Skip to content
Norveth

Work

What we've built, and what it measured

Our own products, kits and R&D, not client projects. Every number comes from the project's own measurements, and demos are labelled as demos. Client work will appear here, with permission, once it exists.

How a scan runs1. Website URL, GitHub repo or ZIP 2. Collect: headless Chromium via Playwright, SSRF blocklist on the crawler 3. Normalise: one shape for every source 4. ~20 checkers in parallel: security, TLS, deps, quality, perf, SEO, a11y, architecture 5. Knowledge graph: every finding linked to its evidence 6. Deterministic report: optional LLM rewrites prose onlyWebsite URL, GitHub repo or ZIPCollectheadless Chromium via Playwright,SSRF blocklist on the crawlerNormaliseone shape for every source~20 checkers in parallelsecurityTLSdepsqualityperfSEOa11yarchitectureKnowledge graphevery finding linked to its evidenceDeterministic reportoptional LLM rewrites prose only
How a scan runs
Our product

Norveth audit engine

Point it at a website, a GitHub repository or a ZIP and it reports what's insecure, slow, broken or invisible to Google, from what a real browser actually receives.

The problem
Site owners can't see what their site really sends to a visitor's browser. Scanners bury them in noise, and AI-written audits invent findings.
What we built
A Python pipeline that crawls in headless Chromium, runs about 20 specialised checkers in parallel, builds a knowledge graph and writes its report deterministically.
  • ~20checkers running in parallel on every scan
  • 8 · 24 · 2dependencies · findings · recommendations on a verified production scan of expressjs/cors
  • 0language models needed to produce a report
Read the case study: Norveth audit engine
From registry to catalogue1. Registries: PyPI, npm, crates.io, Hugging Face, VS Code, MCP, n8n, … 2. ~40 connectors, one interface: timeouts, ETag cache, backoff scheduling 3. Immutable raw store: version hash: unchanged means no new row 4. Extract + score: deterministic; stars deliberately ignored 5. Classify: confidence ≥ 0.8 → catalogue below → human review queue 6. Deduplicated catalogue: indexed · analysed · enriched · auditedRegistriesPyPInpmcrates.ioHugging FaceVS CodeMCPn8n…~40 connectors, one interfacetimeouts, ETag cache, backoff schedulingImmutable raw storeversion hash: unchanged means no new rowExtract + scoredeterministic; stars deliberately ignoredClassifyconfidence ≥ 0.8 → cataloguebelow → human review queueDeduplicated catalogueindexed · analysed · enriched · audited
From registry to catalogue
Our product · in development

Yaltan

Pulls AI tools, models, datasets, MCP servers and plugins from dozens of registries into one deduplicated catalogue, so people can search by the problem they have.

The problem
AI capabilities are scattered across dozens of registries that each describe things differently, and directory sites routinely pad their counts.
What we built
About 40 source connectors on one interface feeding an immutable raw store, deterministic extraction and scoring, a confidence-gated classifier and cross-source deduplication.
  • 103,431real, deduplicated entries indexed (29 July 2026)
  • ~40source connectors
  • 0entries audited so far. We say so.
Read the case study: Yaltan
Demo clinic site on a phone: headline, WhatsApp booking button and call button.
Demo coaching centre site on a phone with a demo-class call to action.
Demo café site on a phone with serif headings and a reserve-a-table button.
Demo SaaS landing page on a phone, dark theme, with a free-trial button.

Clinic, coaching, café and SaaS demo presets, on a phone

Our kit · demo sites

One-page business website kit

A config-driven static site kit: one file describes the business, one command builds a fast, findable one-page site with WhatsApp and call buttons.

DemoDemo presets. The businesses, numbers and photos shown are placeholders, not clients.

The problem
A clinic, coaching centre or café needs a site that loads fast on a mid-range phone, turns visitors into WhatsApp messages and calls, and shows up properly on Google, in 48 hours.
What we built
An Astro kit driven by one config file, with four presets, build-time checks for placeholder content, local-business structured data and a map that loads only when tapped.
  • 100 × 4Lighthouse mobile: performance, accessibility, best practices, SEO
  • 4presets: clinic, coaching, café, SaaS
  • ~90–130 KBwhole built site per preset, placeholder images included
Read the case study: One-page business website kit

Smile Care Dental

Demo business · sample config

  1. Hi

  2. Hello Priya! 👋 Welcome to Smile Care Dental. How can we help you today? Tap Menu below.

    • Services & prices
    • Book appointment
    • FAQs
    • Hours & location
    • Request a callback
    • Talk to a person

  3. do you take upi?

  4. UPI, cards and cash are all accepted at the clinic.

    More questionsMain menu
Demo. Output of the kit's simulator on its sample configuration; placeholder business and prices. Button taps are shown as the customer's messages.
Our kit · demo conversation

WhatsApp assistant kit

A WhatsApp bot for a small business: prices, FAQs, bookings, callbacks and a hand-over to a person, with every lead saved to a Google Sheet the owner owns.

DemoDemo conversation. “Smile Care Dental” is the kit's sample configuration: placeholder business, prices and numbers.

The problem
Small businesses answer the same WhatsApp questions all day and lose enquiries that arrive after hours.
What we built
A conversation engine on Cloudflare Workers with signed webhooks, bookings checked against a Google Sheet under a lock, and an optional AI mode that can't make up a price.
  • 66 / 66automated tests passing (re-run 2026-09-24)
  • 401returned to a forged webhook signature in the simulator
  • 3greeting languages: English, Telugu, Hindi
Read the case study: WhatsApp assistant kit
One program, five backends1. program.unfish 2. Lexer → parser → type check: gradual types, four tiers 3. Five backends: interpreter, stack VM, register VM, C99, WASM 4. Compare outputs: byte-identical, same exit codeprogram.unfishLexer → parser → type checkgradual types, four tiersFive backendsinterpreterstack VMregister VMC99WASMCompare outputsbyte-identical, same exit code
One program, five backends
Internal R&D

Unfish

A programming language written in C99 with no dependencies, running on five backends that must produce byte-identical output.

The problem
Five ways to run the same program (an interpreter, two virtual machines, native code and WebAssembly) are only trustworthy if they can't drift apart.
What we built
A lexer, parser and gradual type checker feeding a tree-walking interpreter, a stack VM, a register VM, a C99 compiler and a WebAssembly backend, held together by a differential test suite.
  • 91 / 91differential test programs with identical output (re-run 2026-09-24)
  • 64of them checked across all five backends
  • 0external dependencies
Read the case study: Unfish

Client reviews

None yet. Norveth is new, and we won't make any up. First 5 clients get 30% off in exchange for a short testimonial on this website.

Claim a first-5 slotOur services
Email us: hello@norveth.app