Alysis Code

The security model documentation gives specific and consistent descriptions of least privilege (four tiers readonly/review/auto/fullaccess, personas can only narrow and never widen, sandbox defaults to strict and refuses execution when no backend is available) and user confirmation (write operations and shell commands require approval, credential files and directories outside the project force manual approval), so it scores high. Data-flow transparency covers SSRF protection, web_fetch source gating, and omission of MCP descriptions, but lacks a complete user-facing data-flow/telemetry explanation, so points are deducted. Sensitive data handling mentions an encrypted provider vault, tokens not stored in config.json, and environment variable cleanup, but has no key rotation/audit details, so it is only moderate. For dependency security, pyproject has lower-bound constraints and CI has npm audit and lock synchronization, but most dependencies are lower-bound only with no hash-lock evidence, so points are deducted. External effects include the sandbox network being off by default and LAN preview requiring approval, but fullaccess removes the sandbox and approvals, leaving a large risk surface, so points are deducted. Rollback is only mentioned via desktop checkpoint and Changes, with no clear CLI-side rollback mechanism, so it scores low. Source attribution includes NOTICE and third-party Kilo Code/OpenCode declarations, but only in the editor sidebar, so coverage is limited.

README, quickstart, security_model, and shell_sandbox are basically consistent on mode naming and defaults, but README uses readonly/review/auto/fullaccess while security_model uses the TUI mapping read/safe/fast/full, so terminology is slightly inconsistent and points are deducted. Dependency declarations are clear and the Python version matrix 3.11–3.14 is covered in CI, but most dependencies are lower-bound constraints with no lock-file hash evidence, and some version numbers (e.g. certifi>=2026.10.19) are unusually advanced, raising availability questions, so points are deducted. The documentation describes sandbox doctor, a troubleshooting table, and fail-closed behavior, but lacks direct evidence of runtime error message formats and diagnosability, so it is only moderate.

It clearly targets terminal and desktop users and covers coding, research, documents, browser, scheduled tasks, and other scenarios, so audience and scenario descriptions are sufficient. security_model and shell_sandbox explain capability boundaries in detail (the sandbox does not cover custom tools, fullaccess is not a sandbox boundary, Windows backend limitations), so boundaries are clear. There are trigger controls such as web_search_policy, persona, and permission modes, but no systematic explanation of tool trigger precision and false triggers, so points are deducted. It covers macOS/Linux/WSL/Windows multiple backends, but Windows is beta, Docker does not support additional folders, and there is no Linux desktop version, so environment fit has gaps and points are deducted.

The docs directory structure is clear and README has navigation, but some links point to external sites and the in-repo documentation index is limited, so points are deducted. Installation notes are very detailed, covering multiple platforms, package managers, upgrades, and PATH handling, so it scores high. Command aliases alysis/alysis-code are stable, but permission modes have two naming schemes in the documentation, slightly affecting stability. There are quickstart and command examples, but no dedicated FAQ section, so points are deducted. shell_sandbox and windows-cli-sandbox have dedicated Limitations sections, so the explanation is sufficient. The full Apache-2.0 LICENSE text is consistent with pyproject metadata, so it scores high. pyproject version is 0.16.1, quickstart mentions 0.15.2, and a CHANGELOG link exists, but no changelog content evidence is provided, so points are deducted. Publisher identity is unverified, and maintenance responsibility and update paths rely only on external sites and Discord with no clear governance explanation, so it scores low.

There are usability designs such as diff, Changes, checkpoint, and document output, but no actual evidence of output quality, so it is moderate. Differentiation is clear through multiple models, sandbox, Forge, and document tools, but there are many similar competitors, so marginal value is moderate. Forge explicitly consumes a large number of tokens and hosted accounts use a credit system, so cost information is limited and may be high, so points are deducted.

Security and sandbox claims mostly point to specific files (read_only_commands.py, command_review_rules.py, etc.), so traceability is relatively good, but some claims have no corresponding file evidence, so points are deducted. README, security_model, and shell_sandbox corroborate each other, but there is no test or code-level cross-validation, so it is moderate. The documentation distinguishes facts from recommendations (e.g. "does not replace code review"), but some performance/security claims lack supporting evidence, so points are deducted.