Repository analysis
Vericore analyzes repositories locally. With AI disabled, deterministic repository analysis does not send repository content to a Vericore telemetry or storage service.
Know what Vericore
does with your data.
This page describes the current 0.7.0 implementation. It is intentionally limited to behavior that exists today.
Provider boundaries
AI-assisted workflows are optional. When configured, bounded repository-derived context is sent directly to the selected provider for the requested operation. AI is not authoritative repository truth.
Self-contained output
Generated HTML reports contain their visualization code and do not require a browser CDN request at report-open time, allowing offline inspection.
Trusted local use
The local REST server validates paths and applies rate limiting, but it does not provide authentication, authorization, tenant isolation, or deployment-level TLS. Do not expose it publicly without an appropriate security boundary.
Bounded repositories
Local server and MCP boundaries reject remote repository URLs and validate repository paths. Keep allowed roots as narrow as practical when configuring trusted integrations.
Bounded AI input
AI operations use bounded repository-derived context rather than indiscriminately sending an entire repository. Exact limits and provider behavior are documented in the source repository.
Verification is not authorization
The Agent Change Contract is a deterministic verification boundary. It detects mismatches, tampering, stale state, and repository identity changes; it is not an authorization system or autonomous coding mechanism.
What is not shipped
There is no production telemetry service, multi-tenant governance layer, autonomous source modification, or deployment-grade authentication in the current release.