Practical overview
When it fits
Use the CLI when you want a local evidence-producing scan and follow-up queries; use the GitHub App when you want pull-request reviews, checks or monitoring tied to a GitHub installation.
Who it is for
- Developers who want local repository security, dependency and architecture findings.
- Teams using GitHub pull requests who want automated reviews and branch-protection checks.
- Developers configuring coding clients to query structured repository evidence through MCP.
Documented uses
- Scan a repository for secrets, dependency vulnerabilities, licenses and static-analysis findings.
- Map code structure, dependencies, endpoints, ownership and Git hotspots.
- Query generated evidence or inspect it in a dashboard.
- Review pull-request changes automatically through the GitHub App.
- Expose focused repository evidence to supported coding clients through MCP.
Requirements & limits
The service is listed as freemium, with a free deterministic scanner and paid plans. The local CLI scan is described as requiring no account. Paid GitHub App tiers require installation on a GitHub account or organization. The CLI is open source under AGPL v3.0.
- The CLI scan path is deterministic and does not use an LLM; optional AI features can use a configured provider.
- Local scans can perform dependency advisory and license lookups and check for a newer release; each can be turned off.
- Managed audits and hosted workflows differ from local scanning and may involve an API token or permission to transmit evidence.
- Dependency checks rely on supported manifests, resolved versions and registry coverage.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Scan a repository and inspect its evidence
Create Aletheore's local repository evidence files, then query endpoints or open the dashboard.
Before you start
- A repository available locally.
- Python package installation using pip.
Steps
Install Aletheore with the command below.
pip install AletheoreFrom the repository, run
aletheore scan ..Query endpoints with
aletheore query endpointsor inspect the results withaletheore dashboard.
Expected outcome
The scan writes `.aletheore/air.json` and `.aletheore/air.toon`; the query and dashboard read the generated evidence.
Guide limitations
- Dependency checks depend on supported manifests, resolved versions and registry coverage.
- Git-history secret scanning can take a long time on large histories.
Configure a repository MCP server for Cursor
Write Cursor client configuration so it can launch Aletheore's repository MCP server.
Before you start
- A local repository and Aletheore CLI.
- Cursor.
Steps
From the repository, run
aletheore mcp-install . --target cursor.Restart or reload Cursor as needed.
Expected outcome
The command writes client configuration for launching the repository's MCP server, which exposes read-only structured repository evidence.
Guide limitations
- The documented setup describes client configuration, not a completed connection or agent workflow.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 6 November 2026
- Original website title
- Aletheore | Evidence-Grounded Code Audits & GitHub Automation · Official homepage title · retained in its source language