The UI exists. The outcome does not.
A signup, checkout, contact form, or CLI command can look complete while never reaching a handler, database, integration, or filesystem write.
Evidence-backed production readiness
A ship-readiness copilot
for vibe-coded apps.
Zeno traces critical user flows, detects launch blockers, and turns repository evidence into a clear readiness verdict before users find what is broken.
npx zenoai For JavaScript, TypeScript, JSX, and TSX projects.
acme-dashboard — zsh
developer@mac acme-dashboard % npx zenoai ░█████████ ░██ ░██ ░███████ ░████████ ░███████ ░███ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░█████████ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░██ ░█████████ ░███████ ░██ ░██ ░███████ 💎 Zeno v0.2.0 One function. One purpose. Everything else is negotiation. ? What do you want Zeno to do for acme-dashboard? ❯ Tell me if this is safe to ship Make this code easier to work with Split large files Check for security risks ✔ What do you want Zeno to do for acme-dashboard? Tell me if this is safe to ship action: tell-me-if-this-is-safe-to-ship ✔ Scanning routes, dependencies, scripts, and environment usage ✔ Found 38 files found (41) → sending (38) skipped: next-env.d.ts, generated types, lockfile AI review Provider : openrouter Model : anthropic/claude-sonnet-4.6 Calls : 1 model call + 1 formatting retry if needed ✔ Proceed with this AI review? Yes ✔ Detected project type: SaaS app [High confidence] ✔ Built deterministic launch findings ⠙ Validating structured output… ✔ Generated and validated structured report ✔ Zeno — done (24s) ━━━ ZENOAI — SHIP READINESS REPORT ━━━ Project : acme-dashboard Reviewed by : Engineering Manager Project type: saas_app [High confidence] Files : 38 Date : 24 Jun 2026, 15:12 Verdict Not yet [High risk] Confidence High Founder summary The dashboard has unverified protected routes and an unsafe data-write path. Public launch should wait until authentication guards and write validation are confirmed. Issue summary ┌────────────────────────┬──────────┬──────────┐ │ Category │ Found │ Showing │ ├────────────────────────┼──────────┼──────────┤ │ Hard blockers │ 2 │ 2 │ ├────────────────────────┼──────────┼──────────┤ │ Soft blockers │ 2 │ 2 │ ├────────────────────────┼──────────┼──────────┤ │ Code ownership risks │ 1 │ 1 │ └────────────────────────┴──────────┴──────────┘ Top issues ┌────────────┬────────────┬──────────────────────┬─────────────────────────────────────────┐ │ Category │ Severity │ Certainty │ Issue │ ├────────────┼────────────┼──────────────────────┼─────────────────────────────────────────┤ │ Hard │ High │ Needs verification │ Protected routes need verification │ ├────────────┼────────────┼──────────────────────┼─────────────────────────────────────────┤ │ Hard │ High │ Needs verification │ Data write needs validation │ ├────────────┼────────────┼──────────────────────┼─────────────────────────────────────────┤ │ Soft │ Medium │ Confirmed │ Missing error-state UI │ ├────────────┼────────────┼──────────────────────┼─────────────────────────────────────────┤ │ Soft │ Medium │ Confirmed │ No production monitoring │ ├────────────┼────────────┼──────────────────────┼─────────────────────────────────────────┤ │ Ownership │ Medium │ Confirmed │ Dashboard route is monolithic │ └────────────┴────────────┴──────────────────────┴─────────────────────────────────────────┘ Hard blockers 1. Protected routes need verification High [Needs verification] Evidence: Dashboard and settings routes were detected, but no route guard or session check was found. Risk: Unauthenticated users may access protected application screens. Fix: Add and verify middleware or server-side session checks for every protected route. 2. Data write needs validation/error handling High [Needs verification] Evidence: A POST route writes to the database without an obvious schema validation or error-handling path. Risk: Invalid input may corrupt data or fail without useful feedback. Fix: Validate request input with a schema and return explicit error responses. Soft blockers 1. Missing user-facing error states Medium [Confirmed] Evidence: The primary data form handles success but has no visible error state. Risk: Failed writes may leave users unsure whether their action completed. Fix: Add explicit pending, success, and error states around the write path. 2. No production monitoring detected Medium [Confirmed] Evidence: No error monitoring or application-health integration was found. Risk: Authentication and write failures may reach users before the team sees them. Fix: Add error monitoring before public launch. Code ownership risks 1. Dashboard route is a 914-line file with 24 functions Medium [Confirmed] Evidence: app/dashboard/page.tsx contains data fetching, mutations, filters, table state, and presentation in one route file. Risk: Future edits may break unrelated dashboard behavior. Fix: After launch paths are verified, split data access and table sections. Can ship? Private preview: Maybe Internal review only while route protection is verified. Public launch: No Protected routes and the primary write path are unverified. Paid traffic: No Do not acquire users into an unverified auth and write flow. Safest next step Verify authentication guards and validate the primary data-write path before refactoring. Deterministic findings saved: 5 launch findings Full report saved: .zeno/reports/ship-readiness-2026-06-24-15-12.json
The problem
Vibe-coded apps can look finished long before their critical path works.
