Evidence, not vibes
Every claim is tagged observed, inferred, proposed or unknown. Findings cite file and line, with severity, confidence, fix and acceptance criteria.
Open source · Apache-2.0 · v0.1.0
The software architecture agent that shows its evidence.
ArchSutra AI turns Claude Code, Cursor, Codex, GitHub Copilot and Gemini CLI into an evidence-first architect. Audit, design, threat-model and modernize with file:line proof, severity and confidence, no extra API key.
npx github:shahvatsalofficial/archsutra-ai audit .Read-only. Offline. No telemetry. Secrets redacted.
- 20automated tests
- 6/6CI jobs green (3 OS x Node 20, 22)
- 0runtime dependencies
- 19audit rules
- 12specialist agents
- 0API keys required
Why teams use it
Keyless and private
The CLI runs offline with no telemetry. Inside your IDE, the skills use the model you already have. No ArchSutra account.
Built for CI
Gate pull requests with --fail-on high. Export Markdown, Mermaid, JSON and SARIF 2.1.0 for code scanning.
A specialist team
Twelve role contracts led by Prime: security, data, cloud, integration, AI, reliability, cost, delivery and verification.
Safe to adopt
Dry-run installs, SHA-256 manifests, conflict detection, backups, and uninstall that never deletes your edits.
Honest by design
Support levels stated plainly. Reliability, performance and cost are "not assessed" unless evidence exists.
How it works
flowchart LR
dev["You, in an AI IDE"] --> skill["ArchSutra skills + Prime"]
skill --> cli["archsutra CLI (offline)"]
cli --> repo[("Your repository, read-only")]
cli --> ev["Evidence: findings.json, SARIF, Mermaid"]
ev --> skill
skill --> out["Report, ADRs, roadmap"]Trust, with receipts
Reproducible proof
20 tests, a 6-job CI matrix, labeled-fixture evaluation, real sample reports. Re-run everything yourself.
See the evidenceLegal and privacy clarity
Apache-2.0, NOTICE, third-party notices, trademark disclaimers, and an explicit list of checks not yet done.
Read the policyWhat is not proven yet: live behavior inside each AI IDE, accuracy on real-world repositories, and trademark clearance for the name. We say so up front.
Supported AI IDEs
| Host | Level | Skills | Agents |
|---|---|---|---|
| Claude Code | adapter | .claude/skills/ | .claude/agents/ |
| Cursor | adapter | .cursor/skills/ | none |
| OpenAI Codex | adapter | .agents/skills/ + AGENTS.md | none |
| GitHub Copilot | adapter | .github/skills/ | .github/agents/*.agent.md |
| Gemini CLI | experimental | .gemini/skills/ | none |
"adapter" = files written to the vendor-documented layout; not yet smoke-tested in the live host. Full matrix.
Documentation
Executive summary
Problem, value, risks, decisions.
Functional specification
Every requirement and scenario.
Technical specification
Modules, algorithms, limits.
Architecture
C4 views, flows, trust boundaries.
User guide
Install, audit, IDE prompts, CI.
CLI reference
Commands, flags, exit codes.
Security, privacy, legal
Model, license, disclaimers.
Testing and proof
Results, CI, evaluation, samples.
Rule catalog
All 19 audit rules.
Frequently asked questions
What is ArchSutra AI?
An open-source software architecture agent: portable Agent Skills plus a deterministic offline CLI that help AI coding assistants audit, design, threat-model and modernize software with file-and-line evidence.
Do I need an API key?
No. The CLI is offline. Inside a supported AI IDE the skills use that IDE's own model, so you need access to the IDE, not an ArchSutra key.
Does it send my code anywhere?
The CLI sends nothing anywhere and has no telemetry. When you use the skills, your AI IDE's model provider processes your prompts and code under its own terms.
Which AI tools does it support?
Adapters exist for Claude Code, Cursor, OpenAI Codex and GitHub Copilot (adapter level) and Gemini CLI (experimental). Live smoke tests are pending and stated openly.
Does it certify compliance or security?
No. Reports are review aids. Absence of findings is not proof of absence of vulnerabilities, and nothing here is legal advice or a compliance attestation.