Static analysis and AI-assisted investigation for Microsoft Dynamics 365 Finance & Operations X++ source code. 109+ rules catch performance bottlenecks, DML anti-patterns, security vulnerabilities, transaction integrity issues, data flow defects, and code quality problems. A built-in AI assistant trained on your codebase helps investigate findings and reason about architecture.
KentōXPP understands X++ — its DML patterns, its CoC extension model, its metadata structure, and its unique performance characteristics.
Rules across seven categories targeting the patterns and anti-patterns specific to D365 F&O development.
Every file receives a weighted grade based on finding severity, giving teams a clear picture of code health.
Two-pass deep validation uses a full recursive descent parser to verify regex findings, suppressing false positives automatically.
Select-in-loop, insert-in-loop, missing set-based operations, unbounded queries, container operations in loops, display methods not cached, and other patterns that degrade runtime performance in production workloads. 29 rules.
Empty methods and loops, excessive nesting, overly long methods, swallowed exceptions, missing CoC next calls, deprecated API usage, overlayering detection, unreachable code, and structural complexity metrics. 23 rules.
Non-standard class prefixes, method naming violations, variable casing, extension and event handler class suffixes, EDT naming, and naming patterns that conflict with your organization's model conventions. 17 rules.
SQL injection via dynamic query construction, unparameterized WHERE values, hardcoded credentials, missing authorization checks, and insecure data handling patterns. 12 rules.
Buffers modified but never persisted, variables read before assignment, select-then-selectForUpdate race conditions, unreachable code after unconditional returns, redundant conditions, null reference risks, and infinite loop detection. 11 rules.
CacheLookup vs TableGroup mismatches, missing delete actions, EDT length validation, table index configurations, form data source issues, security privilege definitions, and menu item structural problems. 9 rules.
DML statements outside transaction scope, unbalanced ttsBegin/ttsCommit pairs, generic catch blocks inside tts scope, user dialogs holding database locks, retry statements without counters, and early returns inside transaction scope. 8 rules.
KentōXPP combines fast regex-based scanning with deep structural parsing for accuracy without compromise.
Connect to your Azure DevOps (TFVC or Git) or GitHub repository. KentōXPP fetches X++ source files and XML metadata — table definitions, form layouts, security configurations, EDTs, and enums. ISV and third-party packages are automatically identified and excluded using configurable patterns, ensuring analysis focuses on your code.
Source files are preprocessed — comments stripped, strings masked, class and method boundaries identified. A full recursive descent parser simultaneously builds a structural AST, extracting DML statement metadata (modifiers, WHERE clauses, JOINs, aggregates, field mappings). Each file is then run against enabled rules using both regex-based pattern matching and AST-powered structural analysis. XML metadata files are parsed and analyzed against metadata-specific rules. Findings are assigned severity and confidence levels, with file-type-aware severity adjustment based on impact tier classification.
Files with critical or high-severity findings are re-parsed using a full recursive descent X++ parser that extracts variables with scope tracking, method calls with receivers, and table field accesses with transactional context. Each finding is validated against this structural data — a selectAll() method call is distinguished from a select DML statement, a List.insert() from a table buffer .insert(), a UI control named "password" from a hardcoded credential. False positives are automatically suppressed with explanations.
Post-scan hooks record baselines, compute trend deltas against previous scans, and profile table DML access patterns. Findings are surfaced in a web dashboard with per-file grades, severity breakdowns, trend tracking across scans, and exportable reports. User feedback on findings drives adaptive severity adjustments over time.
KentōXPP includes a built-in AI assistant that connects to your choice of inference backend — no data leaves your network unless you choose a cloud provider.
Connect to Ollama, MLX (Apple Silicon native), Azure OpenAI, OpenAI, Anthropic, or GitHub Models. Switch providers at runtime via the Settings UI. Local inference keeps your source code entirely on-premises.
Train a custom LoRA adapter on your own X++ codebase. Extraction scripts generate training data from your scan results, class hierarchies, and call graphs. Serve the fine-tuned model locally via MLX for domain-specific responses.