A polished interface and a successful build do not prove that signup, checkout, lead capture, authentication, or data writes complete the outcome users expect.
Generic checks miss product context
A landing page, SaaS dashboard, backend API, and developer tool need different readiness rubrics and different critical-path checks.
Warnings arrive without evidence
AI reviews often sound certain without showing whether a finding came from code, configuration, an inference, or something that still needs runtime verification.
Technical debt hides the blockers
Large files and missing tests matter, but they should not outrank a broken capture form, an unprotected route, or a data write that never completes.
Why Zeno
A readiness review built around what the product is supposed to do.
Zeno combines deterministic repository analysis with bounded AI synthesis. It adapts the rubric to the project, shows the evidence behind each risk, and keeps runtime uncertainty visible.
Project-aware
Zeno identifies the kind of product it is reviewing, assigns a confidence score, and asks for confirmation when the repository is ambiguous.
Landing page SaaS Dashboard CLI API Ecommerce
Evidence-backed
Deterministic repository analysis inspects routes, source patterns, dependencies, scripts, tests, metadata, environment usage, and critical action flows before AI synthesis.
critical path: visitor → submit email → captured lead - no route, server action, or provider call found + submit handler only updates local component state certainty: confirmed from repository evidence
Launch-context aware
A private preview, public launch, and paid traffic campaign do not carry the same standard. Zeno evaluates readiness for the launch you are actually planning.
private preview public launch paid traffic
Honest about certainty
Every finding is marked Confirmed, Likely, Needs verification, or Inferred, so static evidence is never presented as runtime proof.
Confirmed Likely Needs verification Inferred
Four ways to run Zeno
Start with ship readiness. Keep the tools that make the code safer to own.
Ship readiness is the anchor: can this product deliver its intended outcome? Security scanning, guarded cleanup, and deterministic file splitting support that decision before and after launch.
npx zenoai
$ npx zenoai ZENOAI - SHIP READINESS REPORT Project type: Landing page (94% confidence) Launch target: Public launch VERDICT NOT READY - critical capture flow is incomplete HARD BLOCKER / CONFIRMED src/components/WaitlistForm.tsx The primary CTA renders a form, but submit only updates local state. No API call, action, persistence, or provider is wired. CRITICAL PATH Visitor -> submits email -> no durable outcome SAFEST NEXT STEP Connect submit to a server-side capture endpoint, persist the email, then verify success and failure states at runtime.
$ npx zenoai ACTION - MAKE THIS CODE EASIER TO WORK WITH Candidate: src/lib/formatters.ts SAFETY GATE Low consequence / contained change PROPOSED CLEANUP - extract repeated date formatting helper - preserve exports and call signatures - keep diff small and reviewable SKIPPED src/billing/charge.ts - untested payment boundary
$ npx zenoai ACTION - SPLIT LARGE FILES No AI provider required CANDIDATE src/components/Dashboard.tsx (1,038 lines) SAFE EXTRACTION - move exported table columns to dashboard-columns.ts - move static status labels to dashboard-data.ts LEFT UNCHANGED Event handlers, state, data fetching, and rendering logic
$ npx zenoai ACTION - CHECK FOR SECURITY RISKS Local deterministic scan / no API key HIGH / CONFIRMED src/lib/client.ts Secret-like credential is assigned in browser-bundled code. LIKELY src/api/admin.ts Privileged write route has no visible authorization guard. NEXT STEP Remove the client-side credential and verify route auth.
Trace the product's critical path before users find the break.
Zeno identifies what the user is supposed to do, then checks whether repository evidence connects that action to a real outcome. It separates launch blockers from technical debt and flags what still needs runtime verification.
Improve maintainability without turning cleanup into a rewrite.
Zeno filters out generated files, framework boilerplate, and high-consequence untested code before cleanup. It favors contained improvements and skips files when the safest change is no change.
