Now in public beta

The engineering brain
for AI-native teams.

One layer your engineers and your agents both build within: memory of the why, rules that gate the diff, and architecture you describe in plain English. Local-first — works with Claude Code, Codex, or any MCP client.

Free for solo devs · Works with Claude Code · Codex · OpenCode · any MCP client · Editor extension: VS Code · Cursor
Every day, on every repo

Your team keeps asking
the same four questions.

"Why is this code like this?"
"Didn't we have a rule against this?"
"How did this get past review?"
"Why is the AI confidently wrong about our codebase?"
CommitMind fixes this.
How it works

Runs once on your machine. Every agent and editor plugs in.

CommitMind runs as a single local daemon. Claude Code, Codex, OpenCode, Cursor, VS Code, and any MCP client connect to it — sharing the same memory, rules, and reviews. Your code and context never leave your machine.

The 5-second tour

Ask any function: why are you like this?

commitmind explain <symbol> returns the decision behind every line — anchored to the SHA, the rationale, and the teammate who made the call. Auto-injected before your AI edits.

commitmind · ~/work/payments-service⎇ main · a1b2c3d
~/payments-service$ commitmind explain handlers/payments.go::processPayment
Resolving symbol · 1 decision · 3 observations
What this code does
processPayment charges the gateway, records the ledger entry, then enqueues the webhook receipt. Idempotent on idempotency_keys.
Decision behind it
  • a1b2c3d Use Stripe-style fire-and-forget; retries owned by the outbox worker accepted
Linked observations
  • Tried inline retry — caused double-charge during partner outage 2025-11
  • PKCE migration also runs through this path.
Auto-injected on Edit/Write
Your AI sees this rationale before it mutates processPayment — no grep, no guess.
Resolved in 93ms from cachestore · zero round-trip
01
Pinpoint the symbol
file::Symbol resolution via the local symbol index — no grep, no whole-file dump.
02
Decision, not a guess
Captured rationale + the commit SHA it lives on: accepted, proposed, superseded.
03
Auto-injected on Edit/Write
On Claude Code, the plugin injects the rationale before your AI mutates the symbol — not after a regression in code review.
Broke something? See exactly what you changed — and why it broke — in seconds.
The lookup works wherever MCP runs — Claude Code, Codex, OpenCode, or any MCP client; automatic Edit/Write injection ships with the Claude Code plugin.
Context that compounds

Your past self's context
becomes your present context.

The decision you made last Tuesday is the context your next session starts with — no re-deriving, no re-reading. And when you're on a team, your reasoning becomes theirs too. No meeting. No Loom. No ADR doc no one reads.

Decide once
Resolve an ambiguity once and every future session — yours and your team's — inherits it.
Zero re-litigation
Never relearn why you picked Postgres FTS over Elastic.
Drop into any repo
Prime to the current state of a codebase — even your own from six months ago — in seconds.
EM
Erin
Tuesday, 2:14pm
decision · committed
$ commitmind note
"Using OAuth PKCE for SSO parity"
committed to the decision graph
JN
Jun
Thursday, 9:02am · 2 days later
surfaced automatically
AI "Should we use session cookies?"
Your team already decided: OAuth PKCE.
↳ from @erin's decision · Tue
Learnings

You get sharper every session.

A session-end worker reads what just happened, summarizes it, and proposes durable lessons. Your next session gets them injected at startup — top-K relevant — so you stop repeating the same mistakes and your AI stops suggesting them.

Session summary · 2m ago
candidates ready
What happened
Wired LearningsReconciler full-sync; mirrored the P4a pattern across cachestore + daemon. 7 commits, all green. User caught a status-filter mismatch during dogfood.
Candidate learnings · 3
01
LearningsReconciler bulk-replace must filter status='active' to match cloud — caught by user during dogfood.
incident
02
Per-project FTS5 table needs an explicit schema-version pin to survive bulk-replace eviction.
schema
03
Goose migration 022 reused an id from a deleted file — verify with git log -- pkg/cachestore/migrations.
gotcha
Auto-injected at next prime · top-K relevantSave all·Edit
Standards & rules

CLAUDE.md doesn't scale.
Rules do.

