Gortex Code Intelligence

SECURITY.md thoroughly describes operator versus agent channels, tracked-root path confinement, symlink resolution, Unix-socket permissions, network egress, persisted data, and external processes, and it explicitly warns that every agent session can read and write every tracked repository. Local-only defaults, opt-in hosted LLM and federation features, and mandatory authentication for non-loopback HTTP demonstrate meaningful least-privilege design. Deductions apply because any same-user process reaching the daemon socket receives authority over all repositories and the control surface, filesystem access is not session-isolated, loopback HTTP may be unauthenticated, and /v1 CORS defaults to *. Tracking and higher-risk features generally require an operator action, but ordinary agent file writes have no demonstrated per-operation confirmation. Source-derived prompts, notes, local persistence, and optional disclosure paths are explained well, while encryption at rest, secret detection, and credential redaction are not established. Dependencies and Actions are pinned, and release verification, signing, and SLSA controls are asserted; however, the supplied files show no dependency vulnerability scanning, SBOM, or vulnerability-remediation evidence, and the dependency surface is extensive. Non-mutating edit previews are documented, but a general backup, transaction, or undo facility for completed writes is not. The full Apache-2.0 license, copyright holder, and contact address provide strong attribution; registry non-verification is treated only as unknown identity.

README, SECURITY.md, go.mod, and CI present a broadly coherent account of the local architecture, platforms, CGO, SQLite, static distribution, and optional components. CI covers Linux, macOS, Windows, static linkage, and several embedding builds. Deductions apply because the README's opt-in telemetry description sits uneasily beside SECURITY.md's categorical “No telemetry,” and “zero dependencies” describes distribution convenience rather than the substantial build dependency graph. go.mod pins a very large direct and indirect dependency set, while CI pins Actions to commits and exercises several build forms. Availability is not fully established because Go 1.26.6 and some future-dated or very recent module revisions are only declared in the supplied evidence, not independently confirmed. Property tests demonstrate graceful preservation of original output on augmentation timeout, connection failure, or empty results, and readable bridge error formatting, but there is no comprehensive product-level error catalog, diagnostic contract, or recovery guide.

The material clearly targets AI coding agents, IDEs, CLI, MCP, HTTP, and a web UI, with concrete scenarios covering cross-repository analysis, editing, review, search, contract matching, and large repositories. It names 19 agent integrations and supports the three major desktop operating-system families. SECURITY.md precisely states read/write boundaries, lack of session isolation, networking, subprocess execution, and remote-deployment limitations, earning full capability-boundary credit. Triggering evidence includes minimum-pattern gating for grep augmentation, fallback behavior, and opt-in network or process features, but it does not cover routing and invocation precision across the claimed 175 MCP tools. Environment fit is strongly supported by the cross-platform single binary, static Linux checks, Windows-specific path tests, Linux/macOS race tests, and multiple installation channels.

The README has strong organization around installation, quick start, architecture, scale, features, and a topic-based documentation index. Installation guidance includes claimed SHA256 and cosign verification, alternative package formats, and source-build requirements. CLI, MCP, /v1 HTTP, and gortex-* bridge names appear internally consistent, but the supplied evidence contains no compatibility history or deprecation examples, so long-term naming stability is not fully demonstrated. Quick-start commands, tables, examples, and tool-chaining hints are extensive, although no actual centralized FAQ content is supplied. SECURITY.md gives unusually concrete limitations concerning shared authority, loopback exposure, prompt injection, subprocesses, and data egress. The complete Apache-2.0 text and copyright notice justify full license credit. A versioning document and release page are referenced, but neither policy contents nor a changelog is included. A named maintainer, email, private vulnerability channel, and Discord establish an update path, while team governance, support horizons, and succession are absent; publisher registry status remains unknown.

Bridge property tests require user-facing output to be readable plain text, label errors, and include next-step tool hints. The README additionally describes CLI, JSON, MCP, API, graph UI, and GCX1 consumption formats, providing strong output-usability evidence. A persistent code graph, cross-repository call and contract links, impact analysis, live overlays, and speculative edits offer clear marginal value over ordinary file reads. Scale tables, throughput and memory figures, a benchmark workflow, a reproducible-benchmark pointer, and token-savings examples support the cost-benefit case. Deductions apply because the 50x and 27% savings remain largely first-party claims within the supplied files, the largest listed index uses about 5.07 GB peak heap, and the 175-tool surface plus extensive dependency graph impose setup and maintenance costs.

Many claims point to repository documentation on installation, languages, architecture, benchmarks, telemetry, and versioning. CI directly exposes build, test, static-link, and benchmark commands, while go.mod makes dependency versions traceable. The linked documents themselves are mostly absent from the supplied material, however, so claims such as 257 languages, 19 agents, 175 tools, SLSA level 3, the VirusTotal result, and token reductions cannot be checked item by item here. README, SECURITY.md, CI, tests, and the dependency manifest provide useful cross-corroboration for platform support, architecture, safety boundaries, and graceful output fallback; performance and savings evidence remains predominantly first-party. The security policy carefully distinguishes defaults, explicit grants, and missing protections, but marketing maxima and phrases such as “zero dependencies” and “No telemetry” do not always cleanly separate distribution dependencies, build dependencies, and optional configuration.