roam-code
installs/mo · pypistarsforks
How to install roam-code?
cranot/roam-code
$git clone https://github.com/Cranot/roam-codeThe local codebase intelligence layer that lets AI coding agents earn the right to change code — with evidence for what was checked.
README.md
| 1 | <div align="center"> |
| 2 | |
| 3 | # roam-code |
| 4 | |
| 5 | **The local codebase intelligence layer that lets AI coding agents earn the right to change code — with evidence for what was checked.** |
| 6 | |
| 7 | [](https://pypi.org/project/roam-code/) |
| 8 | [](https://github.com/Cranot/roam-code/stargazers) |
| 9 | [](https://github.com/Cranot/roam-code/actions/workflows/roam-ci.yml) |
| 10 | [](https://www.python.org/downloads/) |
| 11 | [](https://opensource.org/licenses/Apache-2.0) |
| 12 | |
| 13 | <sub>Credential-free · 100% local by default (opt-in `metrics-push` is the only outbound surface) · tamper-evident `ChangeEvidence` packets · Apache 2.0 · runs entirely on your machine</sub> |
| 14 | |
| 15 | <!-- BEGIN auto-count:readme-headline-counts --> |
| 16 | <sub>281 commands · 244 MCP tools (16 in the default `core` preset) · 28 languages</sub> |
| 17 | <!-- END auto-count:readme-headline-counts --> |
| 18 | |
| 19 |  |
| 20 | |
| 21 | </div> |
| 22 | |
| 23 | --- |
| 24 | |
| 25 | **Jump to** — |
| 26 | [Why Roam](#why-roam-is-different) · |
| 27 | [Install](#install--first-four-commands) · |
| 28 | [The Compiler](#the-compiler--your-agents-first-token-already-knows-the-answer) · |
| 29 | [Core commands](#core-commands) · |
| 30 | [MCP server](#mcp-server) · |
| 31 | [AI-tool integration](#integration-with-ai-coding-tools) · |
| 32 | [Roam Guard (PR gate)](#roam-guard-for-prs) · |
| 33 | [Performance](#performance) · |
| 34 | [Compare](#how-roam-compares) · |
| 35 | [Pricing](#paid-layers-free-cli-stays-apache-20) · |
| 36 | [FAQ](#faq) |
| 37 | |
| 38 | --- |
| 39 | |
| 40 | ## Why Roam is different |
| 41 | |
| 42 | [METR](https://metr.org/notes/2026-03-10-many-swe-bench-passing-prs-would-not-be-merged-into-main/) and [FrontierCode](https://cognition.ai/blog/frontier-code) both point at the same gap: passing tests is not the same as mergeable code. Roam is an **agent-first CLI surface** that gives the agent local graph facts before it edits, gates risky changes, and emits scoped evidence after the run. In the agent/review tools surveyed as of 2026-06-12, the differentiator is this combination: |
| 43 | |
| 44 | - **Credential-free.** No account, no API key, no cloud login. `pip install` and run. |
| 45 | - **100% local by default.** Source code never leaves the machine; air-gapped repos work like cloud repos. The single outbound surface (`roam metrics-push`) is opt-in, summary-only, and prints its exact payload under `--dry-run`. |
| 46 | - **Tamper-evident `ChangeEvidence` packets.** A Roam-guided change can compile into one portable packet — HMAC-chained run ledger + signed Code Graph Attestation + signed PR bundle — answering eight questions: *who acted, what authority existed, what context was read, what changed, what could break, what policy applied, what verified it, who accepted risk*. PR Replay maps those eight questions today: structural change/risk/policy axes are in scope, context and verification are partial, and missing identity/authority/approval evidence is disclosed instead of invented. Cursor logs the run; Roam records and verifies the evidence its producers captured. |
| 47 | - **MCP runtime security at the wrapper boundary.** Every MCP response is scrubbed for secrets on egress, gated against the active mode (`read_only` / `safe_edit` / `migration` / `autonomous_pr`) with a closed-enum `policy_decision`, and each decision receipt is HMAC-linked into the signed run ledger. Inside-server controls; the gateway layer (Interlock / Lasso / Portkey) composes on top — see [`dev/MCP-SECURITY-POSTURE.md`](dev/MCP-SECURITY-POSTURE.md). |
| 48 | |
| 49 | Underneath sits a SQLite-backed graph of symbols, calls, imports, layers, git history, runtime traces, smells, clones, security flows, and algorithmic patterns across 28 languages — the same local facts queried before, during, and after a change. |
| 50 | |
| 51 | **Dependency-aware, not string-b |
People who liked this also viewed
6 picksType
- fastapi_mcpExpose your FastAPI endpoints as Model Context Protocol (MCP) tools, with Auth!MCP ServersNov 2025
- lean-lsp-mcpLean Theorem Prover MCPMCP ServersJul 2026
- rulesyncA Utility CLI for AI Coding AgentsMCP ServersJul 2026
- FunASROpen-source speech recognition toolkit for training, inference, streaming ASR, VAD, punctuation, speaker diarization pipelines, and OpenAI-compatible/MCP serving.MCP ServersJul 2026
- repomix📦 Repomix is a powerful tool that packs your entire repository into a single, AI-friendly file. Perfect for when you need to feed your codebase to Large Language Models (LLMs) or other AI tools like Claude, ChatGPT, DeepSeek, Perplexity, Gemini, Gemma, Llama, Grok, and more.MCP ServersJul 2026
- mcp-serverMCP server for AI-assisted development of CAP applicationsMCP ServersJul 2026
