Free & self-hosted Your code and keys never leave your infrastructure
Describe a product in a sentence. Review the plan before a byte is written. Get a repository that compiles, migrates and runs — with row-level security, audit, tests and human gates already in it. Self-hosted, free, and yours.
No signup to look. Nothing to install until you want a repository.
Rathvan = intake & scoping + architecture review + scaffolding + security foundations + gates + provenance + deploy verification
Every number on this page is generated from the sources at build time. If one is wrong, the build fails — which is the same rule the platform applies to everything it produces.
Solutions
The pipeline is 13 stages and 3 human gates. A track tightens the stages that matter for the work and relaxes the ones that do not. What it never does is let a prototype reach production by accident.
Structurally incapable of shipping: separate namespace, no production credentials, an expiry. Promotion is a restart, not a merge.
Identity, tenancy, forced row-level security, audit and tests in the first commit — the parts every product needs and nobody enjoys building twice.
Server-priced from the catalogue, integers in the smallest unit, and the full security pass. The rules are gates, not guidance.
Drift detection reads your docs against the facts, drafts the smallest correct edit, and opens a pull request. It never merges one.
Demo
Three products scaffolded by the real tool, captured and published: the config that went in, the plan it printed before writing a byte — including what it refused — and the files that came out, provenance included.
Compare
Not a vendor scoreboard. These are the real alternatives: hand the work to a coding agent, or build the foundations yourself again.
| Coding agent alone | Building it yourself | Rathvan | |
|---|---|---|---|
| Plan before code | Sometimes, in prose | In your head | Printed, and nothing is written until you accept it |
| Security foundations | Whatever it remembered | Week three, usually | RLS enabled and forced, in the first commit |
| Human gates | None that block | Process, if people follow it | Executable — the build stops |
| Where it can ship | Anywhere it is pointed | Anywhere | Staging is the ceiling; production needs a person |
| Provenance | A chat log | Git history, if you look | Every file hashed, the builder and kernel recorded |
| Your code, your keys | Their servers | Yours | Self-hosted; bring your own model keys |
Rathvan is not a replacement for a coding agent — it is what decides whether the agent's output is allowed to become your product.
Download
Answer the intake in the console, download your rathvan.json, and turn it into a repository:
$ npx "https://build.rathvan.com/rathvan-cli.tgz?v=a1c4341f7ead" new ./your-product
The plan prints first and writes nothing until you confirm. Java 21 and Docker are the only prerequisites.
$ ./gradlew installDist $ ./dmg/build-dmg.sh
Run those in service/ and the image lands in build/dmg/. It is unsigned until the app is notarised, so macOS asks you to right-click and Open the first time.
One command, no install, no account. Every scaffold carries a lock file recording which builder and kernel produced it.
A macOS image with a bundled Java runtime — nothing else to install. Your machine, your keys, your data, its own console at /console.
Not hosted yet — it is two commands from the source:
Enterprise
Most platforms like this assume a blank directory, which is why most enterprises cannot use them: the systems that matter already exist and are not going to be rewritten to suit a tool. There are two doors here, and the one you take depends on whether the thing you are improving is already running.
A service that works, that people depend on, and that nobody is volunteering to rewrite. The expense was never the existing code — it is the next twenty features: the plan nobody wrote down, the foundations re-argued each time, the review that happens after the code exists and is therefore a negotiation rather than a decision.
Your system adopts the kernel through four ports — a store, a model-provider chain, a source-control port and a feature gate. Your database, your repository and your vendors stay yours. Nothing is ported to us.
A new platform, a new line of business, or the internal system that has been a spreadsheet for three years. The risk here is the opposite one: not legacy, but the six weeks before anything is real, spent rebuilding the same foundations your last four products already have.
Describe it in a sentence and answer the intake. You read the plan — including what it refused to do — before a byte is written. What comes out is a repository that compiles, migrates and runs.
Self-hosted from the first day. Bring your own model keys, held encrypted, so your spend is yours and your code is read by a vendor you chose. Government identifiers, salary, bank details, phone numbers and raw user notes are never sent to a model.
SSO, per-user credentials with revocation, and spend budgets. Repository access is granted per repository with short-lived tokens — not a blanket key to your organisation.
Production needs a person, every time. The gates are executable: the build stops rather than logging a warning nobody reads.
Every generated file hashed, with the builder and kernel version recorded — so "where did this come from?" has an answer eighteen months later.
And what it does not do
Self-hosted, with a model chain that fails over across vendors rather than failing. If you want to talk through which door applies to your estate — or have us look at the system you already have — that is the conversation to start.