CodeLore

What it answers

Static analyzers read your code at a single point in time. CodeLore reads its history — and that history answers questions static tools can't.

• Bus-factor risk Which complex hotspots are owned by a single contributor — what happens when they go on leave?
• Hidden architectural debt Which files are implicitly coupled — always modified together — but live in different subsystems?
• Refactoring ROI Which highly complex files are actively changing (refactor!) versus stable (leave them alone)?
• Live clones Which copy-pasted blocks keep being edited in lockstep (real debt) versus dead patterns nobody touches (noise)?
• Tangles worth untangling Which dependency cycles are live and hot versus fossils nobody touches — and which single file is the best extraction point?
• "Is a 78 actually good?" How does this file's complexity — and this repo's architecture — compare to a reference corpus of real OSS projects, or your own org's portfolio? And because that corpus is finite, every percentile carries a 95% confidence interval.

In your workflow

Every number comes from a published, deterministic formula — no opaque ML — and everything runs against the repository on your disk: no account, no server, no telemetry.

• CI & pull requests Native SARIF 2.1.0 for GitHub Code Scanning and friends, codelore diff PR-mode deltas, and codelore check quality gates with commit evidence chains — gates that tell refactoring from rot, exempting health-improving churn from the red-band effort ceiling so a hardening campaign doesn't trip its own gate.
• AI coding agents codelore gate and its MCP twin gate_changes weigh your uncommitted working tree against HEAD before you commit — projected code-health delta, newly-introduced import cycles, working-tree-only clones. change_context briefs the agent on a file's owners, co-change partners, and calibrated risk before it writes. And codelore mcp serves every analysis over stdio — fully local.
• Humans One self-contained HTML dashboard — six navigable sections from hotspots to delivery flow, a dependency matrix with a structure×history fusion mode, linked brushing across every widget, an off-boarding simulation — shareable as a single file.

Calibrated, and honest about it

Every score is a published, deterministic formula — no opaque ML. And where a number is an estimate rather than a fact, CodeLore shows you the uncertainty instead of hiding it.

• Confidence intervals on the benchmark Corpus-relative percentiles carry a Wilson 95% confidence interval. A percentile drawn from a finite reference corpus is a sample estimate, not a population fact — so every one ships its lower and upper bound. We're not aware of another tool that shows the uncertainty in its benchmarks.
• Validated against your own bugs codelore calibrate-defects mines this repository's own fix history and reports whether the health score predicts where defects actually land — ROC AUC and precision@k against the defect-implicated files. The SZZ blame that links each fix to its origin is guarded against tangled and whole-file-deletion (ghost) fixes, so the labels stay sharp. Association, not causation; every figure carries its sample size.
• Honest about graph coverage The architecture metrics disclose how much of the import graph actually resolved. A repo whose imports mostly point at third-party code has a sparse dependency graph — CodeLore reports the low coverage rather than rendering a deceptively clean architecture.
• A receipt for every run Each run emits a provenance sidecar recording every threshold, version pin, and config knob — so "we got different numbers because we silently used different settings" stops being a mystery.

How it compares

GitHub Code Quality brings native PR integration, zero setup on GitHub-hosted repos, and CodeQL's rule depth to point-in-time static analysis. CodeLore's angle is different — and complementary.

• Analysis signal Point-in-time static findings versus git-history behavioral signal: hotspots, change coupling, ownership, defect-calibrated risk.
• Where it runs Hosted CI on GitHub's infrastructure versus a single portable binary, offline-capable — the same one gates this repository's own CI.
• Cost model Per-committer subscription plus metered CI compute and AI credits versus free and open source.
• In the agent loop No pre-commit gate versus codelore gate with the gate_changes and change_context MCP tools — a behavioral verdict on uncommitted changes before they land.
• Agent surface None versus a local MCP server exposing every analysis as an agent tool.
• Data residency Code analyzed in GitHub's cloud versus nothing leaving the machine.

This is a comparison with the Code Quality product, not the Code Scanning integration above — CodeLore's SARIF output feeds GitHub Code Scanning directly; the two sit side by side rather than competing.

Install

Pick whichever fits your machine.

# Homebrew (macOS or Linuxbrew, arm64 or x86_64):
brew install emrecdr/codelore/codelore

# Prebuilt binary via cargo-binstall (any Rust dev environment):
cargo binstall codelore

# Container (distroless; the entrypoint is the codelore binary):
docker run --rm -v "$PWD":/repo ghcr.io/emrecdr/codelore:latest analyze --analysis hotspots --repo /repo

# From source (Rust 1.96+ toolchain required):
cargo install --git https://github.com/emrecdr/codelore codelore-cli

Add --features spa to the source build for the optional interactive dashboard emitter, or grab a prebuilt archive from a GitHub Release (five targets per tag, each with SLSA L3 build provenance).

Benchmarks

A weekly workflow runs CodeLore's end-to-end benchmarks and publishes the performance trend over time.

Benchmark trends → — regression tracking across releases, updated as each weekly run lands.