Aletheore

Evidence-grounded repository intelligence

Code intelligence that has to show its work. A deterministic scanner reads your repo and writes structured evidence — every downstream feature (AI audit, PR bot, MCP server, dashboard) has to cite that evidence, or it doesn't get to make the claim.

Install the Aletheore GitHub App — hosted PR review, dashboard, and AIRview docs on top of the same evidence engine. Prefer the free local CLI? Keep reading below.

$ pipx install aletheore
$ aletheore scan .

Scanning /path/to/your/repo...
  → Detecting languages, frameworks, and build tools
  → Building module dependency graph (parsing source with tree-sitter)
  → Analyzing git history and ownership
  → Scanning working tree for secrets
  → Checking dependencies for known vulnerabilities (OSV.dev)
  → Mapping API endpoints
  → Done
✓ Scan complete
  Evidence written to /path/to/your/repo/.aletheore/air.json

No LLM call, no account, no network access beyond the vulnerability/license registry lookups (turn those off too for a fully offline run). That one command gets you a real dependency graph, secrets scan, git-history secret sweep, dependency-vulnerability/license check, and static API endpoint map — for Python, JavaScript/JSX, TypeScript/TSX, Go, Rust, Java, Kotlin, Ruby, PHP, C, C++, C#, and Swift.

Why

• Grounded, not vibes. Every AI-written claim (the audit report, PR review comments, the architecture wiki) is checked against the file:line it cites. A finding that can't be verified against real evidence gets dropped or flagged, not shipped silently.
• The free tier is actually free. scan, query, diff, the MCP server, and the local dashboard need no account and no API key. Nothing leaves your machine, apart from a crash report if the CLI itself crashes (on by default, one command to turn off; see Crash reporting).
• Bring your own model, or don't use one at all. audit works with six provider families (Claude, OpenAI, Google, Mistral, xAI, or a local Ollama model) — your key, your cost, your choice — or skip the LLM step entirely and just use the deterministic evidence.
• 1,600+ tests, real CI, and a GitHub Action that dogfoods itself on every PR to this repo.
• Benchmarked, not just claimed. aletheore-benchmarks is the public harness we test review quality against — real open-source PRs, blind LLM judging, and a published methodology, comparing Aletheore's evidence-grounded context against raw-diff and full-file-context baselines.

What's actually shipped