The AI assistant can fetch files from your repository, search your codebase, query Azure DevOps work items, trace call graph references, and look up class/table metadata via MCP — grounding every response in your actual code.
Ask questions from any page and the assistant automatically receives relevant context — scan findings on a file detail page, class relationships on the baseline page, branch differences on the delta page. AI-powered rule generation creates new analysis rules from natural language descriptions.
KentōXPP goes beyond rule-based scanning with structural analysis, dead code detection, and cross-branch comparison.
Pre-parsed class definitions, method signatures, variable scopes, and caller-to-callee call graph edges. Browse class hierarchies, visualize dependency relationships in an interactive graph, and track table field access patterns across the codebase.
Multi-layer dead code detection combining static analysis, metadata analysis, AOT reference scanning, call graph traversal, and runtime verification. A weighted confidence algorithm accounts for indirect references and reflection. ISV-aware — understands third-party integration patterns.
Compare TFVC branches to identify file differences, unique files, and code changes. Side-by-side syntax-highlighted diff viewer with X++ gutter markers shows exactly what changed between any two branches.
Azure DevOps pipeline analysis and compilation error parsing. Identify build failures, track error patterns across builds, and correlate compilation issues with code changes.
Discovers parameter dependencies across D365 layers — maps which parameter tables, number sequences, and feature flags your custom code relies on and validates their configuration state.
Maps external system connections to D365 — identifies OData endpoints, DMF integrations, custom services, and third-party API calls across your codebase.
KentōXPP learns from your codebase and your feedback to improve analysis accuracy over time.
Learns DML access patterns from your code and classifies tables into usage tiers — configuration, reference, transactional, low-volume. Context-aware rules use these profiles to adjust finding severity based on actual table usage.
Auto-detects naming conventions from your codebase — class prefixes, method styles, table naming patterns, EDT patterns. Provides a data-driven view of your team's actual conventions rather than imposing assumptions.
Scan-over-scan finding deltas with regression and improvement tracking. See which rules are trending up or down, identify files that are improving or deteriorating, and track code quality over time.
User ratings on individual findings feed back into confidence scoring. When developers mark findings as helpful or dismiss them as false positives, KentōXPP adjusts future severity to match your team's priorities.
KentōXPP connects to your D365 environment metadata via the Model Context Protocol (MCP) to enrich analysis with runtime context.
Browse your Application Object Tree directly from the dashboard — search classes, tables, forms, enums, and EDTs. View inheritance hierarchies, table field definitions, form data sources, and extension chains without opening Visual Studio.
When MCP metadata is available, rules can verify table index definitions, check field counts on queried tables, validate security privilege assignments, and assess the actual impact of findings against the live object model.
Every team has different conventions, risk tolerance, and focus areas. KentōXPP adapts to yours.
Define organization-specific rules using regex patterns with configurable severity, category, file type targeting, and reference documentation links. Rules are managed through the web dashboard and applied automatically to every scan.
Create named rule configurations for different contexts — a strict preset for production release gates, a relaxed preset for early development, a security-focused preset for compliance audits. Switch between presets without reconfiguring individual rules.
Configure your organization's model prefix, accepted class prefixes, and naming patterns. KentōXPP validates that classes, methods, and variables follow your conventions rather than imposing a fixed standard.
Define which packages belong to your organization using pattern matching. Owned packages receive higher confidence scoring. ISV exclusion patterns are configurable, ensuring third-party vendor code is filtered without accidentally excluding your customizations that share a prefix.
Self-hosted Next.js application with guided setup wizard, repository management, scan history, trend visualization, and rule administration. Runs locally or on your infrastructure — your source code never leaves your network.
Install via npm and integrate into your build pipelines. Run scans from the command line, enforce quality gates based on finding thresholds, and generate reports as part of your automated delivery process.
Questions about KentōXPP or interested in a demo?
Get in Touch