Kodus

The README describes source-code handling, model providers, BYOK, cloud versus self-hosting, and the contents and opt-out variable for the daily anonymous heartbeat. CLI tests also show that a local diff is sent to /cli/review with a team-key header. Hook installation has dry-run, status, and uninstall paths, while release workflows make external API, Discord, repository-write, and release-note effects visible. Deductions apply because encryption and non-training assurances are assertions without implementation evidence; access controls are largely presented as enterprise features, and the publishing workflow uses contents: write plus a PAT capable of bypassing main-branch protection without an approval gate. Dependency security shows pinned tooling, frozen-lockfile installation, and pinned Actions, but no vulnerability scanning or remediation evidence. Repository branding and contact paths are clear, although publisher identity remains unverified.

CLI integration tests cover help, version output, structured envelopes, field projection, authentication headers, no-change handling, invalid input, dry runs, and hook installation and removal. Stable error codes and specific messages provide thorough failure-message evidence. The package manager is pinned and CI uses frozen-lockfile installation, with multiple model and Git integrations described, but the supplied material lacks a complete dependency inventory or fallback behavior. Self-consistency is reduced substantially because the README instructs yarn setup while package.json explicitly rejects clients other than pnpm. Mock-server tests establish interface behavior but do not establish availability of the real service.

The material clearly distinguishes cloud, self-hosted, CLI, CI/CD, and contributor workflows and addresses Community, Teams, Enterprise, several Git platforms, and multiple model providers. Strict release-tag matching, staged and branch scoping, rejection of removed flags, and command-schema output provide strong trigger-precision evidence. Deductions apply because broad platform, model, and environment compatibility is mostly asserted in the README, complete deployment instructions are only linked externally, and the yarn/pnpm conflict weakens environment guidance. Capability boundaries are partly expressed through plan limits and command help but do not systematically describe review blind spots or unsupported code-analysis cases.

The README has multilingual navigation, workflows, feature descriptions, edition comparisons, a monorepo map, and organized resource links, giving it strong information architecture. Command examples, help tests, machine-readable schemas, strict self-hosted semantic tags, and automated changelog workflows support mature usage and release conventions. Install notes lose credit because they conflict with the enforced pnpm policy. Migration from a legacy business-rules-validation name shows naming evolution, and there is no dedicated FAQ; listed limitations are mainly commercial plan limits rather than technical constraints. license.md clearly states an AGPL/commercial dual-license scheme, but package.json says UNLICENSED, supplied metadata says NOASSERTION, and the referenced enterprise license text is absent. Community and contact channels plus release automation indicate an update path, but verified maintainers and maintenance commitments are not identified.

The CLI offers JSON, Markdown, agent envelopes, field projection, quiet and verbose modes, and actionable issue fields such as file, line, severity, and message. These behaviors are concretely represented in integration tests and response schemas, justifying full output-usability credit. Context-aware review, natural-language rules, issue tracking, and model choice plausibly add material value, but actual review quality is supported mainly by product claims and a fixed mock response rather than source-grounded outcome evidence. BYOK, token-usage visibility, and explicit plan pricing aid cost planning, while no-markup and predictable-cost claims lack implementation or billing evidence.

Several core CLI claims trace to tests, recorded mock requests, scripts, and workflows, including diff submission, authentication headers, output formats, command boundaries, hook lifecycle, and release triggers. The README, package scripts, tests, and workflows cross-corroborate some operational capabilities. Deductions apply because major privacy, security, model-compatibility, review-effectiveness, SOC 2, and pricing claims lack corresponding implementation, policy, or independent evidence in the supplied files. Marketing conclusions are often presented directly as facts, and fixed mock data verifies an interface contract rather than model correctness or live-service behavior, so fact, claim, and inference separation is limited.