Evidence-grounded repository intelligence

Code intelligence that has to show its work. A deterministic scanner reads your repo and writes structured evidence — every downstream feature (AI audit, PR bot, MCP server, dashboard) has to cite that evidence, or it doesn't get to make the claim.

Install the Aletheore GitHub App — hosted PR review, dashboard, and AIRview docs on top of the same evidence engine.
Prefer the free local CLI? Keep reading below.

$ pipx install aletheore
$ aletheore scan .

Scanning /path/to/your/repo...
  → Detecting languages, frameworks, and build tools
  → Building module dependency graph (parsing source with tree-sitter)
  → Analyzing git history and ownership
  → Scanning working tree for secrets
  → Checking dependencies for known vulnerabilities (OSV.dev)
  → Mapping API endpoints
  → Done
✓ Scan complete
  Evidence written to /path/to/your/repo/.aletheore/air.json

No LLM call, no account, no network access beyond the vulnerability/license registry lookups (turn those off too for a fully offline run). That one command gets you a real dependency graph, secrets scan, git-history secret sweep, dependency-vulnerability/license check, and static API endpoint map — for Python, JavaScript/JSX, TypeScript/TSX, Go, Rust, Java, Kotlin, Ruby, PHP, C, C++, C#, and Swift.

Why

• Grounded, not vibes. Every AI-written claim (the audit report, PR review comments, the architecture wiki) is checked against the file:line it cites. A finding that can't be verified against real evidence gets dropped or flagged, not shipped silently.
• The free tier is actually free. scan, query, diff, the MCP server, and the local dashboard need no account and no API key. Nothing leaves your machine, apart from a crash report if the CLI itself crashes (on by default, one command to turn off; see Crash reporting).
• Bring your own model, or don't use one at all. audit works with six provider families (Claude, OpenAI, Google, Mistral, xAI, or a local Ollama model) — your key, your cost, your choice — or skip the LLM step entirely and just use the deterministic evidence.
• 1,600+ tests, real CI, and a GitHub Action that dogfoods itself on every PR to this repo.
• Benchmarked, not just claimed. aletheore-benchmarks is the public harness we test review quality against — real open-source PRs, blind LLM judging, and a published methodology, comparing Aletheore's evidence-grounded context against raw-diff and full-file-context baselines.

What's actually shipped

• aletheore scan — the deterministic scanner above. Safe to run in CI, on every commit.
• aletheore audit — scans, then has a coding-agent CLI or API provider write a full grounded markdown report, citing exact evidence fields throughout. Meant to be run by hand against your own repo — see src/README.md for why it isn't wired into CI.
• aletheore query / aletheore diff — answer a targeted question or compare two scans from existing evidence, no re-scan or LLM call needed.
• aletheore mcp — a stdio MCP server exposing 36 tools by default (37 with ALETHEORE_MCP_ALLOW=external enabled) (module/symbol/dependency lookups, ownership, clusters, dead code, hotspots, full-text and semantic search, scan and index triggers) so a coding agent can query your repo's structure directly instead of shelling out for every lookup; it re-scans in the background as files change unless started with --no-watch. aletheore mcp-install wires it into Claude Code, Cursor, VS Code, Kiro, Opencode, or Codex CLI automatically.
• aletheore tokens — measures how many tokens your coding agent re-reads on every turn and, if you choose, trims the built-in tools a project does not use (reversible, project-scoped, off by default). Every repo-wide, no-target tool (dependency usage, environment variables, error handling, ...) caps its result to a size budget by default — a result that already fits is untouched; an over-budget one keeps its shape, says what was left out, and the same tool takes section/offset/limit/filter to page through the rest losslessly.
• aletheore dashboard — a live local web UI: dependency graph, an Obsidian-style cluster graph, trend charts across scan history, and the MCP tool list.
• A GitHub Action (action.yml, on the Marketplace as "Aletheore") — scans a PR's base and head refs and posts a diff: new/resolved secrets, dependency vulnerabilities, and layer-convention violations, as a PR comment, inline annotations, and the run's Step Summary. CI only ever runs scan + diff — fast and deterministic, never the full agent-driven audit.

- uses: Aletheore/Aletheore@v0.7.2
  with:
    fail-on-new-secrets: true

Full command reference, MCP tool list, per-language import-resolution details, and configuration options: src/README.md.

Aletheore AIR (hosted GitHub App)

Everything above is the free, local-first CLI (Aletheore Community). Installing the Aletheore GitHub App adds a hosted layer on top of the same evidence — paid plans start at $29.99/mo for up to 3 team members (additional seats $6.99/mo each):

• Automated PR review — Flash reviews and managed audits comment directly on pull requests, scoped to the changed hunks, citing file:line evidence. Blast-radius checks trace a changed symbol to its real callers across the repo (or say plainly when no caller could be confirmed, instead of guessing).
• AIRview — an AI-generated, always-current architecture map of the repo, rebuilt from the same dependency-graph evidence scan produces.
• AI-generated Docs — per-symbol descriptions written straight from real source, drafted as PRs land and backfilled for a repo's existing public API, always marked as AI-generated rather than presented as hand-written.
• Production monitoring — live endpoint reachability/latency checks mapped back to the source handler that owns the route, with Slack/Teams alerts on state changes.
• Branch-protection checks and team seat management.

The GitHub App and dashboard code lives in github-app/; see its own README for deployment and operations details.

Repository layout

• src/ — the actual, working CLI code (see its README for everything above in detail).
• github-app/ — the hosted GitHub App: FastAPI server, RQ workers, migrations. See Aletheore AIR above for what it does.
• site/ — the marketing site (Next.js).
• docs/superpowers/ — design specs and implementation plans written during development.
• docs/operations/ — current operational baselines: incident response, data handling, SLOs, deployment verification, branch protection, support process.
• SECURITY.md — vulnerability reporting and response targets.

Related, separate repo: aletheore-benchmarks — the public PR-review benchmark harness and published results.

Licensing

Aletheore is open source under the GNU Affero General Public License v3.0 (AGPL-3.0). You can use, study, modify, and redistribute it, including at a company and for internal tooling, as long as you follow the AGPL. The part that matters most:

• If you modify Aletheore and convey that covered work, or provide it for network interaction in circumstances covered by AGPL section 13, follow the AGPL's corresponding-source and notice requirements for the covered work.
• Independent code and separate components may remain under their own licenses; whether a combination is a covered work depends on the AGPL and the facts of the distribution.
• Running the unmodified CLI or Action on your own code does not put your code under the AGPL.

If those terms don't fit, for example you want to embed Aletheore in a closed-source product or run a modified version as a service without publishing it, a commercial license is available. See COMMERCIAL-LICENSE.md, or email arihantkaul@outlook.com. The hosted, paid tier is Aletheore AIR.

Copyright (C) 2026 Arihant Kaul. See NOTICE.

Releases through 0.8.12 were Apache 2.0, and 0.8.13 through the version before this change were PolyForm Noncommercial 1.0.0. Copies you already received keep the license they came with.

If it's useful to you personally, consider sponsoring development — no accounts, no usage tracking, and nothing leaves your machine when you run it except an optional crash report (see above).