foretop

Open source · Apache-2.0 · runs locally and in CI

Lint beyond your code.

Foretop finds changes outside your repository that can still break it. Start with Ebb: scan every model reference against verified retirement dates, route each deadline to an owner, and keep your source local.

Ebb available now

View the LangChain report View on GitHub

Source stays local Every result links to evidence Unknown is never reported as clear

ebb 0.1.0 · langchain-ai/langchain @ 54383cd · real output
$ uvx --from git+https://github.com/foretop-dev/ebb ebb scan . ✕ break o1-preview — 393d overdue (2025-07-28) → o3 libs/partners/openai/tests/unit_tests/chat_models/test_base.py:1271 ✕ break gemini-1.5-pro — 330d overdue (2025-09-29) → gemini-2.5-pro libs/langchain_v1/tests/unit_tests/chat_models/test_chat_models.py:168 ≠ drift gpt-4-turbo — 59 days (2026-10-23) → gpt-5.6-sol libs/partners/openai/langchain_openai/data/_profiles.py:101 ? unknown 888 further model references with no verified retirement entry
24 references with a published deadline · 2,548 source files · scanned 2026-08-25 · exit 1

Real repositories. Reproducible results.

The output above is not a mock-up. Ebb was run against langchain-ai/langchain pinned at commit 54383cd, and every result below links to the exact source line at that exact revision. Re-run the same command and you get the same answers.

24Model references with published deadlines
17In library or runtime source
7In tests or examples
54383cdPinned commit · scanned 2026-08-25

Those 24 are the references carrying a real published deadline. The scan returned 1,545 results in total across all five checks — the large majority unknown, meaning no verified registry entry exists for them. Unknown is reported as unknown, never as clear, and it is not counted here as though it were a problem we had found.

Inspect every result

Every finding is the same shape

Expected, observed, and the evidence that proves the difference. One format across every check, so a deadline and a missing alert read the same way. These rows are real — they come from pointing all five checks at public repositories and publishing everything that came back.

langchain-ai/langchain @ 54383cd see the full report →
LangChain: sample results, one row per check
CheckSubjectExpectedObserved EvidenceStateDue
ebb claude-3-haiku-20240307 supported documentation only, no active runtime use found few_shot.py:374 ✓clear 127d overdue
ebb gpt-5.5 supported not in the retirement registry usage.py:26 ?unknown —
charter docs-langchain declared tools enumerated http server, not enumerated .mcp.json:3 ?unknown —
lading aiohappyeyeballs licence resolved PSF-2.0 — attribution uv.lock ✓clear —
telltale openapi.yaml a contract to check no spec at repo root — ?unknown —
langfuse/langfuse @ ea3c905 see the full report →
Langfuse: sample results, one row per check
CheckSubjectExpectedObserved EvidenceStateDue
telltale GET /api/public/annotation-queues log signal present no telemetry config in repo openapi.yml:26 ≠drift —
telltale POST /api/public/annotation-queues log signal present no telemetry config in repo openapi.yml:80 ≠drift —
telltale GET /api/public/annotation-queues/{queueId} log signal present no telemetry config in repo openapi.yml:126 ≠drift —
ebb claude-3-5-haiku-20241022 supported retired 2026-02-19 · configuration reference, use claude-haiku-4-5-20251001 claude-code-security-review.yml:57 ✕break 187d overdue
ebb claude-opus-4-1-20250805 supported retired 2026-08-05 · configuration reference, use claude-opus-4-8 claude-code-security-review.yml:68 ✕break 20d overdue
undertow Amazon Web Services (AWS) known subprocessor set 8 listed, effective 2026-08-10 subprocessors page ✓clear —

unknown is a real state, not an absence of one. When a check cannot see something, it says so — it never reports clear. Each report above links to every result from that scan, including the checks that found nothing and said why.

How it works

Three steps, in order, because each depends on the last.

First

Scan locally

Source, configuration, Terraform, Dockerfiles, notebooks and environment templates are read locally. Nothing is executed or uploaded.

Then

Resolve aliases against a reviewed registry

Dated snapshots, regional prefixes and version aliases resolve to canonical model identifiers with cited provider sources.

Last

Route every deadline to an owner

CODEOWNERS is used first, with git blame as fallback, and results are ranked by time remaining and blast radius.

A public registry you can challenge.

Every date carries the page it came from and the day a person last checked it. Nothing is scraped straight into your results — the refresher opens a pull request, and a person verifies it before it can change an answer. A model we cannot verify is reported as unknown, never as safe. The published registry currently holds 32 dated entries across 3 provider pages (anthropic, google, openai), counted on 2026-08-24.

Read the registry

What these never do

Each check is pointed at something sensitive. The constraints are the product.

Never assert without evidenceEvery finding carries the file, line and source it came from, plus the registry version that produced it.
Never fail quietlyWhen a check cannot see something it reports unknown. It does not report clear.
Never upload your sourceAnalysis runs locally. Only findings — paths, identifiers, line numbers — leave the machine, and only if you connect the hub.
Never read a secret valueCredential paths and variable names are reported. The values behind them are never opened, hashed or transmitted.
Never proxy your trafficNothing sits in a request path. Every check runs locally, in CI or on a laptop — no account, no upload.
Never write to your repositoryNo automatic pull requests, no config rewrites. Findings are annotations and exit codes.

More checks are coming.

Ebb is the one you can install today. The other four are in development — they are not installable, not purchasable, and not included in anything below.

ebb LLM deprecation scanner Available now Product page →
telltale OpenAPI telemetry coverage Complete
charter MCP capability drift scanner Complete
undertow Subprocessor change monitoring Complete
lading AI asset licence checker Complete

Pricing

Ebb runs free on your machine, forever. The hosted hub is a private pilot we set up by hand — there is no self-service billing, and nothing on this page can be bought today.

Open-source CLI

Free

Apache-2.0 · unlimited repositories

  • Unlimited repositories
  • Terminal, Markdown, JSON and SARIF output
  • GitHub Action and pull-request annotations
  • Runs locally without an account

Hosted hub Private pilot

Private pilot

Not self-service — we set each pilot up by hand

Shared history, policy, ownership and evidence when one repository becomes forty.

  • Scan history across repositories
  • Shared policies and baselines
  • Ownership and escalation
  • Expiring suppressions with named owners
  • Dated evidence exports

Expected launch pricing from €39/month for up to 10 repositories

Join the hosted pilot

Need more repositories or self-hosting? Tell us about your setup.