Aletheore

Evidence-grounded repository intelligence

Code intelligence that has to show its work. A deterministic scanner reads your repo and writes structured evidence — every downstream feature (AI audit, PR bot, MCP server, dashboard) has to cite that evidence, or it doesn't get to make the claim.

$ pipx install aletheore
$ aletheore scan .

Scanning /path/to/your/repo...
  → Detecting languages, frameworks, and build tools
  → Building module dependency graph (parsing source with tree-sitter)
  → Analyzing git history and ownership
  → Scanning working tree for secrets
  → Checking dependencies for known vulnerabilities (OSV.dev)
  → Mapping API endpoints
  → Done
✓ Scan complete
  Evidence written to /path/to/your/repo/.aletheore/air.json

No LLM call, no account, no network access beyond the vulnerability/license registry lookups
(turn those off too for a fully offline run). That one command gets you a real dependency
graph, secrets scan, git-history secret sweep, dependency-vulnerability/license check, and
static API endpoint map — for Python, JavaScript/JSX, TypeScript/TSX, Go, Rust, Java, Ruby,
PHP, C, C++, and C#.

Why

• Grounded, not vibes. Every AI-written claim (the audit report, PR review comments, the
  architecture wiki) is checked against the file:line it cites. A finding that can't be
  verified against real evidence gets dropped or flagged, not shipped silently.
• The free tier is actually free. scan, query, diff, the MCP server, and the local
  dashboard need no account and no API key. Nothing leaves your machine.
• Bring your own model, or don't use one at all. audit works with six provider families
  (Claude, OpenAI, Google, Mistral, xAI, or a local Ollama model) — your key, your cost, your
  choice — or skip the LLM step entirely and just use the deterministic evidence.
• 1,600+ tests, real CI, and a GitHub Action that dogfoods itself on every PR to this repo.
• Benchmarked, not just claimed. aletheore-benchmarks
  is the public harness we test review quality against — real open-source PRs, blind LLM
  judging, and a published methodology, comparing Aletheore's evidence-grounded context
  against raw-diff and full-file-context baselines.

What's actually shipped

• aletheore scan — the deterministic scanner above. Safe to run in CI, on every commit.
• aletheore audit — scans, then has a coding-agent CLI or API provider write a full
  grounded markdown report, citing exact evidence fields throughout. Meant to be run by hand
  against your own repo — see src/README.md for why it isn't wired into CI.
• aletheore query / aletheore diff — answer a targeted question or compare two
  scans from existing evidence, no re-scan or LLM call needed.
• aletheore mcp — a stdio MCP server exposing 30 tools by default (31 with
  ALETHEORE_MCP_ALLOW=external enabled) (module/symbol/dependency lookups,
  ownership, clusters, dead code, hotspots, full-text and semantic search, scan and index
  triggers) so a coding agent can query your repo's structure directly instead of shelling out
  or re-reading files on every lookup. aletheore mcp-install wires it into Claude Code,
  Cursor, VS Code, Kiro, Opencode, or Codex CLI automatically.
• aletheore dashboard — a live local web UI: dependency graph, an Obsidian-style cluster
  graph, trend charts across scan history, and the MCP tool list.
• A GitHub Action (action.yml, on the Marketplace as "Aletheore") — scans a PR's base and
  head refs and posts a diff: new/resolved secrets, dependency vulnerabilities, and
  layer-convention violations, as a PR comment, inline annotations, and the run's Step Summary.
  CI only ever runs scan + diff — fast and deterministic, never the full agent-driven
  audit.

- uses: Aletheore/[email protected]
  with:
    fail-on-new-secrets: true

Full command reference, MCP tool list, per-language import-resolution details, and
configuration options: src/README.md.

Aletheore AIR (hosted GitHub App)

Everything above is the free, local-first CLI (Aletheore Community). Installing the
Aletheore GitHub App adds a hosted layer on top of the same
evidence — paid plans start at $29.99/mo for up to 3 team members (additional seats $6.99/mo each):

• Automated PR review — Flash reviews and managed audits comment directly on pull
  requests, scoped to the changed hunks, citing file:line evidence. Blast-radius checks
  trace a changed symbol to its real callers across the repo (or say plainly when no
  caller could be confirmed, instead of guessing).
• AIRview — an AI-generated, always-current architecture map of the repo, rebuilt
  from the same dependency-graph evidence scan produces.
• AI-generated Docs — per-symbol descriptions written straight from real source,
  drafted as PRs land and backfilled for a repo's existing public API, always marked
  as AI-generated rather than presented as hand-written.
• Production monitoring — live endpoint reachability/latency checks mapped back to
  the source handler that owns the route, with Slack/Teams alerts on state changes.
• Branch-protection checks and team seat management.

The GitHub App and dashboard code lives in github-app/; see its own
README for deployment and operations details.

Repository layout

• src/ — the actual, working CLI code (see its README for everything above in detail).
• github-app/ — the hosted GitHub App: FastAPI server, RQ workers, migrations. See
  Aletheore AIR above for what it does.
• website/ — the marketing site and live demo.
• docs/superpowers/ — design specs and implementation plans written during development.
• docs/operations/ — current operational baselines: incident response, data handling, SLOs,
  deployment verification, branch protection, support process.
• SECURITY.md — vulnerability reporting and response targets.

Related, separate repo: aletheore-benchmarks —
the public PR-review benchmark harness and published results.

Licensing

Aletheore is licensed under the
PolyForm Noncommercial License 1.0.0, not an OSI-approved open-source license.
It's free for individuals: personal use, research, hobby projects, and evaluation. Any use
for or within a company or other organization — including internal tooling at a company you
work for — is a commercial use and requires a separate commercial license. Reach out at
[email protected] for commercial licensing, or see
Aletheore AIR for the hosted, paid tier.

If it's useful to you personally, consider
sponsoring development — no accounts, no tracking,
nothing leaves your machine when you run it.