Arketo

See what your AI actually built.

Your assistant draws your system live on a canvas, then circles what will break.

Map my app, freeExplore a live scan
  • Free scans to start
  • No card needed
  • Bring your own LLM

One line, and it starts drawing.

Arketo is a standard MCP server. Your assistant connects to it once, then draws, routes and reviews your system while you talk.

What you say

“Map my app, then find what breaks at 50x the traffic.”

  • Claude Code
  • Cursor
  • Windsurf
  • VS Code
What comes back
  • 7components
  • 6connections
  • 2findings
CriticalHighon the canvas above

In Claude Code

claude mcp add --transport http arketo "<your-mcp-url>" --header "Authorization: Bearer <your-key>"

Your code never leaves your machine. Your own AI describes the system, and Arketo only ever stores the picture.

The architecture is already there. You just cannot see it.

You can build an app in an afternoon now. What you cannot do is see the system you just built. The bottleneck, the missing auth check, the single point of failure: none of it shows up until load, an audit, or an outage forces it into the open.

What you can read
  • app/page.tsx
  • app/api/checkout/route.ts
  • lib/auth.ts
  • lib/db.ts
  • components/Upload.tsx
  • middleware.ts
What you shipped

What the AI gave you

Working features fast. Code that runs. Files you can read top to bottom, one at a time.

What it left out

The shape of the whole. Files are not architecture, and the diagram in your head is rarely the one you actually shipped.

See what goes wrong when it stays invisible

Three things it does on your canvas

It draws the whole system

Every component and connection, laid out into frontend, backend, and data tiers and routed automatically as you describe it. Drag to rearrange and the layout keeps up.

“a React app, a Node API and Postgres”

It flags what breaks

Bottlenecks, security gaps, and scaling limits, marked by severity right on the diagram where they live.

CriticalWeb app

The service-role key is in the browser bundle

MediumAuth

No rate limit on sign-in

It writes the report

A full Markdown write-up with a phased scaling plan, ready to drop into your repo or a ticket.

## What's solid
## Fix in this order
## Then
See everything it does on the canvas

The four doors AI leaves unlocked

An assistant writes code that works. Working and safe are not the same thing, and these four gaps turn up again and again in apps that shipped fast. Arketo goes looking for each of them by name.

1

A leaked Supabase service key

Critical

The service key skips every row-level rule you wrote, so once it ships in the browser bundle anyone who opens devtools owns the whole database.

2

The client talking straight to the database

High

The only thing deciding what may be read or written is code running on someone else's machine, and they can edit it.

3

No rate limit on the auth path

High

One script can sit on your login or password-reset endpoint all night, and nothing in the app is counting.

4

An unverified Stripe webhook

Critical

If the signature is never checked, anyone who finds the URL can post “payment succeeded” and get what paying customers get.

Wiz found 1 in 5 vibe-coding platforms exposed. Researchers pulled 400+ leaked secrets out of 5,600 vibe-coded apps. Bots find a leaked key within minutes.

See a real scan.

Real architectures already mapped and reviewed: the components, the connections between them, and the findings that came out of each. Read one before you run your own.

Why not just ask the AI to draw it in chat?

ChatGPT will sketch a diagram. So will Mermaid or Eraser. Then it is a picture: frozen the moment it is made, redrawn from scratch every time the code moves.

What it doesA chat diagram, or MermaidArketo, driven over MCP
Remembers your systemRe-prompted from scratchKept and updated in place
Knows which paths carry loadNo ideaHot paths marked on the wire
Tells you what will breakIf you ask, in proseBy severity, on the component

Not a drawing of your architecture. A running model of it, that your own assistant keeps current.

Every colour means something.

Each one stands for something specific: component type, connection load, finding severity. We built the site the same way, so every colour you have seen so far is data, not decoration.

Components

  • Client
  • Frontend
  • Gateway
  • Backend
  • Database
  • Cache
  • Queue
  • Storage
  • Auth

Findings

  • Info
  • Low
  • Medium
  • High
  • Critical

Connections

  • Standard path
  • Hot path, carrying the load
  • A connection nothing checks

One plan. Bring your own LLM.

The assistant you already pay for does the thinking. We host the live canvas, the findings, and the report. No AI key sits on our side, so there is no token margin to pay.

$7/ monthor $2.50 / week, $69 / yearSee what is included

Same plan on every cadence. No seats, no tiers, no usage surprises. Cancel anytime.

Security scanners for vibe-coded apps charge $29 to $49 a month. Arketo is $7, because your own model does the thinking and there is no token margin to pay.

  • Your system drawn and routed automatically, as you describe it
  • Likely bottlenecks and security gaps surfaced in place, by severity
  • A full Markdown report with a phased scaling plan
  • Your own assistant over MCP. We never hold a model key

Questions, before you start.

Anything else, and a person answers. There is only one of us, so it is a real reply.

Ask a question
  • Do I have to hand over my code or an API key?

    No. Arketo never reads your repository and never holds an AI key. Your AI assistant connects with one command and describes the system to the canvas over MCP, the open standard assistants use to reach outside tools. The thinking happens on the model you already pay for.

  • Which AI assistants does it work with?

    Claude Code, Claude Desktop, Cursor, Windsurf, VS Code, Codex, and anything else that speaks MCP. Your assistant connects with one command, then drives the live canvas for you.

  • What do the free scans include?

    The full taste: your system drawn and routed automatically, findings surfaced by severity in place, and the Markdown report. No card needed to start.

  • What does the plan cover, and what does it cost?

    Everything, with no seats, tiers, or usage surprises. It is one plan billed your way: $2.50 weekly, $7 monthly, or $69 yearly. Because no model key sits on our side, there is no token margin baked in. Cancel anytime.

  • Is my architecture private?

    Yes. Diagrams are yours by default; sharing is opt-in per project via a link you control and can revoke.

Point your AI at your architecture.

You already describe systems to it in plain language. Let it draw the one you built, and tell you where it bends.

Map my app, free