HefestoAI

HefestoAI — release truth engine for AI-generated code

English | 简体中文 | 日本語

[Hefesto Demo]

HefestoAI runs after your AI assistant writes the code and before it ships. It checks that what your project declares (dependencies, configs, install artifacts) matches what it actually does, and it runs security and complexity checks on the code itself.

[PyPI version] [Python 3.10+] [License: MIT] [Languages]

Quick start (GitHub Action)

Deterministic pass/fail check for agent-written code. It compares what your repo declares (dependencies, README, pyproject.toml, CHANGELOG, action.yml, CI) with what it actually does, and flags secrets and risky IaC. Same input, same result.

# .github/workflows/hefesto.ymlname: HefestoAIon: [pull_request, push]permissions:  contents: read  security-events: writejobs:  hefesto:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - uses: artvepa80/Agents-Hefesto@v4        with:          fail_on: HIGH          sarif: 'true'

Findings show up under Security > Code scanning and as pull request annotations. Public repositories work as shown; private repositories without GitHub Code Security set upload_sarif: 'false' (the SARIF file is still written). @v4 follows every 4.x release, minors included (4.16.0 made a run that analyzes no files fail the gate). For a fixed version, pin artvepa80/[email protected] or a commit SHA. The Action runs the same formats as hefesto analyze: Python plus YAML, Terraform, Shell, Dockerfile, SQL, PowerShell, JSON, TOML, Makefile, Groovy, COBOL, CloudFormation, ARM, Helm and Serverless, plus the drift checks. TypeScript, JavaScript, Java, Go, Rust and C# need the CLI with pip install "hefesto-ai[multilang]".

Free and MIT. PRO ($8/mo per user) and OMEGA ($19/mo): plans.

Operational Truth Analyzers (v4.20.4)

These analyzers look for drift between what your project declares and what it does. They run on every hefesto analyze. The problems they look for don't live in any single file, so a per-file linter or security scanner won't report them: they show up only when you compare two files.

# All operational truth findings appear in standard outputhefesto analyze . --severity MEDIUM

Quick Start

pip install hefesto-aicd your-projecthefesto analyze . --fail-on critical
# PR review (added in v4.10.0) — analyze only changed codehefesto pr-reviewhefesto pr-review --strict        # include file-level contexthefesto pr-review --post --pr 42  # post inline comments via gh CLI

Why Hefesto? The AI Code Problem

Assistants such as Claude Code, GitHub Copilot and Cursor write code faster than anyone can review it line by line. Some of what they write passes a linter and is still dangerous:

• os.system(user_input) → command injection
• f"SELECT * FROM {table}" → SQL injection
• code that runs but quietly changes behavior, such as a misspelled attribute or an exception that is caught and dropped (checked in Python)

Hefesto checks for these at pre-commit, at pre-push and in CI, so they surface before the code reaches production.

What Hefesto Catches

# Hefesto catches:password = "admin123"  # HARDCODED_SECRETquery = f"SELECT * FROM users WHERE id={id}"  # SQL_INJECTION_RISKos.system(f"rm {user_input}")  # COMMAND_INJECTION
# Hefesto suggests:password = os.getenv("PASSWORD")cursor.execute("SELECT * FROM users WHERE id=?", (id,))subprocess.run(["rm", user_input], check=True)

GitHub Action

steps:  - uses: actions/checkout@v4  - name: Run Hefesto Guardian    uses: artvepa80/Agents-Hefesto@v4    with:      target: '.'      fail_on: 'CRITICAL'

@v4 is a floating tag that follows the whole 4.x line, minor releases included: every v4.x.y release moves it, so the workflow gets fixes without edits, and also behaviour changes such as the 4.16.0 change that makes a run with no analyzed files fail --fail-on (exit 1; --allow-no-files opts out). If you need exact stability, pin an exact release tag such as artvepa80/[email protected] (exact tags never move) or a commit SHA, and bump it yourself.

