AI is mutating your software DNA faster than you can audit it.

Truemend reads every strand on your machine, heals the mutations it can prove safe, and shows the health of everything it will not touch.

See an audit →Watch a run

Run

Point it at a directory.

One command reads the tree and scores every function. Nothing uploaded. No API key.

One run

$ truemend src/

Health 6.6/10 · 47 files · 312 issues

(1 high, 38 medium)

high guardrails_pii_no_filter src/api/handler.py:142

high ai_unchecked_tool_output src/api/handler.py:88

medium slop_redundant_comment src/utils.ts:15

medium unnecessary_try_catch src/db/query.ts:34

… 308 findings hidden (--verbose)

$ truemend fix src/ --apply

6.6

HEALTH · 47 FILES · 312 ISSUES

Every finding names the pattern, the file, the line, and what it costs to clear. What it will not heal stays, scored.

high

LLM output returned without a PII filter

guardrails_pii_no_filter · src/api/handler.py:142

STRUCTURAL

high

Tool output used without validation

ai_unchecked_tool_output · src/api/handler.py:88

CATALOGED

medium

Comment restates the code below it

slop_redundant_comment · src/utils.ts:15

$0 · AUTO

medium

try-catch wraps code that can’t throw

unnecessary_try_catch · src/db/query.ts:34

$0 · AUTO

Four ways to run the audit. One engine.

Same local audit, wherever the code already lives. No dashboard to stand up.

~/repo

$ truemend .
  Health 6.6/10  47 files
$ truemend fix --apply
  12 healed  3 need a human

At the terminal.

Point it at a directory and read the output. One binary, works offline.

Inside the editor you already use.

The file stays open. The engine runs in the sidebar.

On every pull request.

Fails the build on regression. The audit lands where the team already reviews.

In the chat with your coding agent.

Ask it to audit. It heals what is safe and shows the rest.

15 head-to-head benchmarks. 14 wins, 1 loss, all published.

The audit has to hold up. Judged blind, against each language's own linter. The number is how often a finding does not hold up. Shorter bar is better.

TypeScript / React

vs Biome

Win

Truemend3.0%

Biome8.4%

Java

vs SpotBugs + Checkstyle + PMD

Win

Truemend18.6%

SpotBugs + Checkstyle + PMD60.8%

C# / .NET

vs Roslynator

Win

Truemend9.1%

Roslynator42.0%

Python / Django

vs Bandit + Pylint + Ruff

Loss

Truemend25.0%

Bandit + Pylint + Ruff23.0%

See every study →

Your code stays put.

The audit never needs the network. Nothing leaves unless you send one function, on purpose.

On your machine.

The audit runs where the code already is. No account. No API key. Source does not leave.

With the network off.

The same binary. No special build for a room with no internet.

One function, if you ask.

The only thing that can leave is a single function you send on purpose. Logged. Reversible.

Or keep the model here too.

Point it at a model you already run. Nothing crosses the building.