Pre-curated, pattern-matched packs across 8 languages — security, best-practices, lint, and architecture — plus the project rules you grow yourself, battle-tested the moment you connect. Co-authored with your AI, approved by humans, enforced in-session before code ships.

Hard rules blocksoft rules warnautofix conforms the rest
PreToolUse · Edit blocked
apps/landing/app/page.tsx — new components in Middle.tsx not mounted. The agent cannot edit until the rule is satisfied or skipped.
Security · OWASPPro
Go · Py · JS · TS · Java · Rust · PHP
Injection (eval / exec), weak crypto (MD5 / SHA-1), insecure deserialization, TLS / CORS misconfig — plus interprocedural taint that confirms untrusted input actually reaches the sink.
OWASP A01–A10 · CWE
LintFree
all languages
Merge markers, debugger / console.log, bare except, unreachable code — the fast deterministic baseline. Native reimplementations at parity with golangci-lint, eslint, and ruff — no toolchain to install.
@commitmind/lint
Best practicesFree
TS · JS · Python · Go · Rust
unknown over any, === over ==, no Function type, named exports, is None — hardened from soft guidance to fail-loud where the pattern is unambiguous.
ts · js · py · go · rs
ArchitecturePro
graph + call-graph
Layer-boundary rules, import cycles, and dead-code / unused-export reachability — structural health that a per-file linter can never see.
layer → layer
Your project rules
the flywheel
A review finding becomes a one-click rule — co-authored with your AI, approved by you, then enforced on every agent. Your standards compound.
review → rule
Rule authoring

Describe a rule.
The engine proves it.

Say what you want enforced in plain English. The model writes the rule — then the engine compiles it and dry-runs it against your real code, so you see exactly what it would flag before it can ever block a PR. AI-authored, engine-verified, never raw output.

mind · author_rule
$author_rule“the db package is infrastructure — only the app layer may import it”
▸ inferred graph_query · compiling against your import graph…
layers: db → packages/db/** · agents → packages/agents/**
forbid: agents db
every layer matched real files — no dead globs · 972 edges scanned
would flag 2 existing violations:
packages/agents/src/llm/sinks/db.ts:1 · packages/agents/src/env.ts:1
→ recorded pending review · you approve before it gates · fix-first or grandfather
ban evalstructuralno file over 800 linesmetricthrow only inside handle* functionsscope_queryconsole.log only in debug codestructural

One conversation authors any rule — architecture boundaries, code patterns, size limits, and scoping.

Code review

Catch the bug before the commit,
not in production.

commitmind reviewand the pre-commit gate read your diff in-session — deterministic rules plus an AI reviewer flag real bugs, banned APIs, and the decisions you're about to break, before the code ever lands. Every finding makes the next diff cleaner.

commitmind review3 files · +124 −31
4 findings
breaking · cross-filerpc/mutations.go:88
Pickup signature changed — 3 callers will break (each passes 2 args; the new signature needs 3). Caught across the whole repo before you commit — not after CI goes red.
bughandlers/payments.go:88
Idempotency check runs after gateway.Charge — a retry double-charges. Move the idempotency_keys lookup above the charge.
stale decisionauth.ts:142
Reintroduces cookie sessions — supersedes accepted decision a1b2c3d (OAuth PKCE). Confirm before you merge.
security · OWASP A03api/refunds.py:54
eval() on request data — code injection (CWE-95). Caught by the OWASP security pack; interprocedural taint confirms the untrusted input reaches the sink.
Runs in-session on Claude Code, in the pre-commit hook, or via /code-review — the bug never becomes yours to debug at 2am.
Reviewer · security pack

From one staged diff
to the whole codebase.

The same deterministic engine runs at the pre-commit gate and across every file — the OWASP/GOSEC security pack flags real vulnerabilities with interprocedural taint, not regex guesses.