With SARIF upload to GitHub code scanning (findings appear under Security > Code scanning and as pull request annotations):

jobs:  hefesto:    runs-on: ubuntu-latest    permissions:      contents: read      security-events: write   # upload-sarif      actions: read            # private repositories only    steps:      - uses: actions/checkout@v4      - uses: artvepa80/Agents-Hefesto@v4   # SARIF needs v4.15.0 or later        with:          target: '.'          fail_on: 'CRITICAL'          sarif: 'true'

The Action is a composite action: it installs HefestoAI from the Action's own checkout into a private virtualenv (needs python3 >= 3.10 on the runner; ubuntu-latest has it), runs hefesto analyze, and with sarif: 'true' uploads the SARIF file with github/codeql-action/upload-sarif@v4, also when the fail_on gate fails. Full reference: docs/github-action.md.

Inputs:

Outputs:

AI-Generated Code Guardrails (Pre-commit + MCP)

HefestoAI can run as a pre-commit check or be called by an AI agent over MCP, so risky changes are flagged before merge.

Add as an MCP server:

npx @smithery/cli@latest mcp add artvepa80/hefestoai

Add to Cursor (one click):

[Add HefestoAI MCP server to Cursor]

The button opens Cursor's install prompt through cursor.com/link (GitHub does not render cursor:// links). Direct deeplink: cursor://anysphere.cursor-deeplink/mcp/install?name=hefestoai&config=eyJ1cmwiOiJodHRwczovL2hlZmVzdG9haS5uYXJhcGFsbGMuY29tL2FwaS9tY3AtcHJvdG9jb2wifQ%3D%3D. The same server is in .mcp.json at the repository root ({"mcpServers":{"hefestoai":{"url":"https://hefestoai.narapallc.com/api/mcp-protocol"}}}). No API key.

API Endpoints:

The MCP analyze tool (and POST /api/analyze) runs the open-source engine (hefesto analyze --no-config; the hosted MCP runs a recent hefesto-ai release) on the files you send: at most 20 files, 100 KB each, 256 KB in total, 20 seconds. It returns findings with rule ids, severities, lines and SARIF fingerprints. TypeScript, JavaScript, Java, Go, Rust and C# are covered too (multilang grammars; the first such request on a fresh server instance is a few seconds slower). Nothing is stored. For a whole repository, run hefesto analyze . locally.

The hosted MCP server is closed-source and operated by Narapa LLC. server.json keeps repository on this public repository because it contains the open-source hefesto-ai engine that analyze runs.

PR Review (v4.20.4)

Analyze only the code changed in a pull request and post inline comments on the changed lines. Each finding carries a deterministic dedup key, so a workflow can skip findings it has already posted (the deduped template below does this; the simple one does not).

# Generate review as JSON (default — no network, no token needed)hefesto pr-review
# Post inline comments via gh CLI (convenience mode)hefesto pr-review --post --pr 42 --repo owner/name
# Include file-level context findings (not just changed lines)hefesto pr-review --strict

How it works:

1. Parses git diff between base and head (auto-detects origin/main or GITHUB_BASE_REF)
2. Runs the full analyzer suite on touched files only
3. Filters findings to changed lines (default) or full files (--strict). A function-level finding (complexity, long function, deep nesting) is reported on the def line and counts as changed when any added line falls inside the function. Its line stays on the def line, so the dedup key does not move, and anchor_line is the added line that inline comments go on (null outside a hunk)
4. Emits JSON with SHA256 dedup keys for each finding

GitHub Actions workflow templates are provided under examples/github-actions/:

See examples/github-actions/README.md for setup instructions.

Language Support

Code Languages

¹ TreeSitter languages require the [multilang] extra: pip install "hefesto-ai[multilang]". Without it, files in these languages are skipped at parse time and Hefesto emits a stderr warning pointing to the install command (also exposed via report.meta.parser_failures in JSON output).

DevOps & Configuration

Cloud Infrastructure

Total: the package ships analyzers for 22 formats (7 code languages + 11 DevOps formats + 4 Cloud formats). hefesto analyze (which the GitHub Action and the pre-push hook call) runs all 22. When a suffix matches more than one format, the precedence table in docs/design/devops-analyzers-wiring.md chooses one analyzer.

