Reads the whole repository. Fixes what has one right answer.

Truemend reads the repository for you, on your own machines. Each finding names a file and line. Mechanical fixes come back as diffs you can review, and larger changes come back with an estimated cost. Below: where a model is used, the evidence it produces for audits, and the places it runs.

Start with the free tierSee a finished report

Where a model is used.

Finding problems and applying mechanical fixes use no model. Two optional steps do, and both are off unless you turn them on.

If a security review asks where a model touches your code, these are the only two places.

Bounded refactors

A larger change is prepared as a diff for you to approve. It sends the relevant code to the model you configure, which can be one you host.

Rewording a finding’s history

Code writes a sentence such as “This finding first appeared 4 months ago and is still open.” A small model on your own machine may reword it. It receives only that sentence, and a rewrite that changes the claim is discarded. In a test of 20 rewrites built to change the claim, all 20 were rejected.

About 5 GB of disk. Runs on a CPU. No network access.

When someone asks you to show the control, you have a line of code.

Findings carry the control IDs your auditors already work from, across nine frameworks. A missing moderation check on a model response is not a style note, it is cited evidence against EU AI Act Art. 15 with the file and line attached. Frameworks that come back clean are listed as checked and passed.

  • SOC 2
  • ISO 27001
  • OWASP
  • HIPAA
  • PCI-DSS
  • GDPR
  • EU AI Act
  • NIST AI RMF
  • ISO/IEC 42001
Art. 15Accuracy, robustness and cybersecurity, cited by model output returned with no PII filter src/api/handler.py:1421 of 9 frameworks, in every report

clean frameworks read as ✓ verified clean · full pages in the report

It runs where your code is.

One binary, no runtime and no package manager. It is a command in the terminal, a tool your coding assistant calls over MCP while it writes, a check on the pull request, and a skill an agent drives on its own. Same library, same pattern names, same tier in all four, so a finding does not change identity when it moves from a laptop into CI.

There is no dashboard to stand up and no code to send anywhere for analysis. Adoption is a hook and a workflow file, which is the whole reason it survives contact with a busy team. Analysis runs on your machine; licence checks and definition updates use the network separately.

  • Claude Code
  • Cursor
  • Copilot
  • Codex
  • Windsurf
  • Gemini
  • Aider
  • Roo
  • Amazon Q
  • Zed
claude-code-mcp.jsonconnected
{
"mcpServers": {
"truemend": {
"command": "npx",
"args": ["-y", "truemend-mcp"]
}
}
}
terminaltruemend . · truemend fix src/ --apply
agentclaude mcp add truemend -- npx -y truemend-mcp
ciuses: alsajoo/truemend@v1

Two optional steps use a model, both off by default: where a model is used · setup and licences