Jumbi

AI Readiness Assessment

Every gap,turned into a plan.

Jumbi runs guided AI readiness assessments, scores where you stand, and turns the gaps into a clear, prioritized action plan.

Start an assessmentSee what it checks

Free to start. No credit card.

Overall riskof 100 · lower is saferHigh risk · Developing
Security×0.35
1×15Clear
Security 15, clear.
Code quality×0.25
1×10Clear
Code quality 10, clear.
Dependencies×0.20
no package.jsonGap
Dependencies 40, a gap.
Test coverage×0.20
no test fileGap
Test coverage 70, a gap.
Overall

Overall score: 15 × 0.35 + 10 × 0.25 + 40 × 0.20 + 70 × 0.20 = 29.75 → 30

src/agents/reply.tsPastedScanning 3 / 12
  1. const apiKey = "sk-live-4f9a"Hardcoded API keyKEY
  2. ​
  3. export async function reply(ticket: any) {
  4. // TODO: implement retries
  5. console.log(ticket)
  6. try {
  7. return eval(ticket.macro)
  8. } catch (e) {}
  9. }
  10. // reply.test.ts
  11. it('expands a saved macro', async () =>
  12. expect(await reply(refund)).toBe(REFUND))
reply.test.tsis not in this paste
Apply a fix · the scan reruns0 of 5 applied

The scan

What the scan looks for.

Fifteen rules, the same ones every assessment runs, each aimed at something that makes AI-written code risky to ship. Every rule has a tier, and the tier decides how much a finding adds to the security and code quality scores.
  • High · 9 rulesEach finding +15 security · +10 code quality
  • Medium · 4 rulesEach finding +5 security · +5 code quality
  • Low · 2 rulesEach finding +2 code quality

01Secrets in code

Keys and passwords written into the source, where anyone with the repository can read them.

  • Hardcoded API keyHigh

    Flagged: const apiKey = "sk-live-4f9a"
    Passes: const apiKey = process.env.OPENAI_API_KEY

  • Hardcoded passwordHigh

    Flagged: db.connect({ password: "hunter2" })
    Passes: db.connect({ password: env.DB_PASSWORD })

02Dangerous calls

Calls that run text as code or write it straight into the page.

  • eval() callHigh

    Flagged: return eval(ticket.macro)
    Passes: return MACROS[ticket.macro] ?? ''

  • innerHTML assignmentHigh

    Flagged: el.innerHTML = reply.html
    Passes: el.textContent = reply.text

03Unfinished work

Markers that say the code is not done, or that no person has read it yet.

  • Unfinished "TODO: implement"High

    Flagged: throw new Error('TODO: implement refunds')
    Passes: return refunds.issue(order)

  • FIXME, HACK or XXX markerHigh

    Flagged: // FIXME: double send on retry
    Passes: await sendOnce(ticket.id, reply)

  • Marked as AI-generatedHigh

    Flagged: // AI-generated, not reviewed
    Passes: // Routes by ticket priority

  • TODO commentLow

    Flagged: // TODO: add a rate limit
    Passes: app.use(rateLimit({ max: 60 }))

04Silent failures

Errors nobody will hear about, and logging that was meant for a laptop.

  • Empty catch blockHigh

    Flagged: } catch (e) {}
    Passes: } catch (e) { logger.error(e) }

  • Error thrown without a messageLow

    Flagged: throw new Error()
    Passes: throw new Error('Ticket not found')

  • console.log left inHigh

    Flagged: console.log(ticket)
    Passes: logger.debug(ticket.id)

05Type and lint escapes

Places where the checks that catch mistakes were switched off.

  • The "any" typeMedium

    Flagged: function reply(ticket: any)
    Passes: function reply(ticket: Ticket)

  • Cast with "as any"Medium

    Flagged: const body = req.body as any
    Passes: const body = TicketSchema.parse(req.body)

  • @ts-ignoreMedium

    Flagged: send(ticket.id) // @ts-ignore
    Passes: send(String(ticket.id))

  • eslint-disableMedium

    Flagged: useEffect(load, []) // eslint-disable-line
    Passes: useEffect(load, [load])

06Two checks read the project, not the lines

Dependencies and test coverage are read from the files in the scan, not from patterns in them.

  • Test filesTest coverage

    Flagged: src/agents/reply.tsno test file · 70
    Passes: src/agents/reply.test.tstest file · 30

  • Package manifestDependencies

    Flagged: src/agents/reply.tsno package.json · 40

    A paste without a package.json reports Analysis requires package.json and keeps the category at 40.

The score

How the score is built.

Four categories, each a risk score from 0 to 100 where lower is safer. The overall weights them 35, 25, 20 and 20 percent and rounds the sum, and where it lands on the scale sets the risk level and the readiness label.

support-agent/

The dashed tick in each share marks 25. A category filled past it is a gap.

  • Security 35%88 × 0.35 = 30.8
  • Code quality 25%76 × 0.25 = 19
  • Dependencies 20%55 × 0.20 = 11
  • Test coverage 20%80 × 0.20 = 16

The four fills, side by side

76.8 → 77 Critical risk · Beginner readiness

  1. 0–25

    Low risk

    Advanced readiness

  2. 26–50

    Medium risk

    Intermediate readiness

  3. 51–75

    High risk

    Developing readiness

  4. 76–100

    Critical risk

    Beginner readiness

Overall score: 88 × 0.35 + 76 × 0.25 + 55 × 0.20 + 80 × 0.20 = 76.8 → 77

The plan

From gaps to a plan.

