Free & self-hosted Your code and keys never leave your infrastructure
Describe a product in a sentence. Review the plan before a byte is written. Get a repository that compiles, migrates and runs — with row-level security, audit, tests and human gates already in it. Self-hosted, free, and yours.
No signup to look. Nothing to install until you want a repository.
Rathvan = intake & scoping + architecture review + scaffolding + security foundations + gates + provenance + deploy verification
Every number on this page is generated from the sources at build time. If one is wrong, the build fails — which is the same rule the platform applies to everything it produces.
Solutions
The pipeline is 13 stages and 3 human gates. A track tightens the stages that matter for the work and relaxes the ones that do not. What it never does is let a prototype reach production by accident.
Structurally incapable of shipping: separate namespace, no production credentials, an expiry. Promotion is a restart, not a merge.
Identity, tenancy, forced row-level security, audit and tests in the first commit — the parts every product needs and nobody enjoys building twice.
Server-priced from the catalogue, integers in the smallest unit, and the full security pass. The rules are gates, not guidance.
Drift detection reads your docs against the facts, drafts the smallest correct edit, and opens a pull request. It never merges one.
Demo
Three products scaffolded by the real tool, captured and published: the config that went in, the plan it printed before writing a byte — including what it refused — and the files that came out, provenance included.
Compare
Not a vendor scoreboard. These are the real alternatives: hand the work to a coding agent, or build the foundations yourself again.
| Coding agent alone | Building it yourself | Rathvan | |
|---|---|---|---|
| Plan before code | Sometimes, in prose | In your head | Printed, and nothing is written until you accept it |
| Security foundations | Whatever it remembered | Week three, usually | RLS enabled and forced, in the first commit |
| Human gates | None that block | Process, if people follow it | Executable — the build stops |
| Where it can ship | Anywhere it is pointed | Anywhere | Staging is the ceiling; production needs a person |
| Provenance | A chat log | Git history, if you look | Every file hashed, the builder and kernel recorded |
| Your code, your keys | Their servers | Yours | Self-hosted; bring your own model keys |
Rathvan is not a replacement for a coding agent — it is what decides whether the agent's output is allowed to become your product.
Download
Answer the intake in the console, download your rathvan.json, and turn it into a repository:
$ npx "https://build.rathvan.com/rathvan-cli.tgz?v=1f022f31f43e" new ./your-product
The plan prints first and writes nothing until you confirm. Java 21 and Docker are the only prerequisites.
Then what? After the scaffold — seeing it run, which parts are yours rather than inherited, where a coding agent belongs, and when splitting into services is actually justified.
$ ./gradlew installDist $ ./dmg/build-dmg.sh
Run those in service/ and the image lands in build/dmg/. It is unsigned until the app is notarised, so macOS asks you to right-click and Open the first time.
One command, no install, no account. Every scaffold carries a lock file recording which builder and kernel produced it.
A macOS image with a bundled Java runtime — nothing else to install. Your machine, your keys, your data, its own console at /console.
Not hosted yet — it is two commands from the source:
Sign in and build, with nothing to install and no machine of your own to keep running. Not live yet — it is being rebuilt on its own infrastructure, away from anything else. The two above work today and are not waiting on it.
Enterprise
Eight blueprints, one per domain the scaffolder will actually build — see what each one brings, and read three real scaffolds exactly as they came out. Neither is a mock-up: a blueprint that advertised something the CLI would refuse fails the build.
Each of these is running code with tests against a real database, not a roadmap. Where something is built and not yet switched on, it says so — a capability list that cannot be checked is the thing this platform exists to argue against.
Your cloud account, your database, your model endpoint. A self-hosted inference server is an environment variable, not a code path — so a build produces its plan, design and tests without a byte leaving your infrastructure.
One check at the single point every model call passes through, scanning the prompts and the retrieved context — where your own documents arrive. Identifiers, salary, bank details and phone numbers are refused before a vendor sees them, and the refusal names the kind of thing, never the value.
Eight business capabilities each answer "do you have this?" — and the honest answer is two. ServiceNow, Salesforce, Workday and your accounting package stay yours; the catalogue says which we provide and which we deliberately never will, with the reason.
Kubernetes manifests and an ArgoCD application instead of a deploy script, when that is how you already ship. Where your platform supplies managed persistence, a generated product consumes it rather than shipping a database nobody asked for.
One registry behind all four. Registering is not releasing, releasing needs somewhere to be reached, and a published contract is hashed — so an entry whose contract changed under its consumers is quarantined rather than merely noted.
Every use of a credential you connected is recorded, including the denials — usually the interesting half. An audit that cannot be written refuses the action rather than letting it proceed untraced.
Which capability your organisation chose is recorded append-only, so "what were we running in March" has an answer. Flags turn on without a deploy, and a flag no code knows about reports itself ignored rather than pretending.
Thirteen gates. Row-level security enabled and forced. Migrations additive with a stated rollback. No vendor import in the core. Each exists because a specific check once reported success while the work was broken.
Prove your email domain with a DNS record, then admit everybody at your company — or only the people you invite. Off until you turn it on, and it will not grant a role that can administer anything, because a role you get by registering an address is not an authorisation decision.
Four roles, and a viewer who reads a design without being able to approve it. Teams address work and grant nothing — authorisation stays one lookup. The last owner cannot be removed, because the organisation that reaches that state cannot fix itself.
Most platforms like this assume a blank directory, which is why most enterprises cannot use them: the systems that matter already exist and are not going to be rewritten to suit a tool. There are two doors here, and the one you take depends on whether the thing you are improving is already running.
A service that works, that people depend on, and that nobody is volunteering to rewrite. The expense was never the existing code — it is the next twenty features: the plan nobody wrote down, the foundations re-argued each time, the review that happens after the code exists and is therefore a negotiation rather than a decision.
Your system adopts the kernel through four ports — a store, a model-provider chain, a source-control port and a feature gate. Your database, your repository and your vendors stay yours. Nothing is ported to us.
A new platform, a new line of business, or the internal system that has been a spreadsheet for three years. The risk here is the opposite one: not legacy, but the six weeks before anything is real, spent rebuilding the same foundations your last four products already have.
Describe it in a sentence and answer the intake. You read the plan — including what it refused to do — before a byte is written. What comes out is a repository that compiles, migrates and runs.
Self-hosted from the first day. Bring your own model keys, held encrypted, so your spend is yours and your code is read by a vendor you chose. Government identifiers, salary, bank details, phone numbers and raw user notes are never sent to a model.
SSO, per-user credentials with revocation, and spend budgets. Repository access is granted per repository with short-lived tokens — not a blanket key to your organisation.
Production needs a person, every time. The gates are executable: the build stops rather than logging a warning nobody reads.
Every generated file hashed, with the builder and kernel version recorded — so "where did this come from?" has an answer eighteen months later.
And what it does not do
Self-hosted, with a model chain that fails over across vendors rather than failing. If you want to talk through which door applies to your estate — or have us look at the system you already have — that is the conversation to start.