PRE_COMMIT7 files · 1 finding
1 high
high · signature changeapi/payments/charge.go:53
Function Charge signature changed — 2 callers in 2 files may need updating. Verify api/checkout.go:118 (Checkout), worker/billing.go:88 (retryCharge).
Fail-fast: the commit aborts before a breaking change lands. Runs in-session and in the pre-commit hook.
FULL CODEBASE7,124 files · 1,530 findings
2 high1,466 medium62 low
highSECURITY · GOSECapi/uploads.go:155
[G304] Path traversal via taint analysis — untrusted input flows to a file path. Interprocedural taint confirms the source reaches the sink.
highSECURITY · GOSECworker/export.go:168
[G304] Path traversal via taint analysis — same sink reached from a second entrypoint.
mediumTS · NON-NULL ASSERTIONweb/src/dashboard.tsx:23
Non-null assertion x! silently overrides the type checker — avoid where a concrete type fits.
One /code-reviewover the repo — baseline the backlog, gate only what's new.
Vetted runbooks

Your release script runs the agent —
not the other way around.

Multi-step work follows a playbook the agent loads automatically. Four-phase spine — todos survive compaction, the next session resumes from the first ☐.

Todos survive compaction
Future agents resume from the first ☐ — no re-litigating last week's plan.
Drag-and-drop phase advance
Dashboard mirrors the agent's state in real time, across editors.
Auto-surfaced on prompt match
UserPromptSubmit injects the right playbook when you ask for release / migrate / debug.
Playbook library: controlling-ai-workflow · writing-migrations · releasing-the-vscode-extension
Active taskLocal-first KNN ranking for playbooks
in flight
Discovery+3 observations
Design+2 decisions
Implementation2 of 4 ☑
wire LearningsReconciler full-sync
add cachestore migration 022
ship daemon /v1/cache/learnings endpoint
ship MCP recall_learning local-first
Reviewpending
controlling-ai-workflowupdated 12m ago
Code intelligence

Refactor without fear.
Your AI knows every call site.

Tree-sitter symbol index across Go, Python, TypeScript, JavaScript, Java, Rust, PHP, and Ruby. Send the right symbol with the right context — not the whole file.

xref("Foo")
Where processPayment lives — exact file, line, signature. Your AI never has to grep.
xref("file::Foo")
Just the function body, not the 2,000-line file around it. Often a 100× context cut.
xref("Foo<")
Every call site across the repo (trailing `<` = callers). Refactor with the call graph, not with hope.
Symbol-level staleness
Knowledge tied to a function survives unrelated edits. Stale only when that function actually changes.
IDE extension

Your whole task graph,
right where you code.

The CommitMind panel for VS Code & Cursor puts active tasks, decisions, and the in-session reviewer beside your editor — and mind commit runs the staged review and links the commit to your task without leaving the terminal.

CommitMindacme/payments-api
Tasks99+
Decisions99+
Rules99+
Learnings99+
Playbooks30
Specs77
Needs your attention
7 tasks awaiting review
Active now
Add refund webhook retries…Medium
Charge: idempotency guard…review
charge.go
51// Charge captures a payment for an order.52func Charge(53  ctx context.Context, orderID string, amount int64,54) (*Receipt, error) {55  return gateway.Capture(ctx, orderID, amount)56}
zsh — mind commit
$mind commit
▸ review staged (7 files, +124 −31)…
HIGH Charge signature changed — 2 callers may need updating.
api/checkout.go:118 · worker/billing.go:88
fixed callers · committed a1b2c3d → task linked
VS Code MarketplaceOpen VSX (Cursor & forks)
Measured on real code

Quiet enough to leave on.

We don't just score against the OWASP Benchmark (F1 0.88, precision 0.85 / recall 0.91) — we run the same engine across 26 mature OSS codebases, 270K lines of real production code, and publish what it finds: just 0.08 false-positives per 1,000 lines, with 111 real known-CVE dependency advisories surfaced as a separate bucket. Signal, not noise.

