symbolia.ai/docs/readme-action.md): Assure checks the software your code runs on. From your own GitHub Actions workflow it reads your PostgreSQL server or your site's HTTP responses and tells you, obligation by obligation, what holds, what is disproven, an
- [Beta tester brief](https://symbolia.ai/docs/beta-tester-brief.md): You administer one self-hosted PostgreSQL server, major 14 to 18, and you can run a GitHub Actions workflow that reaches it.
- [Fixtures](https://symbolia.ai/docs/fixtures.md): Every fixture committed under tests/ and docs/ in a layout serve/devfixture.py reads (a directory holding raw/, or a repository directory holding declaration.json) is either tabled below or named, with the reason, under 

## Skills

- [Skills](https://symbolia.ai/skills.md): The Assure skill: what a coding agent reads to set the Action up and read its result.
- [The Assure skill](https://symbolia.ai/skills/assure.md): Assure checks the software your code runs on. From your own GitHub Actions workflow it reads your PostgreSQL server or your site's HTTP responses and tells you, obligation by obligation, what holds, what is disproven, an
- [Route 1: a connection to a PostgreSQL server](https://symbolia.ai/skills/assure/postgres.md): On Supabase, the postgres role cannot grant pgreadallsettings or pgreadallstats. It can grant pgmonitor, and the collector this Action ships refuses pgmonitor as broader than it needs (section 2). So this Action version 
- [Route 2: collected PostgreSQL files](https://symbolia.ai/skills/assure/postgres-local.md): On Supabase, the postgres role cannot grant pgreadallsettings or pgreadallstats. It can grant pgmonitor, and the collector this Action ships refuses pgmonitor as broader than it needs (section 2). So this Action version 
- [Route 3: HTTP endpoints](https://symbolia.ai/skills/assure/http.md): http-observed-baseline checks one HEAD response per endpoint you select against the HTTP obligations Assure holds (response framing, transport policy, cookies and similar). Live collection against real endpoints is not i
- [Route 4: a MySQL submission](https://symbolia.ai/skills/assure/mysql.md): mysql-declared-model checks a MySQL server against a mysql:// connection and your declaration file, or against an artefacts directory holding raw/submission.json.
- [Route 5: a Python (Flask) repository](https://symbolia.ai/skills/assure/python.md): python-auth-declared-model checks how a Flask app signs people in and guards its routes. It reads your code as text and never runs it. The check is free and contacts no server of yours.
- [Deliberate feedback](https://symbolia.ai/skills/assure/feedback.md): Send feedback when something cost you a step: an input you could not build, a reading you disagree with, or a package or rule the check does not cover. Send what you saw and what you expected, within the customer's permi

## Benchmark

- [Benchmark](https://symbolia.ai/benchmark.md): Ten real Flask apps, one planted sign-in flaw each, every tool version pinned.

## Changelog

- [Changelog](https://symbolia.ai/changelog.md): The Action's releases, as published.

## Status

- [Status](https://symbolia.ai/status.md): Where to read the service's health.

## Measurements

- [Measurements](https://symbolia.ai/figures.md): Every number on this site: what it measures, how it was measured, and where to verify it.

## Direction

- [Controller demo](https://symbolia.ai/vision/controller-demo.md): An interactive demonstration on an industrial controller, from recorded evidence.

## Legal

- [Terms of service](https://symbolia.ai/legal/terms.md): The terms on which Symbolia provides Assure. Draft for the Director's review, 19 October 2026.
- [Privacy](https://symbolia.ai/legal/privacy.md): What personal information Symbolia holds about you, why, and what we do with it. Draft for the Director's review, 19 October 2026.
- [Data handling](https://symbolia.ai/legal/data.md): Where to read what Assure collects, sends, keeps and never reads.