[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-92513":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":15,"subscribersCount":15,"size":15,"stars1d":15,"stars7d":15,"stars30d":16,"stars90d":15,"forks30d":15,"starsTrendScore":15,"compositeScore":17,"rankGlobal":10,"rankLanguage":10,"license":18,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":21,"hasPages":19,"topics":22,"createdAt":10,"pushedAt":10,"updatedAt":43,"readmeContent":44,"aiSummary":45,"trendingCount":15,"starSnapshotCount":15,"syncStatus":16,"lastSyncTime":46,"discoverSource":47},92513,"brain0","Brain0-ai\u002Fbrain0","Brain0-ai","The black box for AI-written code. Passive decision graph linking every commit to the agent prompts behind it: drift detection, DLP audit of what agents read, evidence-driven risk, MCP memory for coding agents, signed provenance attestations. One command, offline by default.","",null,"Rust",133,12,130,0,2,43.54,"Apache License 2.0",false,"main",true,[23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"ai","ai-agents","attestation","audit","claude","cli","code-review","coding-agents","developer-tools","dlp","git","llm","local-first","mcp","observability","provenance","rust","security","supply-chain-security","typescript","2026-07-22 04:02:06","\u003Cdiv align=\"center\">\n\n\u003Cpicture>\n  \u003Csource media=\"(prefers-color-scheme: dark)\" srcset=\"docs\u002Fassets\u002Fbrain0-wordmark-dark.svg\">\n  \u003Cimg alt=\"brain0\" src=\"docs\u002Fassets\u002Fbrain0-wordmark-light.svg\" width=\"380\">\n\u003C\u002Fpicture>\n\n\u003Cbr\u002F>\n\n**The black box for AI-written code.**\n\n`git` tells you *what* changed. brain0 tells you *why*: which prompt wrote it,\nwhat the agent **read** to write it, and whether you can trust it.\n\n[![CI](https:\u002F\u002Fgithub.com\u002FBrain0-ai\u002Fbrain0\u002Factions\u002Fworkflows\u002Fci.yml\u002Fbadge.svg)](https:\u002F\u002Fgithub.com\u002FBrain0-ai\u002Fbrain0\u002Factions\u002Fworkflows\u002Fci.yml)\n[![License: Apache-2.0](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-Apache_2.0-blue.svg)](.\u002FLICENSE)\n[![npm](https:\u002F\u002Fimg.shields.io\u002Fnpm\u002Fv\u002Fbrain0?color=cb3837&logo=npm)](https:\u002F\u002Fwww.npmjs.com\u002Fpackage\u002Fbrain0)\n[![Rust](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fcore-Rust-e43717?logo=rust)](.\u002Fcrates)\n[![TypeScript](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fgui-TypeScript-3178c6?logo=typescript&logoColor=white)](.\u002Fpackages)\n[![PRs Welcome](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FPRs-welcome-27a644.svg)](.\u002FCONTRIBUTING.md)\n\n[Quickstart](#quickstart) · [What it answers](#the-questions-your-repo-cant-answer-today) ·\n[Give your agent memory](#give-your-agent-the-why-layer-mcp) · [How it works](#how-it-works) ·\n[Comparison](#how-it-compares) · [Docs](.\u002Fdocs)\n\n\u003C\u002Fdiv>\n\n---\n\nCoding agents now write most of the diff: continuously, in parallel, and opaquely.\nbrain0 **passively** builds a decision graph of your repository: every **commit** linked to\nthe **agent intents** behind it, down to the single **function**, with dated history, drift\ndetection, a DLP audit of what agents *read*, and a two-dimensional **risk score** rendered\ngreen → red. No hooks, no agent cooperation, no code changes: it reads git and the\ntranscripts your agents already write to disk.\n\n> Dogfooded from day one: brain0's own development is tracked by brain0.\n\n## Quickstart\n\n```bash\nnpx brain0 up\n```\n\nThat's it. From any repo, `up` infers the repo id from your git remote, indexes the git\nhistory (the **facts**), passively ingests your coding-agent sessions (the **intents**,\nwith Codex and Claude Code auto-discovered), and opens the GUI at `http:\u002F\u002Flocalhost:8787`:\nan explorable graph of your codebase, from repo to module, file and symbol, where clicking a\ncommit reveals the prompts behind it, per-file diffs, and risk at a glance.