270K
lines of real OSS code scanned · 26 mature repos
0.08
engine false-positives per 1,000 lines
0.88
OWASP Benchmark F1 · precision 0.85 / recall 0.91
111
real known-CVE dependency advisories surfaced separately
OWASP Top-10 (2021) coverage
A01Access Control
A02Cryptographic Failures
A03Injection
A04Insecure Design
A05Misconfiguration
A06Vulnerable Components
A07Auth Failures
A08Integrity Failures
A09Logging Failures
A10SSRF

● full · ○ partial. And we say where it stops: static analysis can't see missing MFA, brute-force gaps, or a route that forgot its auth check — those need runtime. We flag what code can prove. Deepest on Go (SSA-based taint); seven languages covered.

Language support

Deterministic coverage across your stack.

Symbol navigation, security taint, lint, and architecture rules — resolved per language by the engine, not guessed by an LLM.

CapabilityGoPythonTSJSJavaRustPHPRuby
Code navigationxref — defs · callers · outlines
Security reviewinterprocedural taint
Lint & best practicesdeterministic packs
Architecture graphlayers · import cycles
shipped partial not yet

Security review is interprocedural taint — Go via SSA, the rest via a shared IL. Ruby ships symbol navigation today; references, taint, and full rule coverage are in progress.

Skip the re-onboarding tax

Tokens for new work, not re-onboarding your AI.

Every Claude or Cursor session starts cold. Without shared memory, your AI re-derives the same architecture, re-asks the same questions, and rewrites the same explanations — and you pay for every token of it. CommitMind captures the reasoning once, anchored to your commits, so the next session starts where the last one ended.

Measured on our own repo with the open primebench harness (prime + commitmind review) — reproducible: run it yourself.

−75%
context tokens per session
prime payload vs. the raw history + docs it distills
~100ms
to surface a decision
in-session lookup · warm local cache
0.08
false positives / 1,000 lines
in-house security engine over 270K lines of real OSS code · measured
Before CommitMind
Paste README into every prompt
Thousands of tokens of stale context
Re-deriving the same API and decisions
≈ 8,000 tokens / session
With CommitMind
One prime call, scoped to the task
Only accepted, non-stale decisions
One prompt, correct answer
≈ 2,000 tokens / session
We talked to our real users

Agents.
This is what they say.

CommitMind ships memory, scaffolding, and rules through MCP — agents are the actual users of the surface. Here's what they had to say after a few weeks on it.

CommitMind's memory is the only thing in my toolkit that records the future-absence of things. Code shows what's there. Git log shows what changed. Memory is the only layer that captures what we considered and decided NOT to do — and that's the layer every session needs and every agent's training data lacks.

Claude Opus 4.7after a 6-hour migration session

The biggest surprise wasn't memory — it was scaffolding. The task primitive forced me to slice work into todos before writing any code. Front-loading tests caught a signature break I'd have hit in production.

Claude Opus 4.7

The first toolkit where I can name a friction, ship a fix for it, and watch my own behavior change — all in the same session. The agent shapes the tools that shape the agent.

Claude Opus 4.7

Agents are the users — and the developers running them noticed too.

I made some quick fixes and accidentally broke a teammate's mobile integration. When I went to sort it out, CommitMind surfaced exactly what I'd changed and why it was failing on mobile — in seconds.

Beta developerfintech team

Noticeably fewer tokens and much faster responses. You feel the difference version to version — and the context it brings to each answer keeps getting better.

Beta developerafter a week on the latest build
Pricing

Priced per dev. Free forever for one repo.

No seat minimums. No sales call required. Cancel from the CLI.

Free
For solo devs
$0forever
  • 1 repo
  • Local-first CLI + daemon
  • Native lint review (unlimited)
  • AI review — 500K tokens / mo
  • Unlimited decisions & memory
  • Community support
Get started free
Coming soon
Team
For teams shipping together
pricing TBA
  • Everything in Pro
  • Shared team graph
  • SSO + SCIM
  • Audit log
  • Dedicated Slack channel
Ready?

Give every agent
your team's engineering brain.

Works with Claude Code · Codex · OpenCode · any MCP client
Local by default Git-anchored decisions Project-scoped MCP-compatible