ailinter

AI Code. Human Standards.

The open-source safety visor for AI-assisted development. Scans code quality, secrets, and vulnerabilities before and after every AI edit — directly in your editor.

Created by Ivan Bernikov · ailinter.dev

What It Does

ailinter gives your AI coding assistant a safety checklist. Before the AI writes a single line — and after — it evaluates the file and tells the AI whether to Go Ahead, Proceed with Care, or Stop & Refactor.

Quick Start

# macOS (Homebrew)
brew install ailinter/ailinter/ailinter

# Go install
go install github.com/ailinter/ailinter/cmd/ailinter@latest

Or download pre-built binaries from GitHub Releases.

# Scan a file
ailinter check src/main.go

# Interactive setup (configures AI agents, git hooks, VS Code)
ailinter init

# Non-interactive: configure specific agent
ailinter init --agent claude --vscode --hook

# Start MCP server
ailinter mcp

Add to Your AI Assistant

One command setup:

ailinter init --agent all

Creates MCP configs for OpenCode, Claude Code, Cursor, and GitHub Copilot — plus agent instructions, sub-agent definitions, skill files, and optional git hooks and VS Code integration.

Manual MCP config:

{
  "mcpServers": {
    "ailinter": {
      "command": "ailinter",
      "args": ["mcp"]
    }
  }
}

See the Setup Guide for all options, interactive mode, and agent-specific configurations.

The Quality Score

Every file gets a 0–100 score that tells AI assistants whether it's safe to modify:

Vulnerability Tiers

Every file also gets a vulnerability classification:

Why ailinter?

MCP Tools (7)

Supported Languages

13 languages with full detector coverage for code quality. Vulnerability patterns target Python, Go, JavaScript/TypeScript, Java, C#, PHP.

Config formats also scanned: .env, Dockerfile, Makefile, .gitignore, .yml, .toml, .json, .xml, .html, .css, .sql.

Code Quality Detectors (20)

Plus line-level AI prompts and severity classification (warning/alert/critical) on every finding.

Vulnerability Patterns (58)

6 categories across Python, Go, JS/TS, Java, C#, PHP:

Every finding includes a human-readable description, line/column location, severity, and a reminder with the fix.

Secret Detection Rules

269 betterleaks rules + 150 gitleaks fallback = 419 total rules across 100+ providers:

Secrets are redacted in MCP output — AI assistants never see the full secret value.

Known Limitation: Concatenated Secrets

Secret scanning operates on a per-line/per-value basis using regex patterns. Secrets that are split across multiple variables and concatenated at runtime (e.g., pk1 = "sk_live_" + pk2 = "ABC123") are not detected. This is an inherent limitation of static regex-based scanning (shared by gitleaks, trufflehog, and all similar tools).

To mitigate: prefer reading credentials from environment variables or secret management systems rather than splitting secret values across variables.

CLI

ailinter check — Analyze files

ailinter check src/main.go               # Single file (auto format)
ailinter check .                          # Directory scan
ailinter check --format json app.py       # JSON output
ailinter check --format markdown app.py   # LLM-friendly table output
ailinter check --format problems app.py   # GCC-style (IDE problem matchers)
ailinter check --no-secrets app.py        # Skip secrets (safe for AI context)
ailinter check --no-vulnerabilities app.py # Skip vulnerability scanning
ailinter check --secrets-only app.py      # Secrets only
ailinter check --vulnerabilities-only app.py # Vulnerabilities only
ailinter check --lang python script.py    # Force language detection
ailinter check --no-gitignore .           # Don't respect .gitignore patterns

ailinter init — Setup project

ailinter init                             # Interactive setup (TTY)
ailinter init --agent opencode            # OpenCode subagent + skill + MCP
ailinter init --agent claude              # Claude Code CLAUDE.md + MCP
ailinter init --agent cursor              # Cursor rules + MCP
ailinter init --agent copilot             # GitHub Copilot instructions
ailinter init --agent all                 # All of the above
ailinter init --vscode                    # .vscode/tasks.json + settings + extensions
ailinter init --hook                      # .githooks/pre-commit
ailinter init --profile strict            # Strict threshold profile
ailinter init --agent all --vscode --hook # Everything at once

See the Setup Guide for the full interactive flow and all generated files.

Other commands

ailinter mcp                              # Start MCP server on stdio
ailinter rules list                       # List all threshold defaults
ailinter rules list --lang python         # Filter by language

Benchmarks

Comprehensive 7-tool comparison across 11 controlled test fixtures (24 known secrets in 7 languages) and 3 clean open-source repos (Express, React, NestJS — 106 files). All tools run with default configurations; no custom rule tuning.

Key findings:

• 100% recall parity with gitleaks on all 24 controlled fixtures — both tools use the same detection engine with identical results
• Zero false positives across 106 clean files — one of only 3 tools (ailinter, gitleaks, betterleaks) to achieve this
• 203+ combined patterns — 150 secret detection rules + 58 vulnerability patterns = 203% more coverage than gitleaks alone
• Fastest unified scan — ailinter completes in 347ms while also running code quality analysis and vulnerability detection in the same pass
• Only unified tool — combines code quality (20 detectors), secret scanning (150+ rules), vulnerability analysis (58 patterns), AI refactoring guidance (16 patterns), and MCP server (7 tools) in a single lightweight MIT-licensed binary

Methodology: Apple Silicon (arm64), Go 1.26, gitleaks v8.30.1, betterleaks dev (main), trufflehog v3.95.3, detect-secrets v1.5.0, semgrep v1.157.0. Speed is wall-clock time including process startup. See Full Benchmark Report.

Architecture

cmd/ailinter/           # CLI entry point
internal/
├── analyzer/           # Orchestrator + scoring engine
├── cli/                # CLI commands (check, mcp, init)
├── config/             # JSON config + .ailinter.toml parser
├── mcp/                # MCP server + 7 tool handlers
├── parser/             # 20 code smell detectors
├── refactoring/        # 16 embedded refactoring patterns
├── secrets/            # betterleaks 269-rule config + gitleaks wrapper
├── telemetry/          # Usage and performance metrics
└── vulnerability/      # 58 vulnerability patterns, 6 categories

Stack: Go · mcp-go · betterleaks · gitleaks · cobra · MIT

Build: make build → 30 MB binary, zero runtime dependencies. Targets: darwin, linux, windows (amd64 + arm64).

Development

make build       # Build to bin/ailinter
make test        # Run tests
make test-cover  # Tests with coverage (85.3%)
make lint        # go vet
make fmt         # Go fmt
make release     # Cross-platform binaries

Community

• Website: ailinter.dev
• Issues: github.com/ailinter/ailinter/issues
• Contributing: CONTRIBUTING.md
• Security: SECURITY.md
• Changelog: CHANGELOG.md

License

MIT — built on open source: gitleaks (MIT), betterleaks (MIT), mcp-go (MIT), cobra (Apache-2.0).

Code smell definitions adapted from Samman Coaching Reference by Emily Bache, CC BY-SA 4.0.