² COBOL: all 16 rules are free; no license is needed. The analyzer is regex-based (no full COBOL parser) and reads .cbl, .cob, .cobol, .cpy and .pco files (lower or upper case), plus .dcl, .copy, .cbk and extension-less files that a scanned program COPYs or EXEC SQL INCLUDEs and that hold COBOL data definitions (copybooks get only the data rules COBOL004/COBOL008/COBOL009/COBOL016, COBOL007 and COBOL015 for their own nested COPYs; the other rules are not applied to them).

COBOL details (source format, per-rule behaviour, COPY expansion, measured recall, performance, SARIF): docs/cobol.md.

Installation

# FREE tierpip install hefesto-ai
# Required for TypeScript, JavaScript, Java, Go, Rust, and C# analysispip install "hefesto-ai[multilang]"
# Optional: Black, for `hefesto analyze --format-check`pip install "hefesto-ai[format]"

pip install hefesto-ai installs the FREE tier only. For PRO or OMEGA, Narapa sends you an activation code after purchase, and the activation instructions come with it.

CLI Reference (v4.20.4)

# Analyze codehefesto analyze <path>hefesto analyze . --severity HIGHhefesto analyze . --output jsonhefesto analyze . --format sarif > hefesto.sarif   # SARIF 2.1.0 (--format is an alias of --output)hefesto analyze . --sarif-file hefesto.sarif       # text report + SARIF filehefesto analyze . --format-check   # opt-in: also report Black formatting drifthefesto analyze . --config ci/hefesto.yaml    # explicit config file (see Configuration)hefesto analyze . --no-config                 # ignore .hefesto.yamlhefesto analyze src/ --copybook-path ../copylib  # COBOL copybooks outside the scanhefesto analyze . --include-vendored  # also analyze vendored/minified JS (skipped by default)
# PR review (added in v4.10.0)hefesto pr-review                              # JSON to stdouthefesto pr-review --base main --head HEAD      # explicit refshefesto pr-review --strict                     # file-level findings toohefesto pr-review --post --pr 42 --repo o/r    # post via gh CLI
# Check statushefesto status
# Install/update git hookhefesto install-hooks
# Start API server (PRO)hefesto serve --port 8000
# Telemetry (on by default)hefesto telemetry disable

JSON Output

hefesto analyze . --output json          # stdout = pure JSON, banners -> stderrhefesto analyze . --output json 2>/dev/null | jq .  # pipe-safe

SARIF Output

hefesto analyze . --format sarif > hefesto.sarif   # stdout = pure SARIF, banners -> stderrhefesto analyze . --sarif-file out/hefesto.sarif   # any --output, plus a SARIF file

SARIF 2.1.0 for every finding hefesto analyze reports (all analyzers it runs, COBOL included, plus Operational Truth and provider findings), validated against the OASIS schema in the tests:

• one rule per rule ID (COBOL004, DOCKER010, ...; the issue type such as HARDCODED_SECRET when an analyzer has no ID) with name, description, help, help URI and a default level;
• level: CRITICAL/HIGH -> error, MEDIUM -> warning, LOW -> note; security rules (secrets, injection, unsafe commands, ...) also get security-severity (9.5 / 8.0 / 5.5 / 3.0), so GitHub rates them Critical/High/Medium/Low;
• CWE, from one mapping (CWE list 4.20): GitHub code scanning reads the rule tag external/cwe/cwe-N (no zero-padding). The same id is a run.taxonomies CWE entry (organization MITRE) with a relationships kind on the rule (equal, superset or relevant). Python: secrets 798, SQL injection 89, command injection 78, eval/exec 95, bare except 396, pickle import 502 (relevant, precision low, because only the import is flagged). Assert has no CWE. A finding's metadata.cwe overrides the table; existing COBOL tags (cwe-798, cwe-20) stay as written. Table: docs/ANALYSIS_RULES.md;
• repo-relative URIs (%SRCROOT%, the git top level of the current directory) and partialFingerprints built from the rule, the file and the text of the flagged line, so alerts keep their identity when code above them moves;
• GitHub upload limits: at most 25,000 results (highest severity kept) and 10 MB gzipped; anything dropped is reported in the log's tool notifications.