\n\nThen make it a habit:\n\n```bash\nbrain0 today             # morning triage: what agents did, riskiest first\nbrain0 report            # the accountability report (add --md to share it)\nbrain0 query \"why did the parser break\"   # root-cause debug over the graph\n```\n\n## What you need\n\nThe only hard requirement is **Node.js ≥ 20**. brain0 is offline-first: with nothing else\ninstalled it still works end to end: deterministic summaries, local feature-hash embeddings,\nzero egress. Local models make it *better*, never *required*.\n\n| Piece | Needed for | Without it |\n|---|---|---|\n| **Node.js ≥ 20** | everything (`npx brain0 up`) | (required) |\n| **git** | commit history (the facts side) | filesystem checkpoint mode (`brain0 watch`) |\n| **A coding agent**: Codex (`~\u002F.codex`) or Claude Code (`~\u002F.claude\u002Fprojects`), auto-discovered | the *why* layer: prompts, drift, reads\u002FDLP | graph of commits + code only |\n| **[Ollama](https:\u002F\u002Follama.com)** + models (below) | model-written summaries · semantic search · GUI smart chat | deterministic summaries · feature-hash embeddings · retrieval-only answers |\n| `ANTHROPIC_API_KEY` \u002F `OPENAI_API_KEY` (opt-in) | a hosted LLM for the GUI smart chat | local Ollama (default) |\n\n### Recommended local models\n\n```bash\nollama pull qwen3:4b               # summarizer (default)\nollama pull qwen3-embedding:0.6b   # embeddings (default; nomic-embed-text is the auto-fallback)\n```\n\nBoth run on modest hardware. On a small GPU (≈4 GB VRAM) use a lighter summarizer for the\nfirst, cache-populating run. Summaries are content-cached in `~\u002F.cache\u002Fbrain0\u002F`, so every\nlater rebuild costs zero model calls (and even an interrupted run keeps its work):\n\n```bash\nBRAIN0_SUMMARIZER_MODEL=qwen3:1.7b npx brain0 up\n```\n\nIf a configured model is missing, brain0 tells you exactly what to pull and degrades\ngracefully (embedder falls back to `nomic-embed-text`, then local). Every choice is\noverridable: `BRAIN0_SUMMARIZER_{PROVIDER,MODEL,ENDPOINT}`, `BRAIN0_EMBED_{PROVIDER,MODEL,ENDPOINT,DIM}`,\n`BRAIN0_LLM_PROVIDER`. Details in [`docs\u002Fmodels.md`](.\u002Fdocs\u002Fmodels.md).\n\n## The questions your repo can't answer today\n\n- *Which prompt introduced this bug?*\n- *Who (agent or human) touched this function, when, and **why**?*\n- *The agent claimed it \"changed little.\" **Did it?***\n- *Did any session read `.env` or a private key before pushing code?*\n- *This change looked harmless. Did it later prove dangerous?*\n\nbrain0 answers all five, by construction. Three of those answers exist nowhere else:\n\n### ① Drift: declared vs. done\nAgents narrate what they changed; git records what actually changed. brain0 reconciles the\ntwo and scores the gap. From brain0's own report:\n\n```\ndrift — declared vs done (41)\n  · [1.00] claude-code — changed but not declared: crates\u002Fbrain0-cli\u002Fsrc\u002Fmain.rs,\n           packages\u002Fgui\u002Fsrc\u002Fmain.ts … +12 more\n```\n\n### ② Sensitive reads: DLP for agent context\nbrain0 records which files each session **read** (paths and secret *kinds* only, never\nvalues), so you know what reached a possibly-remote model:\n\n```\nsensitive reads — DLP (7)\n  · claude-code read crates\u002Fbrain0-agentsrc\u002Fsrc\u002Fdriver.rs [env_secret]\n  · 8 read(s) outside the repo reached the model's context\n```\n\n### ③ Risk that learns: green → red\nEvery artifact carries an **a-priori** score (blast radius, churn, drift, diff size) fused\nwith an **a-posteriori** score fed by evidence (reverts, immediate fixes). A change that\n*looked safe but later proved dangerous* is flagged as a **gold signal**: the pattern\nworth studying.\n\n## Give your agent the \"why layer\" (MCP)\n\nThe same graph is a query channel your coding agent can call **before touching code**:\nprovenance-aware context, by reference, nothing heavy pushed through MCP.\n\n```bash\nclaude mcp add brain0 -- brain0 mcp\n```\n\n| Tool | What the agent learns |\n|---|---|\n| `brain0_context` | a file\u002Fsymbol's risk, recent history, and the intents (agent · model · drift) behind it |\n| `brain0_blame` | *which intent wrote this line*: `file:line` resolves to its symbol via live parsing |\n| `brain0_debug` | root-cause candidates for an issue, recency- and risk-aware |\n| `brain0_audit` | repo risk distribution, gold signals, riskiest nodes |\n\nYour agent stops re-breaking what it can't remember. Uninstalling brain0 makes it\nforget again.