Open source (AGPL-3.0) evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.

Aletheore – Evidence‑Grounded Repository Intelligence

What it is – A Python‑based CLI (and optional hosted GitHub App) that scans a code repository, builds a deterministic evidence store, and lets AI agents or humans query that evidence for audits, PR reviews, security checks, and architecture docs. All findings are tied to exact file:line locations, so any AI‑generated claim can be verified.

Core capabilities

Feature	What it does	Why it matters
`aletheore scan`	Parses source (Python, JS/TS, Go, Rust, Java, Kotlin, Ruby, PHP, C/C++, C#, Swift) with tree‑sitter, builds a module‑dependency graph, extracts git history, runs a secret‑scan, checks OSV.dev for vulnerable dependencies, and maps API endpoints.	Gives a single, reproducible JSON (`air.json`) that serves as the factual basis for everything else.
`aletheore audit`	Runs `scan` then feeds the evidence to a coding‑agent (Claude, OpenAI, Google, Mistral, xAI, or local Ollama) to produce a markdown audit report that cites the underlying evidence.	Provides a human‑readable review that can be posted on PRs while remaining traceable.
`aletheore query` / `diff`	Answer ad‑hoc questions or compare two scans without re‑scanning or calling an LLM.	Fast, deterministic look‑ups for CI pipelines or local debugging.
`aletheore mcp`	Starts a local MCP (Multi‑Component Protocol) server exposing ~35 built‑in tools (symbol lookup, ownership, dead‑code detection, semantic search, etc.) that coding agents can query via stdin/stdout.	Lets external AI assistants work against a pre‑computed index instead of repeatedly reading files.
`aletheore dashboard`	A live web UI showing the dependency graph, cluster view, scan‑history trends, and available MCP tools.	Visual insight into repo health and evolution.
GitHub Action	Runs `scan` + `diff` on every PR, posting comments/annotations about new secrets, vulnerable deps, and convention violations.	Enforces evidence‑grounded checks automatically in CI.
Hosted GitHub App (AIR)	Paid SaaS layer that adds automated PR reviews, AI‑generated docs, architecture maps, and endpoint monitoring, all backed by the same evidence store.	Gives teams a turnkey, hosted solution with billing and seat management.

Typical workflow

Local scan – aletheore scan . → creates .aletheore/air.json.
Ad‑hoc query – aletheore query "Which functions are dead code?".
Full audit (optional LLM) – aletheore audit → markdown report with citations.
CI integration – Add the GitHub Action to automatically surface new secrets or vulnerable deps on PRs.
Optional hosted app – Install the Aletheore GitHub App for automated PR reviews and AI‑generated docs.

Installation & quick start

# Install in an isolated environment
pipx install aletheore   # or: pip install aletheore

# Run a scan on the current repository
aletheore scan .

# View the generated evidence
cat .aletheore/air.json

The tool works offline; the only network calls are optional vulnerability/license look‑ups (which can be disabled).

Licensing & usage

License – PolyForm Non‑commercial License 1.0.0. Free for personal, research, or hobby use. Commercial use (including internal tooling at a company) requires a paid license.
Commercial tier – Hosted GitHub App starts at $29.99 / month for up to 3 users; additional seats $6.99 / month.
Sponsorship – Individual contributors can sponsor the author via GitHub Sponsors.

Who might benefit?

Individual developers who want deterministic repo analysis without sending code to an external service.
Teams looking for AI‑assisted PR reviews that are auditable and traceable.
Security engineers needing secret‑leak detection and vulnerability mapping baked into CI.
Tool builders who need a fast, local knowledge base (via the MCP server) for custom coding agents.

Aletheore/Aletheore