Columns are not reported (start line only).

Formatting Drift (opt-in)

hefesto analyze does not check formatting by default. With --format-check it also runs Black in check mode (in-process, files are never modified) on the Python files it analyzed:

pip install "hefesto-ai[format]"                    # or: pip install blackhefesto analyze . --format-check                    # report drifthefesto analyze . --format-check --fail-on LOW      # fail the gate on drift

• Each file Black would reformat is one FORMAT_DRIFT finding, severity LOW. Because the check is opt-in, these findings are shown even when --severity is above LOW. --fail-on and --exclude-types apply to them like any other finding, so --fail-on MEDIUM (or higher) does not trip on drift.
• Black settings come from your pyproject.toml [tool.black] table, found the same way the black CLI finds it (line-length, target-version, skip-string-normalization, preview, extend-exclude / force-exclude, ...). If required-version does not match the installed Black, Hefesto warns.
• JSON output carries a unified diff (first 60 lines) in code_snippet and lines_added / lines_removed in metadata.
• If Black is not installed, Hefesto prints a one-line warning and continues; the exit code is unaffected.
• Only Black is covered; isort and flake8 are not run.

Exit Codes

Gate Examples

hefesto analyze . --fail-on high         # exit 1 if HIGH+ foundhefesto analyze . --fail-on critical     # exit 1 only if CRITICAL foundhefesto analyze .                        # always exit 0 (report only)hefesto analyze . --fail-on high --allow-no-files   # an empty run keeps exit 0hefesto analyze . --fail-on high --allow-not-analyzed  # a file that failed does not fail the gate

A run that analyzes no files (empty directory, only unsupported files, or every file excluded) is never reported as a pass: the report says "No files were analyzed", a warning naming the path goes to stderr, and with --fail-on the gate fails with exit 1. When files were left out as vendored JavaScript, the warning names how many and suggests --include-vendored.

For runs that are empty on purpose (a changed-files-only job on a PR that touches only Markdown, a monorepo matrix entry with no supported sources), pass --allow-no-files (the Action's allow_no_files: 'true' input passes it for you). Only the exit code changes: the run keeps exit 0 and prints "Gate skipped: no files were analyzed (--allow-no-files)", while "Files analyzed: 0", "No files were analyzed" and the stderr warning are still printed. It is a command-line flag only: .hefesto.yaml cannot set it (an allow_no_files key is rejected as unknown, exit 2), so a shared config never turns this check off.

A file that is not valid UTF-8 is read with the latin-1 fallback and analyzed (its findings count); the text report lists it under "Decoded with fallback (latin-1)", --output json has it in meta.decoded_with_fallback, SARIF has a warning notification for it, and stderr warns about it.

A file the run found but could not analyze (it could not be read, or its analyzer raised an error) is never dropped silently: the text report lists it under "Not analyzed" with the reason, --output json has it in meta.not_analyzed (path, language, reason: read_error or analyzer_error, exception), SARIF has an error notification for it in invocations[0].toolExecutionNotifications, and a warning goes to stderr (also with --quiet). With --fail-on such a file fails the gate with "Gate failure: N file(s) could not be analyzed (exit 1)", also when --allow-no-files is set. --allow-not-analyzed (the Action's allow_not_analyzed: 'true' input) opts out: the gate then judges only the findings, and the file is still listed and warned about. Like --allow-no-files, it is a command-line flag only. --allow-not-analyzed does not cover a path where no file was analyzed at all (for example hefesto analyze a.ts without the TypeScript parser): that is the zero-files case, which still exits 1 with --fail-on unless --allow-no-files is set. When a missing parser is the cause, the warning says so: parser unavailable for typescript (pip install "hefesto-ai[multilang]").