\n\n## How it works\n\nbrain0 is a **pure observer**: it never writes to your repository.\n\n```\n            ┌───────────────────────── GUI (PixiJS \u002F TS) ─────────────────────────┐\n            │   bipartite graph · LOD lens · risk color · timeline · search bar    │\n            └───────────────▲─────────────────────────────────────▲───────────────┘\n                            │ references \u002F highlights              │ on-demand\n            ┌───────────────┴────────────┐                         │ hydration\n            │  Internal agent (TS)        │                         │\n            │  RAG-on-graph · your LLM    │                         │\n            └───────────────▲────────────┘                         │\n                            │ index queries                        │\n   ┌────────────────────────┴─────────────────────────────────────┴──────────────┐\n   │             Abstract storage (one `Storage` trait, pluggable backends)        │\n   │  light index + embeddings   |   heavy payload (dedicated store)               │\n   │  SQLite + sqlite-vec (local, open core)  |  Postgres + pgvector (enterprise)  │\n   └────────────────────────▲──────────────────────────────────────────────────────┘\n                            │ append-only (client-server)\n   ┌────────────────────────┴─────────────────────────────────────────────────────┐\n   │                          Core observer (Rust)                                 │\n   │  git reader  +  fs-watcher \u002F checkpoint engine (no-git fallback)  [FACT]       │\n   │  passive transcript + memory ingest (Codex, Claude Code, …)        [DECLARED]  │\n   │  Tree-sitter (symbol extraction + AST-fingerprint identity)                   │\n   │  declared↔done reconciliation (gap-filling + drift)                           │\n   │  a-priori risk  ·  a-posteriori risk hooks (event-driven)                     │\n   └────────────────────────▲─────────────────────────────────────────────────────┘\n                            │ passive read-only (no agent cooperation)\n                  ┌──────────┴───────────┐\n                  │   Coding agents      │  write transcripts + memory to disk;\n                  │  (e.g. Codex, Claude)│  brain0 reads them, like it reads git\n                  └──────────────────────┘\n```\n\nPrinciples that don't bend:\n\n1. **Passive observation**: never modifies your repo, never commits\u002Fchecks out, never interferes with git.\n2. **The magnifying glass**: zooming descends into the *same* object (repo → module → file → symbol), never loads different nodes.\n3. **No unjustified new nodes**: an entity that evolves stays the same node (deterministic, cross-machine symbol identity with rename\u002Fmove tracking), with a dated chain of versions.\n4. **Light index, lazy heavy payload**: the navigable graph is small and lasts for years; diffs, messages and summaries hydrate on demand.\n5. **Open source and composable**: bring your own database and your own LLM keys, or run fully offline.\n\n## How it compares\n\n| | `git blame` | Vendor dashboards¹ | Git AI | **brain0** |\n|---|:---:|:---:|:---:|:---:|\n| Who committed a line | ✅ | ✗ | ✅ | ✅ |\n| Which **prompt\u002Fintent** produced a change | ✗ | ✗ | ✅ | ✅ |\n| Cross-agent, vendor-neutral | ✅ | ✗ | ✅ | ✅ |\n| **Drift**: declared vs. actually done | ✗ | ✗ | ✗ | ✅ |\n| What the agent **read** (incl. secrets, DLP) | ✗ | ✗ | ✗ | ✅ |\n| **Risk score** per file\u002Fsymbol, evidence-driven | ✗ | ✗ | ✗ | ✅ |\n| Explorable **graph GUI** with time travel | ✗ | ✗ | ✗ | ✅ |\n| Zero integration (no hooks in your agents) | ✅ | ✗ | ✗ | ✅ |\n| Local-first, offline by default | ✅ | ✗ | ✅ | ✅ |\n\n¹ Copilot Metrics API, Cursor team analytics, Claude Code analytics: per-vendor aggregates\n(sessions, LoC accepted), no line\u002Fsymbol-level provenance, no causality.