The engine

5,520 ways code drifts.
One engine that mends them.

Not a linter with opinions. An AST-native engine that parses your code the way a compiler does, then fixes what it finds, with receipts.

The loop

Sense. True. Learn.

01 / SENSEast-grep

Reads the whole repo

Builds a live model of your conventions, patterns, and the decisions behind them, parsed as syntax trees, not text.

02 / TRUE3-tier

Mends what’s off

Dead code, broken patterns, duplicate logic, quiet debt. Every change scoped to one function, verified by re-parse, reversible.

03 / LEARNcompounds

Sharper each pass

Every session deepens its sense of what “true” means for your codebase. Six months in, it knows your patterns better than a new hire.

Detection

Compiler precision.
Linter breadth.

AST-level pattern matching via ast-grep: no regex guessing, no LLM in the detection loop. 5,520 patterns across seven coverage areas, each with a validated fix path.

92
Web frontend
React, Next.js, Vue, Angular, Svelte, Tailwind
131
Mobile
Flutter, React Native, SwiftUI, Compose, Android
151
Backend
Flask, FastAPI, Django, ASP.NET, Gin, Actix, Ktor
68
Database & ORM
Postgres, Supabase, Prisma, SQLAlchemy, Mongo, Redis
106
AI / ML SDKs
OpenAI, Anthropic, LangChain, Transformers, Bedrock
34
DevOps & infra
Docker, Kubernetes, Terraform, GitHub Actions
48
Auth, payments, testing
Auth flows, Stripe, Sentry, test quality
337
Core languages
22 languages: TS/JS, Python, Go, Java, Rust, Swift, SQL, C/C++, PHP…
Remediation

Auto-fix everything is dangerous.
Report-only is useless.

Every fix is classified by safety before it lands. That classification is the safety model, not an organizational convenience.

TIER 1 · DETERMINISTIC
Patches
36.8% of patterns · 2,077

AST-safe transforms applied automatically with zero risk: var→const, dead exports, unused imports, rethrow-only catches. Every one of these lands for free.

verified by AST re-parse
auto-reverted on failure
logged with reversible diff
TIER 2 · CATALOGED
Refactors
57.7% of patterns · 3,256

Known refactoring patterns from a curated catalog: extract function, decompose nested callbacks. Bounded scope, predictable output, 3,256 patterns, reviewed before landing.

constrained prompt scope
post-fix validation
scoped diff, tests run
TIER 3 · STRUCTURAL
Rewrites
5.2% of patterns · 295

God classes, tangled dependency graphs: architectural decisions only humans should make. You get evidence, options, and a recommendation. The decision is yours.

never auto-applied
evidence-backed options
human-owned decision
Governance

Citations, not badges.

Every audit maps findings to nine compliance frameworks with real control IDs: a missing content-moderation check is cited evidence against EU AI Act Art. 15, not a marketing claim.

SOC 2ISO 27001OWASPHIPAAPCI-DSSGDPREU AI ActNIST AI RMFISO/IEC 42001
Art.15
Accuracy, robustness & cybersecurity, cited by model output returned with no PII filter src/api/handler.py:142
1 OF 9 FRAMEWORKS · EVERY REPORT

clean frameworks read as ✓ verified clean: checked and passed, never unexamined · full pages in the report

Zero infrastructure

It runs where your code lives.

No SaaS dashboard. No Docker. No CI YAML. Truemend is an MCP server over stdio: your AI assistant calls it directly, inside the editor.

One 74 MB binary. No runtime, no package manager, works offline. Copy one file, run it.

Claude CodeCursorCopilotGeminiAmazon QWindsurfAiderZed
CLAUDE-CODE-MCP.JSON
{
"mcpServers": {
"truemend": {
"command": "truemend",
"args": ["serve"]
}
}
}
connected · stdio · that’s the whole setup