Xalgorix Cloud
Autonomous AI security testing for developers and security teams: find vulnerabilities, prove each with a working exploit, and ship verified fixes with zero infrastructure setup.
翻訳待ち
Aletheore is more than a scanner. Free deterministic CLI audits (secrets, vulnerabilities, licenses, dead code, git hotspots) plus a hosted GitHub App: automated PR reviews on Aletheore Flash ($8/mo),
翻訳待ち
セキュリティPython · HTMLGitHub @Aletheoreオンライン所有者未確認
Have you tried it? One tap is enough. No sign-in needed.
Evidence-grounded repository audit CLI - deterministic scanner, MCP server, live dashboard, and a GitHub Action that posts PR diffs.
翻訳待ち
Loading the full README. The saved excerpt is shown below.
Code intelligence that has to show its work. A deterministic scanner reads your repo and
writes structured evidence — every downstream feature (AI audit, PR bot, MCP server,
dashboard) has to cite that evidence, or it doesn't get to make the claim.
Install the Aletheore GitHub App — hosted PR review, dashboard, and AIRview docs on top of the same evidence engine.
Prefer the free local CLI? Keep reading below.Read the full README ↗Watch the 95-second developer walkthrough →
https://github.com/user-attachments/assets/91b58344-d5b7-4be5-b71f-32f1da8499ed
With background music and on-screen explanations. Follow a scan of Aletheore's own CLI source, inspect dependencies and related tests, then see how the evidence connects to MCP and PR review. The walkthrough separates captured local output from explanations of hosted features.
Requires Python 3.11–3.14 and pipx. Run these commands from a repository you want to inspect:
pipx install aletheore
aletheore scan .
aletheore query hotspots
aletheore dashboard .
Open the dashboard at the local URL printed in your terminal. The scan writes
.aletheore/air.json, a compact .aletheore/air.toon, and history snapshots.
The deterministic scanner does not call an LLM. Local scanning and structural queries
need no Aletheore account or model API key. Registry lookups and optional scanner integrations
can use the network; see Data and network behavior.
Already installed? Update with pipx upgrade aletheore.
For a virtual environment or source installation, see the setup guide.
aletheore demo
The demo creates a small synthetic Python repository with local Git history and runs
the real scanner to build reusable evidence, retrieve source, trace imports, and execute
a local MCP tool call. In a terminal, arrow-key menus guide one screen at a time,
with actions to open the sample dashboard or try your own repository. Use aletheore demo --plain
for a printable report; piped output also runs without prompts.
You can also select Take the guided demo from the aletheore home menu.
Tests are suggested, not executed. Git must be installed; no account,
model, or repository clone is needed. The sample and evidence remain in a temporary
directory for follow-up queries and the dashboard. Delete that directory when finished.
A real local scan of Aletheore's CLI source. Hover modules in the dashboard to explore resolved imports. Security checks were disabled for this capture; graph nodes do not represent a clean security verdict.
An actual bot comment on PR #1128. The screenshot shows the review surface; a finding remains something to investigate.
The public AIRview demo, captured from the website using Aletheore's own module graph. Try the interactive version to drag modules and trace imports. This is the public demo rather than an authenticated hosted workspace.
Run a scan first. Replace the example paths and symbol with names from your repository.
| What you need to know | Command |
|---|---|
| Where is a function defined? | aletheore locate find_ownership |
| Who imports this file, directly or indirectly? | aletheore dependents src/example.py |
| Where is this symbol referenced? | aletheore usages parse_config |
| Which tests are related to this file? | aletheore tests-for src/example.py |
| Which files change frequently? | aletheore query hotspots |
| Who has contributed to a file? | aletheore query ownership src/example.py |
| Which endpoints are mapped? | aletheore query endpoints |
| Which secret findings need review? | aletheore query secrets |
| Are there circular imports? | aletheore cycles |
dependents follows resolved import edges. tests-for identifies candidates from import
relationships and naming conventions; it does not execute tests or establish coverage.
Ownership reflects Git history, rather than an assignment of responsibility.
Use aletheore query to list available query kinds and aletheore COMMAND --help for options.
aletheore mcp-install . --target cursor
This writes client configuration so Cursor can launch the repository's MCP server.
Restart or reload the client as needed. Other supported targets include Claude Code,
VS Code, Kiro, Opencode, Antigravity, Codex CLI, and Claude Desktop; list the current
options with aletheore mcp-install --help.
An agent can inspect symbols, imports, dependents, owners, endpoints, and related evidence without starting each investigation from an unstructured repository dump. For example, ask your agent:
Before changing this function, use Aletheore to locate its definition, inspect its references and import dependents, and identify candidate tests. Cite the evidence and distinguish resolved relationships from uncertainty.
For clients you configure manually, the server command is aletheore mcp ..
Optional AI answering, semantic indexing, and external tools have their own setup and
network requirements. See the MCP guide.
Shield is a local safety net for AI-written changes in a Git repository. It makes no model call.
pipx install aletheore # or: pip install aletheore
aletheore shield
This is the beginning of the README. Read the rest at the original. Read the full README ↗