Separate clearly extractable data without restructuring behavior.
The deterministic split action moves static constants, types, and configuration into smaller files. It does not use AI or attempt broad logic rewrites.
Catch obvious security signals before they become launch incidents.
The local static scan checks for exposed secrets, unsafe configuration, risky routes, insecure data handling, and related repository signals. It is a fast safety check, not a replacement for a security audit.
Risk classification
Launch blockers, quality gaps, and ownership risk are not the same thing.
Hard blockers
Failures that stop the product's critical path or make the intended launch unsafe, such as an unwired form, broken auth guard, or missing durable write.
Soft blockers
Important gaps that may be acceptable for a private preview but should be resolved before a broader public launch or paid acquisition.
Ownership risks
Maintainability and safety-net gaps that increase future change risk without being mislabeled as immediate launch failures.
Explicit certainty
Confirmed, Likely, Needs verification, and Inferred labels show how strongly the repository supports each conclusion.
Workflow
Move from repository scan to a defensible next step.
Run Zeno in the project
Start with npx zenoai. Zeno scans the repository structure, source patterns, routes, dependencies, scripts, tests, metadata, and environment usage.
Choose the question
Check ship readiness, scan security risks, make the code easier to work with, or split clearly extractable content from large files.
Review the evidence
See the critical path, blocker class, severity, certainty, project type, launch context, and the repository evidence behind each finding.
Act or share
Take the safest next step, rerun Zeno, or open the local HTML report. Export CSV, or use the browser's print dialog to save a PDF.
Local reporting
Keep the compact terminal verdict. Open the full evidence when you need it.
Start here npx zenoai
Run the review locally, inspect the evidence, then act on the safest next step.
npx zenoai npx zenoai help npx zenoai reset npx zenoai reset-history npx zenoai clear-report npx zenoai report list npx zenoai report open latest - Complete local artifacts Every full report is saved locally as JSON, HTML, and CSV for review, automation, or sharing.
- Browser-based PDF export Open the printable HTML report and use Print / Save as PDF when you need a portable launch record.
- Bounded structured output Schema limits, JSON repair, and deterministic fallback keep malformed model output out of the terminal.
- Reports stay discoverable List previous reports or open the latest local report directly from the CLI.
Beta updates
Using Zeno? Help shape
what comes next.
Get release notes and occasional product research invites. No spam.
Why project-aware review matters
Generic code review finds issues. Zeno evaluates whether the product can deliver value.
Scenario Generic AI review Zeno readiness review
Review context Applies a generic checklist or summarizes code quality. Adapts the review to the detected product type and intended launch.
Primary question What issues exist in this repository? What must the user do, and does the code appear wired to complete it?
Prioritization Often mixes launch failures, tests, metadata, and maintainability. Prioritizes broken critical paths before softer quality and ownership risks.
Confidence May present conclusions without an evidence boundary. Labels certainty and identifies findings that still require runtime verification.
FAQ
Common questions about Zeno.
What does Zeno do?
Zeno is a ship-readiness copilot for vibe-coded apps. It offers four actions: tell me if this is safe to ship, make this code easier to work with, split large files, and check for security risks.
Does Zeno prove that my app works?
No. Zeno uses repository evidence and static analysis to trace whether critical flows appear wired. It explicitly identifies findings that need runtime verification and does not replace end-to-end testing, monitoring, or manual review.
What kinds of projects can Zeno review?
Zeno detects landing pages, SaaS apps, dashboards, developer tools and CLIs, backend APIs, documentation sites, and ecommerce projects. It stores a confirmed selection in .zeno/project.json when detection is ambiguous.
What is the difference between a private preview, public launch, and paid traffic verdict?
Each launch context has a different tolerance for incomplete flows and operational gaps. Zeno makes the context explicit so a preview-level recommendation is not mistaken for public or paid-traffic readiness.
Which actions run without an AI provider?
Security scanning and large-file splitting are deterministic local actions and do not require an API key. Ship-readiness analysis combines local static analysis with AI synthesis. Guarded cleanup uses the configured provider for selected files.
Can I export and share a report?
Yes. Zeno saves complete reports locally as JSON, HTML, and CSV. Open the printable HTML report and use your browser's Print / Save as PDF option when you need a PDF.
Which coding agents does Zeno work with?
Any tool that leaves code behind in your repository, including Codex, Claude Code, Cursor, Windsurf, Copilot, ChatGPT, and local scripts.
Which languages does Zeno support?
Zeno currently focuses on JavaScript, TypeScript, JSX, and TSX projects.