One layer your engineers and your agents both build within: memory of the why, rules that gate the diff, and architecture you describe in plain English. Local-first — works with Claude Code, Codex, or any MCP client.
CommitMind runs as a single local daemon. Claude Code, Codex, OpenCode, Cursor, VS Code, and any MCP client connect to it — sharing the same memory, rules, and reviews. Your code and context never leave your machine.
commitmind explain <symbol> returns the decision behind every line — anchored to the SHA, the rationale, and the teammate who made the call. Auto-injected before your AI edits.
The decision you made last Tuesday is the context your next session starts with — no re-deriving, no re-reading. And when you're on a team, your reasoning becomes theirs too. No meeting. No Loom. No ADR doc no one reads.
A session-end worker reads what just happened, summarizes it, and proposes durable lessons. Your next session gets them injected at startup — top-K relevant — so you stop repeating the same mistakes and your AI stops suggesting them.
Pre-curated, pattern-matched packs across 8 languages — security, best-practices, lint, and architecture — plus the project rules you grow yourself, battle-tested the moment you connect. Co-authored with your AI, approved by humans, enforced in-session before code ships.
Say what you want enforced in plain English. The model writes the rule — then the engine compiles it and dry-runs it against your real code, so you see exactly what it would flag before it can ever block a PR. AI-authored, engine-verified, never raw output.
One conversation authors any rule — architecture boundaries, code patterns, size limits, and scoping.
commitmind reviewand the pre-commit gate read your diff in-session — deterministic rules plus an AI reviewer flag real bugs, banned APIs, and the decisions you're about to break, before the code ever lands. Every finding makes the next diff cleaner.
The same deterministic engine runs at the pre-commit gate and across every file — the OWASP/GOSEC security pack flags real vulnerabilities with interprocedural taint, not regex guesses.
Multi-step work follows a playbook the agent loads automatically. Four-phase spine — todos survive compaction, the next session resumes from the first ☐.
Tree-sitter symbol index across Go, Python, TypeScript, JavaScript, Java, Rust, PHP, and Ruby. Send the right symbol with the right context — not the whole file.
The CommitMind panel for VS Code & Cursor puts active tasks, decisions, and the in-session reviewer beside your editor — and mind commit runs the staged review and links the commit to your task without leaving the terminal.
51// Charge captures a payment for an order.52func Charge(53 ctx context.Context, orderID string, amount int64,54) (*Receipt, error) {55 return gateway.Capture(ctx, orderID, amount)56}We don't just score against the OWASP Benchmark (F1 0.88, precision 0.85 / recall 0.91) — we run the same engine across 26 mature OSS codebases, 270K lines of real production code, and publish what it finds: just 0.08 false-positives per 1,000 lines, with 111 real known-CVE dependency advisories surfaced as a separate bucket. Signal, not noise.
● full · ○ partial. And we say where it stops: static analysis can't see missing MFA, brute-force gaps, or a route that forgot its auth check — those need runtime. We flag what code can prove. Deepest on Go (SSA-based taint); seven languages covered.
Symbol navigation, security taint, lint, and architecture rules — resolved per language by the engine, not guessed by an LLM.
| Capability | Go | Python | TS | JS | Java | Rust | PHP | Ruby |
|---|---|---|---|---|---|---|---|---|
| Code navigationxref — defs · callers · outlines | ||||||||
| Security reviewinterprocedural taint | ||||||||
| Lint & best practicesdeterministic packs | ||||||||
| Architecture graphlayers · import cycles |
Security review is interprocedural taint — Go via SSA, the rest via a shared IL. Ruby ships symbol navigation today; references, taint, and full rule coverage are in progress.
Every Claude or Cursor session starts cold. Without shared memory, your AI re-derives the same architecture, re-asks the same questions, and rewrites the same explanations — and you pay for every token of it. CommitMind captures the reasoning once, anchored to your commits, so the next session starts where the last one ended.
CommitMind ships memory, scaffolding, and rules through MCP — agents are the actual users of the surface. Here's what they had to say after a few weeks on it.
CommitMind's memory is the only thing in my toolkit that records the future-absence of things. Code shows what's there. Git log shows what changed. Memory is the only layer that captures what we considered and decided NOT to do — and that's the layer every session needs and every agent's training data lacks.
The biggest surprise wasn't memory — it was scaffolding. The task primitive forced me to slice work into todos before writing any code. Front-loading tests caught a signature break I'd have hit in production.
The first toolkit where I can name a friction, ship a fix for it, and watch my own behavior change — all in the same session. The agent shapes the tools that shape the agent.
I made some quick fixes and accidentally broke a teammate's mobile integration. When I went to sort it out, CommitMind surfaced exactly what I'd changed and why it was failing on mobile — in seconds.
Noticeably fewer tokens and much faster responses. You feel the difference version to version — and the context it brings to each answer keeps getting better.
No seat minimums. No sales call required. Cancel from the CLI.