一家公司所宣称的技术究竟是不是真的？DDE 通读代码库，核实技术主张、识破造假与 AI-washing——再将其与行业及竞争对手对标，并为你自身的短板评分，一切都在你的 IDE 中完成。
+ Parallel Atlas 4-Axis (35% Crypto Core)
+ 30-Item × 10-Co. Capability Matrix
With Data Provenance Box & Source Appendix
Runs inside your existing IDE AI subscription
Due Diligence Engine (DDE) 是一款开源命令行工具，能把你 IDE 中的 AI 智能体——Claude Code、OpenAI Codex CLI、Google Gemini CLI、Antigravity、Cursor、GitHub Copilot（支持 Claude Opus 5.5 / Sonnet 5.5、Gemini 4 Argon、GPT-5 等）——变身为世界级的技术分析师。它会通读任意目标对象的整个代码库——无论是投资组合公司、收购标的、竞争对手，还是你自己的团队——核实其所宣称的技术是否真正落地，实时调研市场与竞争对手，并在多个加权维度上为优势与短板评分，最终将一份咨询级水准的 PDF 报告写入你的下载文件夹。一切都在你 IDE 的 AI 沙箱中本地运行：无需 API 密钥、不经第三方服务器、无遥测，也不产生任何额外费用。
Generic AI code reviewers stop at checkbox compliance ('Has auth? ✓ Has HTTPS? ✓'). DDE inspects actual cryptographic primitives (Signal Protocol, PQXDH + ML-KEM-1024, libsignal/BoringSSL FFI vs. self-rolled crypto), concurrency models, and live 2026 market sources.
Eliminates stale training-cutoff analysis. Before inspecting the repo, the agent searches 2026 competitor acquisitions, shutdowns, funding rounds, CVEs, and regulatory shifts. Every matrix cell carries source URLs + verification dates, surfaced in the PDF Data Provenance Box.
"data_freshness": {
"web_search_performed": true,
"search_date": "2026-10-22",
"queries_executed": 14,
"sources_cited": 28
}In v0.6.2, heuristic false positives (git rebase timestamp diffs, high-velocity commits, documentation buzzword counts) are silently discarded and blocked by _filter_red_flags. Only genuine code-level security gaps, race conditions, and logic bugs with exact file:line and fix plans appear.
{
"severity": "HIGH",
"file_path": "src/crypto/session.rs:142",
"title": "Nonce reuse risk on concurrent retry",
"description": "Use atomic counter or ChaCha20Poly1305 random nonce..."
}Third-party badges (SOC2, ISO, HIPAA) are reference-only and never scored. DDE audits 4 claim-vs-code consistency checks plus 6 code-measured capabilities: Cryptographic depth, Concurrency model, I/O patterns, Caching architecture, Scalability, and ML implementation depth.
Claim vs Code (4): Pitch accuracy / Feature completeness
Code Measured (6): Crypto FFI / Concurrency / I/O / Cache / Scale / ML每一份路演材料都写着「AI 驱动」，但少有人能证明这一点。技术尽职调查既慢又贵，难以在整条项目管线上规模化推进。
营销话术会夸大——甚至凭空捏造——代码库根本不具备的能力。要发现这种落差，需要耗费一名资深工程师的时间。
为每一笔交易通读代码库、梳理架构、对标竞品，都是数天的专家级工作，而你很少有这样的时间。
缺少客观的技术基准，定价与风险决策就只能依赖创始人的叙事，而非事实证据。
Every report delivers both the balanced 5-Dimension Standard Score (equal 20% weights) and the parallel Atlas 4-Axis Engineering Philosophy (55% weighted toward deep cybersecurity engineering).
API Wrapper vs. Genuine IP
Distinguishes thin third-party API wrappers from defensible proprietary algorithms, protocols, and custom engineering.
Stack Modernity & Cryptographic Edge
Evaluates 2026-grade language safety, runtime efficiency, post-quantum primitives (ML-KEM-1024), and modern toolchain maturity.
