HefestoAI MCP server

HefestoAI — release truth engine for AI-generated code

After your AI wrote the code, but before it ships. HefestoAI verifies that what your project declares — deps, configs, install artifacts — matches what it actually does.

Operational Truth Analyzers (v4.13.1)

HefestoAI's core contribution: detecting drift between what your project declares and what it does. These analyzers run automatically on every hefesto analyze and catch issues that linters and security scanners miss because they're not in any single file — they're in the inconsistency between files.

# All operational truth findings appear in standard output
hefesto analyze . --severity MEDIUM

Quick Start

pip install hefesto-ai
cd your-project
hefesto analyze . --fail-on critical

# PR review (new in v4.11.2) — analyze only changed code
hefesto pr-review
hefesto pr-review --strict        # include file-level context
hefesto pr-review --post --pr 42  # post inline comments via gh CLI

Why Hefesto? The AI Code Problem

AI tools like Claude Code, GitHub Copilot, and Cursor generate code at machine speed. But who validates that code?

• Copilot generates os.system(userinput) → command injection**
• Claude writes f"SELECT FROM {table}" → SQL injection**
• AI code looks clean to linters but changes business logic silently (semantic drift)

Hefesto catches what your linter misses. Pre-commit, pre-push, CI/CD — before it reaches production.

What Hefesto Catches

# Hefesto catches:
password = "admin123"  # HARDCODED_SECRET
query = f"SELECT * FROM users WHERE id={id}"  # SQL_INJECTION_RISK
os.system(f"rm {user_input}")  # COMMAND_INJECTION

Shortened. The full README is on GitHub.