Aletheore is an evidence-grounded repository intelligence tool that deterministically scans codebases to produce structured evidence. This evidence serves as the verifiable basis for all downstream features, including AI audits, PR reviews, and various developer dashboards, ensuring claims are always traceable and accurate.

Is Aletheore open source?

Yes, licensed under NOASSERTION.

Aletheore: Evidence-grounded repository intelligence…

Features

01Deterministic code scanning: Scans multiple languages (Python, JS/TS, Go, Rust, Java, Kotlin, Ruby, PHP, C, C++, C#, Swift) for dependencies, secrets, vulnerabilities, and API endpoints.

02Evidence-grounded audit reports: Generates full markdown reports with exact evidence citations, supporting various LLM providers or operating without an LLM.

03Multi-Codebase Protocol (MCP) server: Exposes over 30 tools for coding agents to directly query repository structure, dependencies, ownership, and more.

04Local web dashboard: Offers a live local UI with dependency graphs, cluster graphs, and trend charts across scan history.

05GitHub Action integration: Automates PR reviews for new/resolved secrets, dependency vulnerabilities, and layer-convention violations, posting feedback as comments and annotations.

Compatibility

Python

Runtime

Verified via docs

JavaScript/JSX

Language

Verified via docs

TypeScript/TSX

Language

Verified via docs

Language

Verified via docs

Rust

Language

Verified via docs

Java

Language

Verified via docs

Quick start

$ pipx install aletheore

Use cases

↳Ensuring verifiable AI-generated content: Guarantees that AI-written claims in audits, PR reviews, or documentation are grounded in verifiable code evidence.

↳Automated security and vulnerability scanning in CI/CD: Integrate fast, deterministic scans into CI/CD pipelines to catch secrets, vulnerabilities, and dependency issues early.

↳Enhancing developer productivity: Provides local-first tools for detailed repository analysis, targeted queries, and code insight visualization without external accounts or network access.

↳Automated pull request quality and compliance checks: Automatically review PRs for changes impacting security, architecture, and compliance with immediate, evidence-backed feedback.

↳Generating dynamic architecture maps and API documentation: Creates always-current architecture maps and per-symbol descriptions directly from source code, powered by evidence.