Aletheore MCP
A repository scanner with an MCP server: dependency graph, secrets, vulnerabilities and an API map with code line citations
- 650 ★ on the repository
- Last commit
- AGPL-3.0
Extended access
Why this level
- The server reads all the source files and git history of the repository
- The secrets tool shows the agent keys found in the code and in git history
- The external mode sends repository evidence to a third-party service; it is off by default
Install
- Works in
Manual install
pipx install aletheorePython is required. Then run aletheore scan . in the repository root to build the evidence.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The server reads all the source files and git history of the repository
- The secrets tool shows the agent keys found in the code and in git history
- The external mode sends repository evidence to a third-party service; it is off by default
This is third-party code. Review the repository files before installing.
What it does
Aletheore is a command-line repository scanner with an MCP server. The `aletheore scan` command, with no LLM and no account, parses code through Tree-sitter and writes structured evidence, meaning the facts it found about the code, to .aletheore/air.json. That file holds a module dependency graph, file owners from git history and a map of API routes. It also holds secrets from the working tree and history, plus dependency vulnerabilities and licenses from OSV.dev. Supported languages are Python, JavaScript and TypeScript, Go, Rust, Java, Kotlin, Ruby, PHP, C, C++, C# and Swift. The `aletheore mcp` command starts a stdio server over that data, which by default gives the agent 36 tools. They search symbols, source code, imports and reverse dependencies. Others show owners, secrets, vulnerabilities, licenses and routes and find dead code and hotspots. There is full-text and semantic search and a rescan trigger. After edits the server rescans the repository in the background, and `aletheore mcp-install` registers it in the configuration of Claude Code, Cursor, VS Code, Kiro, Opencode and Codex CLI. The same evidence feeds the other commands. `aletheore audit` asks an agent or an API provider to write a report in which every file and line citation is checked against the data. `aletheore dashboard` opens a local panel with graphs, and the GitHub Action posts to a pull request the difference in secrets, vulnerabilities and layer violations.
Who it is for. For developers who work through a large or unfamiliar repository and want to check AI conclusions against the code.
Good fit when
- The agent needs the links between modules to say what breaks when a file changes, without reading all the code
- Before a release you need to find secrets in the working tree and git history and check dependencies for known vulnerabilities
- CI needs the difference in secrets and vulnerabilities between a branch and its base in a pull request comment
- You want a repository audit in which every AI claim is checked against a line of code
- Before a refactor you need to find dead code and hotspots
Not a fit when
- You work at a company: the license allows personal use, and an organization needs a commercial license
- The project language is outside the supported list: no dependency graph or route map is built for it
- The repository has more than 5000 source files: the MCP server's background rescan does not start for it
- You want to run audit in CI: the command is meant for manual runs, and CI runs only scan and diff
Example request
Use Aletheore to show which modules import auth.py and check whether the project dependencies have known vulnerabilitiesMCP
- Transport
- stdio
- Authentication
- not required
Environment variables
ALETHEORE_MCP_ALLOW- Comma-separated permitted effect classes: read, write, network, external. An explicit value replaces the default set.
ALETHEORE_MCP_WATCH- A value of 0, false, no or off turns off the background rescan after file edits.
ALETHEORE_API_TOKENsecret- Token for the hosted Aletheore service, used by the managed audit tool, which is not registered by default.
Limitations
The PolyForm Noncommercial 1.0.0 license is not open source by the OSI definition. By default the server can write to the .aletheore folder and reach the network for OSV.dev and package registry data. Semantic search goes through a local Ollama and without it answers with an embedding provider error. The `aletheore audit` command needs a provider key or a local model. The OpenAI and Anthropic APIs are unavailable from Russia, while a local Ollama works with no outside access. The background rescan is lighter than a full one: it takes vulnerabilities, licenses and git history from the last full scan. If the CLI crashes it sends a crash report by default, and one command turns that off. The paid GitHub App with pull request review is a separate hosted service.
How to disable. Remove the aletheore entry from your agent's configuration (`.mcp.json`, `.cursor/mcp.json`, `.vscode/mcp.json` or your agent's own file), then run `pipx uninstall aletheore`. The `.aletheore/` folder with scan results stays in the project and can be deleted by hand.
FAQ
How do I connect Aletheore to Claude Code or Cursor?
Install the package with `pipx install aletheore`, run `aletheore scan .`, then `aletheore mcp-install .`. By default the command registers the server in every supported agent, and the `--target` flag narrows the list. The entry goes beside the servers you already configured and leaves them untouched.
Do I need an account or an API key?
Neither is needed for `aletheore scan`, `aletheore query` and `aletheore diff`, the MCP server and the local dashboard. A provider key or a local model is required only for `aletheore audit`. The scanner's network lookups to vulnerability databases and registries can also be switched off for a fully offline run.
How do I run the MCP server read-only?
Set `ALETHEORE_MCP_ALLOW=read`. The variable lists the permitted effect classes: besides read there are write, network and external. A tool whose effects are not permitted is never registered, so the agent cannot see it. In read-only mode 32 tools remain.
What does the nav profile give me?
The `aletheore mcp --profile nav` command starts a lighter server with three tools: `locate`, `symbol_source` and `search`. Their definitions take about a tenth of the full server's. The saving depends on the task: when the target is already named in the request, a plain grep is just as cheap.
Can I use Aletheore in a commercial project?
Only under a separate license. Under PolyForm Noncommercial, use by individuals for personal purposes, research and evaluation is free, while work inside a company counts as commercial. The contact for a commercial license is in the license section.
Discussion
No questions or reviews yet.
Related
MCP serversMCP-Shield finds your MCP configs, connects to servers and scans tool descriptions for hidden commands, exfiltration channels and tool shadowing
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A security scanner CLI for code and AI agents: vets .claude, hooks, MCP configs and SKILL.md before cloning and finds leaked keys
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
MCP server for the ARL-Next platform: returns ports, fingerprints, certificates, vulnerabilities and leaks for a domain, IP or URL from your asset database
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| Aletheore (this entry) | no | not required | 650 | |
| GitNexus | no | not required | 48,101 | builds a code graph with Tree-sitter and serves call chains, change blast radius and search to the agent over MCP |
| codebase-memory-mcp | no | not required | 47,795 | builds a code graph of functions, classes, calls and HTTP routes and answers the agent's structural queries locally |
README in short
The README starts with an example `aletheore scan` run, then explains why to choose the tool and lists the shipped features. Next come sections on the paid GitHub App, the repository layout and the license terms. The full command reference and the MCP tool list live in src/README.md.