PoC Demo vs. Production Grade
Inspects error handling, edge cases, migrations, state machines, and automated test coverage to separate demos from production code.
Structural Integrity + Integrated Security (v0.3)
Evaluates security posture as an inseparable foundation of production architecture alongside modularity, fault isolation, and scalability.
Pitch Deck & Website Claims vs. Code Reality
Cross-examines public marketing claims ('AI-powered', 'E2EE', 'Zero-Knowledge') against actual repository implementation to expose AI-washing.
Strong investment candidate
Viable with conditions
Significant concerns
High risk
Do not invest (or Critical Deal-Breaker)
Generates 7 consulting frameworks across 6 global regions, plus an 8th chart: a ~30-item × 5–10 competitor Implementation Capability Matrix dynamically tailored to the target's industry with 3–5 line competitor selection rationales.
Vision × Execution
Market Growth × Relative Share
Competitive Position × Technical Moat Depth
Security Implementation × Privacy Readiness
Data Protection × Audit Transparency
Downside Risk × Upside Potential
R&D Velocity × ARR Traction (3D Bubble)
Uses the 4-state Japanese tech rating standard (○ / △ / × / ?) with primary source URLs and verification dates on every cell.
Publicly documented & verified in code, whitepapers, or specs
Asserted in marketing, but not independently verifiable
Explicitly absent in documentation or architecture
Cannot be determined from public evidence (preferred over guessing)
| Category / Capability | Target | Comp. A | Comp. B | Comp. C | Provenance (sources + last_verified) |
|---|---|---|---|---|---|
Core Cryptography Hybrid Post-Quantum Key Agreement (PQXDH / ML-KEM-1024) | ○ | ○ | × | △ | [2026-10-22] Verified FIPS 203 ML-KEM-1024 + X25519 FFI implementation |
Metadata Privacy Sealed Sender / Zero-Knowledge Routing | ○ | ○ | × | × | [2026-10-22] Verified sender certificate encapsulation across relays |
Data Governance Cryptographic Message Retirement (Tombstone Zeroize) | ○ | △ | × | ? | [2026-10-22] Verified Ed25519-signed Tombstone & cache zeroization |
Audit Transparency Public Source Code & Automated Security CI | ○ | ○ | × | × | [2026-10-22] Verified public GitHub repository & CodeQL/osv-scanner CI |
* In live PDF reports, the ~30 capability items and 5–10 top competitors are dynamically selected for the target's industry (Messaging, Fintech, Medical, Gaming, SaaS, IoT), with all cited URLs listed in the Source Appendix.
Typeset in black and Atlas Blue (#5271FF), combining executive synthesis, code-level evidence, global market charts, and a cryptographic purge certificate (~22–24 pages depending on findings).
5-dim horizontal bars, 5-dim radar chart, Data Provenance Box (search date, query & source counts, or training-cutoff warning), and business + technical synthesis.
Evidence-backed SWOT grid, per-dimension enablers, 1/3/5-year projections with confidence, immediate/medium/long-term roadmap, and investment thesis.
Genuine code defects only (file:line + fix plan) and the 10-item technical audit (4 claim-vs-code + 6 code-measured).
Regional positioning charts, 3–5 line rationale per competitor (HQ, market position, why chosen), and the ○△×? capability matrix.
Performance / Stability / Lightweight / Security Strength bars plus a plain-language executive glossary (MFA, SOC2, libsignal, PQXDH).
Engineering rebuild time/cost estimation, complete URL Source Appendix (added in v0.6.0), and cryptographic workspace purge certificate.
一套可复用、以证据为先的技术评估——每一笔交易都套用同一份评分标准。
将路演内容与真实代码库逐一比对，分清哪些是真正构建出来的，哪些只是口头宣称。
标记出「AI」只是薄薄一层封装、写死的启发式规则，或干脆不存在的情形——把真正的 ML 与营销噱头区分开来。
在多个等权维度上给出 0–100 分的评分与字母等级，并附上完整的推理过程。
梳理结构、依赖与设计取舍，以评估可维护性、可扩展性和技术债务。
在网络上调研真实竞品、融资动态与安全公告，构建一份附带出处的市场对比。
完全在你 IDE 的 AI 沙箱中运行。无第三方服务器、无遥测——并经 CodeQL、Dependabot 与 pip-audit 审计。
DDE itself operates zero third-party servers and zero telemetry. Choose the exact execution boundary that matches your security policy.
