Nobody on your team is reading all of it.
TrueMend reads the repository for you, on your own machines. It scores every function, names the lines that are not ready to ship, corrects the ones it can prove safe, and prices what is left. Below: what lands on the first pass, how much of it stays yours to decide, and where it sits in the week you already have.
What you have by the end of the first afternoon.
One command, no account, no service to stand up. Three things come back, in this order.
It reads everything, not a sample.
You point it at a directory. Every file becomes a syntax tree and every function gets its own score, so a two thousand line file comes back as forty verdicts instead of one.
A full source tree finishes in 13.8 s, and 0.26 s against a warm cache, which is short enough to sit in a pre-commit hook. Parsing and scoring happen on your machines: no account, no API key, and nothing is uploaded to be analysed.
src/api/handler.py:142
src/agents/tools.py:88
src/orders/charge.ts:64
src/index.ts:12
A line number, not a heat map.
Each finding arrives with the pattern that caught it, the file and line it sits on, the severity, and which tier of remediation it belongs to. Your developers can argue with a named pattern. They can do nothing with a dashboard that says quality is down four percent.
Findings you disagree with can be switched off by pattern, per repository, and the false-positive rate we measure on our own source is published rather than kept quiet.
Some of it is already repaired when you open the diff.
37.9% of the library rewrites safely as a syntax-tree transform. Those land as an ordinary diff you can read, verified by re-parse and reverted automatically if the file stops compiling.
Everything else comes back priced instead of quietly changed, so the cleanup you approve is a bounded piece of work with a number next to it rather than an open-ended refactor.
The question is how much judgment the repair needs.
Every pattern is filed into one of three tiers before you ever see a finding, so you know in advance what will be done for you and what will be handed back. This is the part to take into a budget conversation: the first tier is free and needs no review process, the second is bounded work you can schedule, the third is architecture and stays yours.
Mechanical rewrites with one correct answer: a rethrow-only catch removed, an unused import dropped, a mutable binding that was never reassigned. The transform happens on the syntax tree, so it cannot depend on a model having read the code correctly. Free, in every tier of the product.
Known moves from a curated catalogue: extract a function, unpick nested callbacks, split a handler that grew three responsibilities. Scope is one function at a time, the output is reviewed before it lands, and an estimate travels with it so the work can be scheduled like any other ticket.
A class doing nine jobs and a dependency graph with cycles are architecture, not defects with a known correction. You get the evidence, the options, and a recommendation. Nothing is touched. If you want a person in the room for these, that is what the consulting engagements are for.
tier shares are shares of the pattern library, not of your findings · what each tier costs
When someone asks you to show the control, you have a line of code.
Findings carry the control IDs your auditors already work from, across nine frameworks. A missing moderation check on a model response is not a style note, it is cited evidence against EU AI Act Art. 15 with the file and line attached. Frameworks that come back clean say so, checked and passed, rather than being left off the page.
clean frameworks read as ✓ verified clean · full pages in the report
Nothing to stand up, nothing to migrate onto.
One binary, no runtime and no package manager. It is a command in the terminal, a tool your coding assistant calls over MCP while it writes, a check on the pull request, and a skill an agent drives on its own. Same library, same pattern names, same tier in all four, so a finding does not change identity when it moves from a laptop into CI.
There is no dashboard to stand up and no code to send anywhere for analysis. Adoption is a hook and a workflow file, which is the whole reason it survives contact with a busy team.
one model in the product, and it sits last: local, off by default, and it may not change what a sentence says · readable history · setup and licences