Can you audit a MERN codebase written by another agency?

Yes. Auditing codebases written by other agencies or in-house teams is a common use case. We approach it without assumption about quality and report what we find. The NDA covers all findings. The goal is a useful written report that helps your team, not a performance review of the previous agency.