$ dde prompt --pdfDDE locally generates a structured prompt. Code reading and PDF generation happen inside your existing IDE AI agent session (Claude Code, Codex, Gemini CLI, Antigravity, Copilot, Cursor).
DDE makes zero outbound calls. Your AI agent runs STEP 0 live web searches for public competitor & CVE data.
$ dde analyze . --skip-aiSource code is analyzed 100% locally in memory/temp workspace and never sent to any AI model or external service.
In v0.6.3 (780e3cd / aac4c77), --skip-ai strictly disables API key auto-loading and blocks all outbound network requests.
$ dde analyze owner/repoUses your own API keys to cross-verify across up to 3 providers via the unified SSOT registry (BYOK_DEFAULT_MODELS / PROVIDER_MODEL_COSTS): Anthropic (Claude Haiku 5.5 → Sonnet 5.5 → Fable 5.1), Google (Gemini 4 Argon), and OpenAI (Astra gpt-6.1-sol / GPT-5).
Configured for zero-retention API endpoints (store=False, with fail-closed enforcement on GoogleProvider). Strips user:token@ credentials from GitHub URLs and immediately dereferences PATs after single in-memory use.
Eradicated all 36 audit defects across 35+ modules with GPT-6-Astra (xhigh) & Gemini 4 Argon, unified the SSOT model/cost registry, and locked permanent verification with 156 automated tests (tests/test_audit_regressions.py + tests/test_zero_drift_invariants.py).
Blocks Zip Slip traversal, symlinks, and FIFO special files during archive ingestion, and strips user:token@ credentials from GitHub URLs. Preserves .git during analysis for commit forensics, then performs in-place "r+b" 3-pass zero-fill shredding with strict os.walk(onerror=...) failure propagation and Windows NTFS user-only ACL locking.
Site verification (site_analyzer.py) enforces ip.is_global to block RFC 6598 CGNAT (100.64.0.0/10), private, loopback, and cloud metadata IPs as well as unsafe redirects, using reentrant DNS pinning (_pinned_dns_context) to prevent time-of-check to time-of-use (TOCTOU) DNS rebinding attacks.
Applies _esc_text across all dynamic PDF fields (ImplementationMatrix, sources, RedFlags) to prevent ReportLab XML parser crashes. Protects Latin digits and ASCII punctuation with Helvetica in Arabic (ar) and Thai (th) to prevent missing-glyph tofu boxes (□) across 24-page PDFs, enforces Jinja2 autoescape=True, and guarantees idempotent Score.compute().
Unifies __version__, BYOK_DEFAULT_MODELS, and PROVIDER_MODEL_COSTS (Astra gpt-6.1-sol $2/$10, gpt-6-astra $5/$25, gpt-5 $1.25/$10, Haiku >100k tiered rate) in config.py SSOT. Enforces fail-closed store=False on GoogleProvider, supports async def AST analysis, and locks 156 CI tests via test_zero_drift_invariants.py.
DDE 会生成一段结构化提示词，任何能够读取文件、运行 shell 命令的 AI 智能体都可以执行它。无需安装专属插件，也无需登录。
用一条 pip 命令即可从公开仓库安装。纯本地 Python——无需账号，无需配置。
在目标项目下，于你的 AI IDE 终端中运行 DDE 命令。分析由你现有的 AI 订阅完成——不产生任何额外费用。
智能体会读取数百个文件，从加权维度逐一评估，并实时在网络上调研竞品、融资动态与安全公告。
一份咨询风格的 PDF 会出现在你的下载文件夹中——包含 0–100 分的评分、字母等级、竞争格局，以及附带出处的评判依据。
New in v0.6.3: paste Method A directly into your AI agent chat for fully automated install + audit + PDF generation, or run Method B in your terminal. Bundled Noto fonts render 14 PDF languages out of the box.
