The code your agents have never seen
A model's competence tracks what it was trained on. Your internal frameworks, your naming conventions, the service three teams depend on that nobody has documented since 2019 — none of it was in the training set. That is exactly where an agent stops retrieving and starts inventing, and exactly where a wrong answer costs the most.
- Never in the training set Private code cannot be recalled, only guessed at. Every internal API is a hallucination risk.
- Too large for any context window A monorepo does not fit, and it never will. Agents burn their budget re-exploring the same directories every session.
- Changes faster than documentation Docs describe intent at the time of writing. A compiled graph describes what is actually in the commit you shipped.
What Enterprise includes
Scale
- Private monorepo ingestion
- all repos, one graph
- Incremental re-index on push
- CI webhook
- Cross-repo symbol resolution
- included
- Dedicated index capacity
- by contract
Control
- Per-repo access scoping
- included
- Team & seat management
- dashboard
- Query analytics & symbol hotspots
- included
- Versioned graph pinning
- per release
Deployment
- Nudox Cloud
- fully managed
- Self-hosted Docker images
- your infrastructure
- Air-gapped operation
- supported
- MCP endpoint inside your network
- self-hosted
Support
- Named technical contact
- included
- Onboarding & integration support
- included
- Response-time SLA
- set per agreement
- Support hours & coverage
- 24/7
How Nudox lands in your org
-
Review repo topology, languages, and build systems.
00Scope
Pick the pilot repo. Name one technical contact.
-
Provision the deployment — cloud tenant or signed images.
01Connect
Grant read access to the repo. Add the CI hook.
-
Compile the repos into a versioned symbol graph.
02Index
Verify coverage on the hot paths your team picked.
-
Expose the MCP endpoint and issue keys.
03Roll out
Point the agent fleet at the endpoint. Widen to more teams.
-
Re-index incrementally on every push.
∞Operate
Read query analytics. Expand repo scope as it earns it.
Where the graph lives
Two deployments, one product. The only question is which side of your network boundary the graph is compiled on — and that is a decision for your security team, not for us.
Nudox Cloud
Best for a fast start with no infrastructure work.
We run the indexer and hold the graph. Your team grants read access and nothing else — no hosts to size, no upgrades to schedule. Your source is read by our infrastructure, which is the trade you are making.
Self-Hosted
Best for strict data-boundary and air-gap requirements.
Ships as Docker images you run with Compose on your own hosts. The indexer, the graph, and the MCP endpoint all sit inside your boundary — your source never leaves it. In exchange, your team owns the host, the upgrades, and the backups.
| Nudox Cloud | Self-Hosted | |
|---|---|---|
| Where your source goes | Read by Nudox infrastructure | Never leaves your network |
| Where the graph lives | Nudox infrastructure | Your infrastructure |
| Outbound network required | Yes | No — air-gap capable |
| Delivery | Hosted tenant, nothing to install | Docker images, run with Compose |
| Who runs upgrades | Nudox, continuously | Your team, on your schedule |
| Scaling | Managed for you | You size and grow the host |
| Re-index on push | Automatic | Automatic, on your runners |
| Secret & key management | Nudox-managed | Yours, entirely |
| Audit visibility | Dashboard | Your own logging stack |
| Ops burden on your team | None | Real — you run it |
| Best for | Fast start, no infra work | Strict data-boundary requirements |
Security & data handling
True by construction
- No LLMs anywhere in the ingestion pipeline. The graph is compiled, so its structure cannot be hallucinated.
- Deterministic, reproducible rebuilds — the same commit always produces the same graph.
- In self-hosted deployments your source never leaves your network.
- Versioned graph state, so every answer traces back to a specific commit.
Confirm before publishing
- SSO / SAML — PLACEHOLDER
- SCIM provisioning — PLACEHOLDER
- Audit logging — PLACEHOLDER
- Encryption at rest and in transit — PLACEHOLDER
- Data residency options — PLACEHOLDER
- SOC 2 — PLACEHOLDER (state the actual status, including "not yet pursued")
Pilot-01 // Scoped engagement
Start with one repository
We would rather prove this on the repo that hurts than sell you a platform. Pick the codebase your agents get wrong most often — that is the honest test.
- Scope
- One repository you choose, plus its direct dependencies.
- Duration
- 3 months.
- Deployment
- Nudox Cloud, or self-hosted Docker images inside your network.
- Cost
- $0.
Exit criteria — how we both judge it
- Agents resolve your internal symbols correctly on paths your team names in advance.
- A measurable drop in exploratory grep-and-read calls per task.
- A go/no-go review with your team. No auto-renewal, no lock-in.
Enterprise questions
Can we run Nudox fully air-gapped?
Yes. The self-hosted deployment runs with no outbound network access — the indexer, the graph, and the MCP endpoint all sit inside your boundary. The optional license check shown in the topology diagram above is omitted in air-gapped installs.
Does our source code ever leave our network?
In a self-hosted deployment, no. In Nudox Cloud, yes — our infrastructure reads your repositories in order to compile the graph. We would rather state that plainly than bury it. If that trade is not acceptable to your security team, self-host.
What does self-hosting actually require to run?
Docker images, run with Compose on hosts you control. Your team owns sizing, upgrades, and backups. Sizing depends on the repositories you index — tell us what you are running and we will size it with you before you commit to anything.
How do you handle monorepos and very large codebases?
This is the case Nudox is built for. Repositories are compiled into a single versioned graph with cross-repo symbol resolution, and re-indexed incrementally on push rather than rebuilt from scratch. Agents query the graph over MCP and retrieve only the symbols a task touches, instead of pulling whole directories into context.
How does licensing work for self-hosted deployments?
Enterprise deployments are licensed per contract — seat-based or usage-based, as covered on the pricing page. Air-gapped installs use an offline license, so the deployment never needs to reach us.
Do you sign a DPA and support a security review?
PLACEHOLDER — state what is actually offered here: DPA, security-questionnaire turnaround, penetration-test reports, and certification status. Do not claim a certification that is not held.
What is the support SLA?
PLACEHOLDER — state response-time targets, support hours, and the escalation path. Every Enterprise deployment includes a named technical contact.
How do we start?
With one repository and a scoping call. See the pilot terms above, then get in touch — tell us what you are running and how your agents fail today.
Ready to run Nudox behind your firewall?
Tell us what you are running and where your agents go wrong. We will tell you honestly whether Nudox helps.