Pre-Push Hook

In your own project, hefesto install-hooks installs the hooks shipped with the package: pre-commit analyzes the staged (index) content of the staged files (--fail-on HIGH), pre-push analyzes the repository (--fail-on CRITICAL). The hooks call the Python interpreter that ran install-hooks (python -m hefesto), fall back to hefesto on PATH, and fail with a message if neither is found (reinstall the hooks or set SKIP_HEFESTO_HOOKS=1). The hooks go to git rev-parse --git-path hooks, so worktrees and submodules work; if core.hooksPath is set (Husky, lefthook...), nothing is written and the command exits 1: call python -m hefesto analyze from that hook manager or use the hefesto-analyze pre-commit framework hook (see pre-commit Hook). It also exits 1 when no hook was installed (for example, existing hooks without --force). The contributor hooks from scripts/git-hooks/ described below are used only in a clone of Agents-Hefesto (root pyproject.toml with name = "hefesto-ai"); the command says which set it installed.

Automatic validation before every git push in this repository:

# Install the same hooks and print the plans link (PRO $8/mo, OMEGA $19/mo)hefesto init
# Install/update hook (copies scripts/git-hooks/pre-push -> .git/hooks/pre-push)hefesto install-hooks
# Update an existing hookhefesto install-hooks --force
# Bypass temporarilySKIP_HEFESTO_HOOKS=1 git push

The hook runs two gates:

1. Security gate — hefesto analyze with --fail-on CRITICAL --exclude-types VERY_HIGH_COMPLEXITY,LONG_FUNCTION (blocks security issues, ignores complexity debt)
2. Fast lint/test gate — Black, isort, Flake8, and a minimal test suite

Note: Hooks are local to your machine and not committed to git. Run hefesto install-hooks after cloning or whenever scripts/git-hooks/pre-push is updated.

Features by Tier

• PRO ($8/mo per user) and OMEGA ($19/mo): plans and checkout

Hefesto PRO Optional Features

Hefesto OSS works standalone. If Hefesto PRO is installed, OSS can optionally enable: Patch C API hardening for hefesto serve, scope gating (first-party by default), TS/JS symbol discovery, and safe deterministic enrichment (schema-first, masked, bounded). See docs/PRO_OPTIONAL_FEATURES.md.

REST API (PRO), OMEGA Guardian and IRIS

hefesto serve (PRO) exposes the analyzer over HTTP: docs/rest-api.md. OMEGA Guardian and the IRIS production-monitoring agent: docs/omega-iris.md.

CI/CD Integration

GitHub Actions — Full Repo Analysis

name: Hefesto
on: [push, pull_request]
jobs:  analyze:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4      - name: Install Hefesto        run: pip install hefesto-ai      - name: Run Analysis        run: hefesto analyze . --severity HIGH

GitHub Actions — Code Scanning (SARIF) with the CLI

jobs:  analyze:    runs-on: ubuntu-latest    permissions:      contents: read      security-events: write    steps:      - uses: actions/checkout@v4      - run: pip install hefesto-ai      - run: hefesto analyze . --severity LOW --fail-on CRITICAL --sarif-file hefesto.sarif      - if: always()        uses: github/codeql-action/upload-sarif@v4        with:          sarif_file: hefesto.sarif          category: hefesto

GitHub Actions — PR Review with Inline Comments (v4.20.4)

name: Hefesto PR Review
on:  pull_request:    types: [opened, synchronize, reopened]
permissions:  contents: read  pull-requests: write
jobs:  review:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4        with:          fetch-depth: 0      - run: pip install hefesto-ai      - name: Review changed code        env:          GITHUB_BASE_REF: ${{ github.event.pull_request.base.ref }}          GITHUB_SHA: ${{ github.event.pull_request.head.sha }}          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}        run: hefesto pr-review --post --pr ${{ github.event.pull_request.number }} --repo ${{ github.repository }}

For production use with dedup (no duplicate comments on reruns), see the workflow templates in examples/github-actions/.

pre-commit Hook

# .pre-commit-config.yamlrepos:  - repo: https://github.com/artvepa80/Agents-Hefesto    rev: v4.20.4    hooks:      - id: hefesto-analyze

GitLab CI

hefesto:  stage: test  script:    - pip install hefesto-ai    - hefesto analyze . --severity HIGH

Configuration

hefesto analyze takes its options from command-line flags (see CLI Reference above) and, optionally, from a .hefesto.yaml file (below). There is no environment variable for analysis options such as severity or output format.