✓ Your current locale is natively supported for localized PDF output (14 languages).
Install https://github.com/Atlas-Associates-Inc/Due-diligence-engine (python3 -m pip install -U --no-cache-dir git+https://github.com/Atlas-Associates-Inc/Due-diligence-engine.git), run dde prompt --pdf --lang zh on this project, and execute the entire generated prompt (STEP 0 live web research, full code audit, JSON generation, and PDF rendering) end-to-end to save the consulting PDF report to ~/Downloads/.python3 -m pip install -U --no-cache-dir git+https://github.com/Atlas-Associates-Inc/Due-diligence-engine.git && dde prompt --pdf --lang zhdde doctordde prompt --pdf --lang zh --url https://example.comWorks out of the box in any AI agent capable of reading files and running shell commands.
Boutique consulting depth with local-first privacy at zero added software cost.
| Dimension | DDE (v0.6.3) | Manual DD Consulting | Generic AI Code Review | SaaS DD Platforms |
|---|---|---|---|---|
| Added Cost | $0 (uses your IDE AI) | $$$$ (consultant fees) | Per-token API fees | $$$$ (enterprise subscription) |
| Code Privacy | Local / IDE sandbox (0 DDE servers) | Manual NDA & repo sharing | Uploads code to vendor | Stores code in vendor cloud |
| Deliverable | 24-page consulting PDF (14 langs) | Bespoke report | Inline PR comments | Web dashboard |
| Data Freshness | Live web search (2026) + URLs | Depends on analyst | Training cutoff only (stale) | Vendor refresh cycle |
| Crypto & Security Depth | PQXDH / ML-KEM-1024 / FFI audit | Depends on consultant | Surface checklist | Surface checklist |
| Competitive Benchmarks | 7 charts × 6 markets + 30-item matrix | Manual research (weeks) | None | Limited |
| Red Flag Precision | Code-verified only (file:line + fix) | High (slow) | High false-positive noise | Heuristic rule noise |
| Setup & Turnaround | 1 command / ~10–20 min | 2–4 weeks | Minutes (partial) | Days (onboarding) |
无论你是在做投资决策、客观审视自家工程，还是对标竞争对手——都能快速拿到源自代码的证据。
VC、成长期基金与 M&A 团队：在深度尽调之前，先在整条项目管线上筛查技术风险、辨明主张背后的真伪。
在自家代码库上运行 DDE，以第三方视角看清优势、短板与技术债务——用于排定改进优先级，或为下一轮融资做准备。
基于公开仓库与市场数据，对标竞争对手的技术栈与实现深度，用证据看清你自己的位置。
是的。DDE 基于 Apache 2.0 许可证开源。它使用你 IDE 中已有的 AI 订阅，因此无需 API 密钥，也不产生任何额外费用。
不会。DDE 是 100% 本地运行的 Python，运行在你 IDE 的 AI 沙箱中。没有 DDE 服务器，也没有遥测。网络调研只会获取关于竞品和市场的公开信息。
任何能够读取文件并运行 shell 命令的智能体都可以。它已在 Claude Code、OpenAI Codex CLI、Google Gemini CLI、Antigravity 和 GitHub Copilot Agent Mode 上验证（支持 Claude Opus 5.5 / Sonnet 5.5、Gemini 4 Argon、GPT-5 等最新模型），并可与 Cursor、Gemini Code Assist、Aider、Windsurf 等同类的智能体终端配合使用。
一份咨询级水准的 PDF（约 24 页），保存到你的下载文件夹，包含一个总体 0–100 分的评分、一个字母等级、一份竞争格局、一份实现对照矩阵，以及附带出处的评判依据。
AI-washing 指的是在底层技术微乎其微甚至根本不存在的情况下，却把产品包装成 AI 驱动来营销。DDE 会将路演中的主张与代码库中的真实实现逐一比对，并标记出其中的落差。