Evidence-driven code intelligence
Aletheore reviews, audits, and monitors repositories with every finding traced back to source evidence: file, line, symbol, owner, commit, dependency, and risk.
Every alert, review, audit, and query resolves back to:
Why it is different
Aletheore starts with deterministic repository evidence, then lets AI reason only over what the scanner can prove. The result is friendlier than raw static analysis and more trustworthy than a generic AI summary.
What it covers
Run locally with the CLI, install as a GitHub App, or give coding agents a smaller evidence context through MCP.
Automatic PR comments and Flash reviews on every push, independently re-checked by a second model on AIR before you see them, plus managed audits and branch-protection checks that cite the changed file and line.
Architecture clusters, dependency graphs, hotspots, owners, dead code, and AIRview — auto-generated architecture maps — from the same canonical evidence.
Secrets, vulnerable packages, licenses, infrastructure, database usage, and AI usage are detected before an audit is written.
Source-mapped endpoint health checks alert when a route breaks and point back to the handler that owns it.
Docs
Every team says "we'll document it later," and later never comes - the code always outruns the wiki. Aletheore AIR writes the docs instead: grounded, per-symbol descriptions generated straight from your real source, kept current automatically, with zero engineer hours spent typing a docstring nobody wanted to write. Export the whole set as a single Markdown file whenever you need it outside the dashboard.
How Docs stays honest
Same evidence-grounded discipline as every other Aletheore surface - AI only describes what the scanner can prove exists.
Every push to an open pull request, Flash drafts a description for any public symbol that's still missing one - batched per changed file, so docs never fall behind the code.
The moment you connect a repo, Pro runs a full first pass across everything already public, so you're not starting from a blank docs page.
Every AI-touched description is grounded in the real source snippet and carries an explicit AI-generated or AI-polished marker - never silently presented as something a developer wrote.
Progress is saved symbol by symbol, so one failing file never costs the ones that already succeeded. A 48-hour sweep automatically finishes any repo with real commit activity since its last pass.
How teams use it
Tree-sitter and git history produce air.json and air.toon. No LLM in the scan path.
Query architecture, owners, dependencies, endpoints, secrets, hotspots, and semantic search from one evidence file.
The GitHub App comments on PRs, gates new secrets, and can run managed audits or Flash reviews on paid plans.
Live endpoint checks alert on outages and latency regressions with source handler context.
Installable today on any GitHub account or organization you administer - the public Marketplace listing is still under GitHub's review, so this direct link is the way to find it for now.
Three real public repositories, actually scanned by aletheore scan at pinned commits. The numbers below are read directly from that output. Read the full writeup, findings and all →
That is what Aletheore finds on its own. For how it measures up against a real competitor - locating code, generated docs, PR review, wins and losses both - see the full benchmarks →
Python · full git history
JavaScript · real npm dependencies
Go · the stress test
Not a curated sample - the actual torvalds/linux repository, cloned in full and scanned end to end: 94,849 files, 8.2GB, 1.46 million commits.
Dependency graph of net/openvswitch - generated by Aletheore straight from the parsed source, no LLM involved.
Measured against Aletheore's own air.json/air.toon pair from a real self-scan - the exact data the MCP server and audit's coding-agent adapter read.
Paste a public GitHub repo below. It runs the real deterministic scanner in an isolated sandbox - no signup, nothing installed on your machine, and the clone is destroyed the moment the scan finishes. One free run every 20 minutes; repos over 400MB need the CLI instead.
Nothing leaves your machine when you run the deterministic local scan. Bring your own API key for AI-assisted audit reports, or skip them entirely: the evidence pipeline stands on its own.