Environment Variables

# Telemetry (see Telemetry below)export HEFESTO_TELEMETRY=0                            # Disable usage events
# PRO/OMEGA only (read by the private distribution, ignored by the FREE tier)export HEFESTO_LICENSE_KEY="your-key"
# API Security (PRO, v4.7.0) -- used by `hefesto serve`export HEFESTO_API_KEY="your-api-key"                # Enable API key authexport HEFESTO_RATE_LIMIT_PER_MINUTE=60               # Enable rate limitingexport HEFESTO_CORS_ORIGINS="https://app.example.com" # Restrict CORSexport HEFESTO_EXPOSE_DOCS=1                          # Enable /docs, /redocexport HEFESTO_WORKSPACE_ROOT="/srv/code"              # Path sandbox rootexport HEFESTO_CACHE_MAX_SIZE=1000                     # Cache size limitexport HEFESTO_CACHE_TTL_SECONDS=300                   # Cache entry TTL

Config File (.hefesto.yaml)

Put the hefesto analyze options you would otherwise repeat on every run in a .hefesto.yaml (or .hefesto.yml) file, usually at the repository root:

# .hefesto.yaml -- every key is optional and maps to a `hefesto analyze` flagseverity: MEDIUM            # --severity      LOW | MEDIUM | HIGH | CRITICALfail_on: HIGH               # --fail-on       LOW | MEDIUM | HIGH | CRITICALoutput: text                # --output        text | json | htmlexclude:                    # --exclude       list or "a/,b/" string  - tests/  - node_modules/exclude_types:              # --exclude-types list or comma-separated string  - VERY_HIGH_COMPLEXITY  - LONG_FUNCTIONquiet: false                # --quietmax_issues: 50              # --max-issuesformat_check: true          # --format-check  (needs: pip install "hefesto-ai[format]")enable_memory_budget_gate: false  # --enable-memory-budget-gatecopybook_paths:             # --copybook-path (COBOL copybook directories outside the scan)  - ../copylib              # relative paths are resolved from this file's directoryinclude_vendored: false     # --include-vendored (analyze vendored/minified JavaScript too)

• Excluded by default: .venv/, venv/, .tox/, node_modules/, .git/, __pycache__/, dist/, build/, .mypy_cache/, .pytest_cache/, .eggs/, *.egg-info/ (whole path components below the analyzed path), plus vendored and minified JavaScript (.js, .mjs, .cjs): *.min.js / *-min.js files, files under vendor/, vendors/, bower_components/ or jspm_packages/, and files under a lib/, libs/, plugins/, third_party/ or thirdparty/ directory inside static/, assets/, public/ or wwwroot/ (for example static/js/libs/jquery.js). A top-level lib/ is the project's own code and stays in scope, as do non-JavaScript files under vendor/ (Go, PHP). --include-vendored (or include_vendored: true) analyzes the JavaScript ones again; a single file given on the command line is always analyzed. The summary says how many were left out (N files skipped as vendored (use --include-vendored); meta.vendored_skipped in JSON, a tool notification in SARIF).

• critical_tests (preview): an optional section that maps requirements to pytest tests for the critical-test regression guard. hefesto analyze validates it and otherwise ignores it; see docs/critical-tests.md.

• exclude entries are path segments, not globs. Each entry matches whole path components below the analyzed path (tests/fixtures/ skips tests/fixtures/...); * and ** are taken literally, so tests/fixtures/** or *.json match nothing even though "Excluding: ..." lists them. A file or directory given explicitly on the command line is not filtered by exclude.

• Discovery: Hefesto starts at the first path given to hefesto analyze (its directory if it is a file) and walks up to the repository root (the first directory containing .git), or to the filesystem root outside a repo. The nearest file wins. Both .hefesto.yaml and .hefesto.yml in one directory is an error. With several paths, the first path's config applies to the whole run (Hefesto warns if another path would pick a different file).