\n\n## Commands\n\n| Command | What it does |\n|---|---|\n| `brain0 up` | index + observe + serve the GUI, one shot |\n| `brain0 today` | last-24h triage, attention first (`--since 7d`) |\n| `brain0 report` | drift · sensitive reads · top risk · agent footprint (`--md`) |\n| `brain0 query \"\u003Cquestion>\"` | root-cause debug over the graph, by reference |\n| `brain0 mcp` | serve the query channel (context\u002Fblame\u002Fdebug\u002Faudit) over stdio |\n| `brain0 ingest` \u002F `observe` \u002F `watch` | the underlying fact\u002Fintent observers |\n| `brain0 rewind` | restore the working tree from a recorded checkpoint (the `watch` safety net) |\n| `brain0 guard` \u002F `preflight` | DLP: flag secret reads that reached a remote model · block them pre-commit\u002Fpre-run |\n| `brain0 provenance` \u002F `attribution` \u002F `attest` \u002F `compliance` | AI provenance per commit · per-hunk attribution · signed (Ed25519, in-toto) attestations · auditor pack |\n| `brain0 verify` \u002F `audit` \u002F `purge` \u002F `reembed` | integrity, audit log, crypto-shred, re-embedding |\n\n## Building from source\n\nPrerequisites: **Rust** (see `rust-toolchain.toml`), **Node 20+**, **pnpm**.\n\n```bash\ncargo build && cargo test          # Rust core (14 crates)\npnpm install && pnpm -r build && pnpm -r test   # TS workspace (shared · agent · gui · server)\n.\u002Fscripts\u002Fe2e.sh                   # cross-language end-to-end check\n\n# All-in-one dev loop (build → ingest → observe → server :8787 → GUI :5173)\npnpm dev --repo myorg\u002Fmyrepo\n```\n\nThe GUI's **Refresh** button re-runs the same passive observer and re-embeds, live; it is\nserved same-origin on `127.0.0.1` only.\n\n```\ncrates\u002F      Rust core (model, parser, identity, storage, observer, reconcile, risk,\n             agentsrc, crypto, models, policy, attest, mcp, cli)\npackages\u002F    TypeScript (shared, agent, gui, server, cli)\nschema\u002F      SQL DDL for the local SQLite backend\ndocs\u002F        Documentation (agent-artifact schemas, security, models, open-core, governance)\n```\n\n## Privacy & security, by default\n\n- **Offline by default**: no keys ⇒ local embeddings + local models (Ollama optional);\n  nothing leaves the machine. Remote LLM\u002Fembeddings are an explicit opt-in, with context\n  redacted before egress.\n- **Secret scanning at ingest**: transcripts are scanned and redacted (typed placeholders,\n  never values) *before* anything is stored, summarized, or embedded; `BRAIN0_EXCLUDE` \u002F\n  `BRAIN0_REDACT` add your own rules. The raw prompt text is **not persisted**; only the\n  model-generated summary.\n- **Encrypted at rest**: envelope-encrypted payload store (ChaCha20-Poly1305, KEK rotation,\n  crypto-shred purge) with restrictive file permissions.\n- **Append-only, content-addressed**: the graph is tamper-evident (`brain0 verify`), with\n  an append-only security audit log.\n\nThreat model and honest limitations: [`docs\u002Fsecurity.md`](.\u002Fdocs\u002Fsecurity.md).\n\n## Open core\n\nEverything in this repository is free and open source under [Apache-2.0](.\u002FLICENSE) and\nfully functional on its own, with **no license checks, feature flags, or crippled code paths**.\nTeam\u002Fhosted capabilities (a PostgreSQL + pgvector backend implementing the same public\n`brain0_storage::Storage` trait, signed entitlements, a multi-tenant server) live in a\nseparate **brain0-enterprise** repository (AGPLv3 + commercial). brain0 never depends on\nbrain0-enterprise. Full boundary and rationale: [`docs\u002Fopen-core.md`](.\u002Fdocs\u002Fopen-core.md).\n\n## Contributing\n\nSee [CONTRIBUTING.md](.\u002FCONTRIBUTING.md). By participating you agree to the\n[Code of Conduct](.\u002FCODE_OF_CONDUCT.md). Contributions are accepted under our CLA\n(see [`cla\u002F`](.\u002Fcla\u002F)), which keeps the open-core dual-licensing sustainable.\n\n## License\n\n[Apache-2.0](.\u002FLICENSE) © The brain0 Authors.\n","Brain0 是一个面向 AI 编程代理的代码变更可追溯性与风险审计工具。它被动构建提交与 AI 代理意图（如提示词、读取上下文、调用模型）之间的决策图，支持漂移检测、数据防泄漏（DLP）审计、基于证据的风险评分、MCP 协议记忆支持及签名式来源证明；默认离线运行，仅依赖 Git 历史和代理本地日志。适用于关注 AI 生成代码安全性、合规性与可审计性的研发团队，尤其适合需满足软件供应链安全（如 SBOM、Provenance）、内部代码审查或 AI 工程治理的场景。","2026-07-09 02:30:12","CREATED_QUERY"]