Any category above 25 is a gap, and gaps rank by the points they add to the overall. Each becomes steps rated by impact and effort, ordered highest impact first and then least effort, so the quick wins lead.

Support agent · 4 gaps by impact

  1. 01

    Securitycritical88 × 0.35 = 30.8 pts

    A live API key is committed and user text reaches eval().

    12
  2. 02

    Code qualitycritical76 × 0.25 = 19 pts

    An empty catch block swallows errors and debug logs remain.

    3
  3. 03

    Test coveragecritical80 × 0.20 = 16 pts

    The AI-generated agent paths have almost no tests.

    5
  4. 04

    Dependencieshigh55 × 0.20 = 11 pts

    Several packages are two major versions behind.

    4

Points are what a gap adds to the overall: its score times its weight. The bar runs to 35, the most one category can add.

The plan on impact and effort

5 steps · 1 quick win

  1. 1

    Rotate and vault the exposed OpenAI keyQuick win

    High impact · Low effort · closes the security gap

  2. 2

    Replace eval() in the macro expander

    High impact · Medium effort · closes the security gap

  3. 3

    Log the swallowed router errors

    Medium impact · Low effort · closes the code quality gap

  4. 4

    Upgrade the two lagging packages

    Medium impact · Medium effort · closes the dependencies gap

  5. 5

    Raise agent test coverage to 70% or more

    Medium impact · High effort · closes the test coverage gap

Read it from the top left: the highest impact first and, within the same impact, the least effort. That is the order the plan lists its steps in.

The report

A report your stakeholders can read.

Open any assessment as a clean report for the people who sign off on a launch: the overall risk and readiness in one paragraph, the scorecard with its math, the gaps by impact and the plan in order. Print it, or save it as a PDF from the print dialog.
  1. 01SummaryThe overall risk, the readiness label, the biggest gap and the size of the plan, in plain words.
  2. 02ScorecardEach category with its score, its weight and the points it adds, summed and rounded.
  3. 03Gaps by impactEvery category above 25, worth the points it adds to the overall.
  4. 04The planEvery step with its impact and effort, the quick wins marked.

Report export comes with Pro.

readiness-report · support-agent/
The report for the sample support agent: overall risk 77, critical risk and Beginner readiness, with 4 gaps and a 5-step plan.

Pricing

Assess free. Upgrade for the full plan.

Run assessments with a scorecard and basic gap analysis on the free plan. Pro adds unlimited assessments, full action plans, deep dives, trend tracking and report export. Teams that need single sign-on or self-hosting talk to us.

  • Free

    Assess your first project

    $0forever

    • Guided assessments
    • Readiness scorecard
    • Basic gap analysis
    • No credit card
    Start free

  • Pro

    Recommended

    For teams improving readiness

    $15per month

    • Unlimited assessments
    • Full action plans
    • Per-category deep dives
    • Trend tracking
    • Report export
    Start with Pro

  • Enterprise

    For organizations at scale

    Custom

    • Everything in Pro
    • Single sign-on
    • Self-host option
    • Dedicated support
    Talk to us

Questions

Asked and answered.

Anything else? Ask us directly.

What does Jumbi assess?

Jumbi assesses your project's readiness across four categories: security, code quality, dependencies, and test coverage. It produces an overall score and a per-category scorecard, plus a gap analysis and prioritized action plan.

Why is a lower score better?

Jumbi's scores are risk-oriented, so a lower score means lower risk and higher readiness. As you close gaps and improve, your overall risk score trends down, which is exactly what you want to see across re-assessments.

How does the action plan help me improve?

Jumbi turns the gaps it finds into a prioritized action plan, ranking each item by impact and effort. You can work top-down, fix the highest-leverage issues first, and re-assess to confirm your readiness is improving over time.

Is my code private?

Your assessments and findings are scoped to your account, encrypted at rest, and never used to train models. Enterprise customers can also self-host Jumbi entirely on their own infrastructure.

How much does Jumbi cost?

Jumbi is free forever for running assessments with a scorecard and basic gap analysis, with no credit card required. Pro is $15 per month for unlimited assessments, full action plans, per-category deep dives, trend tracking, benchmarks, and report export. Enterprise is custom-priced with SSO, a self-host option, and dedicated support.

How is the overall score calculated?

Each of the four categories gets a risk score from 0 to 100. The overall score weights security at 35 percent, code quality at 25, dependencies at 20 and test coverage at 20, then rounds to a whole number. Above 75 is critical risk, above 50 high, above 25 medium and 25 or below low, which Jumbi reads as Beginner, Developing, Intermediate and Advanced readiness.

What can I assess?

Paste code or upload files. Jumbi reads JavaScript, TypeScript, Python, Java, Go, Rust, Ruby, PHP, Vue, Svelte, SQL, shell scripts, stylesheets, HTML, Markdown and config files such as JSON and YAML. Connecting a GitHub repository is not available yet.

What counts as a gap?

Any category with a risk score above 25. Gaps are ranked by impact (each score times its weight), and the action plan orders its steps by impact and then by effort, so the quick wins come first.

Find the gapsbefore your users do.

Paste code or upload files and get a readiness score, a scorecard for every category, the gaps ranked and a plan to close them. Free to start, no credit card.

Start an assessmentTalk to us

As pasted

64High risk

Developing readiness

With the 5 fixes

25Low risk

Advanced readiness

The snippet at the top of this page, scored by the same rules before and after the fixes you can apply there.

Jumbi's glass dial on a dark stage, a white beam running into it and its needle lit in indigo