• Precedence: explicit flag > config file > built-in default. A flag counts as explicit even when it repeats the default (--severity MEDIUM overrides severity: LOW). Lists are replaced, not merged: --exclude docs/ ignores the file's exclude.

• Flags: --config PATH uses that file instead of searching; --no-config ignores config files. They cannot be combined.

• Validation: unknown keys, bad values and invalid YAML stop the run with exit code 2 and a message naming the problem, e.g. Error: invalid Hefesto config in /repo/.hefesto.yaml: 'severity' must be one of LOW, MEDIUM, HIGH, CRITICAL (got 'urgent'). Keys may use - or _ (fail-on or fail_on); null means "not set".

• The file in use is printed as Config: <path> (to stderr with --output json; hidden with --quiet).

• Only hefesto analyze reads it (not pr-review or the GitHub Action inputs). Rule thresholds (cyclomatic complexity, etc.), --save-html and the PRO scope/enrichment flags are not configurable through the file.

vs. Competition

*Semgrep Supply Chain and Secrets are priced separately. **Snyk Team covers up to 10 developers; Enterprise is credit-based. Prices from each vendor's official pricing page, checked Oct 2026; they change often.

Where HefestoAI fits: most tools check code against the rules of its language. HefestoAI also checks a project against its own declarations: whether the imports match the declared dependencies, whether the versions in pyproject.toml, the CHANGELOG and the README agree, and whether action.yml and the Dockerfile match the files they reference.

Dogfooding (Honest Account)

We run HefestoAI's strict gate against HefestoAI's own code on every push to main. The gate has been GREEN since 2026-04-29, and getting there took more than six weeks: we logged the findings on 2026-03-17.

In strict mode, the gate flagged 12 complexity findings in our own gate-internals code (2 CRITICAL, 10 HIGH). We considered three responses: silence the findings (rejected — that's exactly the drift we critique), accept the override permanently (rejected — same reason), or refactor at root cause (chosen). The root-cause refactor itself was short once we started it: one PR, written over two days (2026-04-27 and 04-28) and merged on 2026-04-29. Along the way we also found a declared-vs-real drift in our own positioning doc and logged it for a fix.

The full audit and refactor history are tracked internally in our private repo. The refactor took the two CRITICAL functions from cyclomatic complexity 33 → 1 and 25 → 6, all helpers under 10. The 10 HIGH findings are under a temporary override whose mechanics and reversion criteria are documented.

Telemetry

The CLI sends anonymous usage events to PostHog by default (a random id; analyze also sends file and issue counts, duration, exit code, version, OS, Python, and ci/docker/dogfood plus pypi or editable — no code, file paths, findings or repository names, and no IP field in the payload). Turn them off with hefesto telemetry disable, HEFESTO_TELEMETRY=0, or DO_NOT_TRACK=1. The GitHub Action sends no usage events unless you set telemetry: 1. Separately, hefesto analyze asks pypi.org for the latest version (1.5 s timeout, cached for 24 hours). hefesto telemetry disable does not stop that check. From 4.20.3 the settings below skip it; 4.20.2 and earlier have no setting to disable it. Details: docs/telemetry.md.

The PyPI newer-version check is skipped, with no request and no cache write, when HEFESTO_NO_UPDATE_CHECK is 1, true, yes, or on, when HEFESTO_TELEMETRY is 0, false, no, or off, or when DO_NOT_TRACK is 1, true, yes, or on. Usage events stay on by default. The Action's default telemetry: 0 exports HEFESTO_TELEMETRY=0, so that check does not run on runners.

Changelog

Release history: CHANGELOG.md.

Contact

• Enterprise & licensing: [email protected]
• Support & bug reports: [email protected]
• General inquiries: [email protected]
• GitHub Issues: artvepa80/Agents-Hefesto/issues
• Website: hefestoai.narapallc.com

License

The code in this repository is licensed under the MIT License. The paid PRO and OMEGA features (the separately distributed hefesto_pro add-on) are covered by separate commercial terms in LICENSE-COMMERCIAL.md. Questions about licensing: [email protected].

(c) 2026 Narapa LLC, Miami, Florida