Governance for AI-written code.
Thesmos scans every commit against 2,214 rules spanning security, auth, and AI-safety patterns — catching BLOCKER-severity issues before they reach production.
npm install --save-dev thesmos-governance
Fire without governance burns.
Real Findings in AI-Generated Code
This is what Thesmos catches.
AI_013Prompt Injection via User Input
const res = await llm(systemPrompt + userMessage)User input concatenated directly into the system prompt. Allows adversarial prompt injection.
src/api/ai/chat.ts:34
ZOD_008Missing Input Validation
const { amount } = await req.json()No Zod schema on POST route body. Unvalidated data reaches the database.
src/app/api/orders/route.ts:12
DB_003N+1 Query Pattern
orders.map(o => await prisma.item.findMany(...))Prisma queries inside a loop. 100 orders = 101 database round-trips.
src/components/OrderList.tsx:22
See It Work
Describe a feature. Thesmos plans it, builds it, and governs it.
Autopilot turns plain language into a governed task graph: it creates a branch, executes the plan step by step, journals every decision, and self-reviews against all 2,214 rules before surfacing a PR.
If governance fails mid-session, Autopilot pauses and asks — it never ships a BLOCKER.
thesmos autopilot generate "add Stripe checkout"Plan
Converts natural language into a governed task graph. Each step scoped, reversible, and rule-checked.
Execute
Runs each task with full tool access — file edits, shell commands, test runs — within agent scope limits.
Journal
Every decision logged to .thesmos/autopilot/journal.md. Every rule evaluated. Full audit trail.
Review
Self-reviews the diff against 2,214 rules before opening the PR. No BLOCKER reaches main.
What thesmos scan looks like
Not a mockup — try the live scanner on your own code.
What You Get
Governance that ships with your code, not around it.
Catches vulnerabilities AI tools miss
Every commit is checked against 2,214 rules spanning security, authentication, and AI-safety patterns — the prompt-injection, SSRF, and missing-auth bugs AI coding tools generate by default.
Blocks BLOCKER findings before they reach main
thesmos review --staged runs as a pre-commit hook or GitHub Actions step. BLOCKER-severity findings stop the merge — a gate, not a suggestion.
Works with every AI tool you already use
thesmos adapters syncs the active rule set to Claude, Cursor, Copilot, Gemini, and Codex — one command, every AI tool aligned to the same rules.
How It Fits Your Workflow
Install once. Govern every AI tool you already use.
Thesmos doesn't replace Claude, Cursor, or Copilot — it teaches them your rules, then checks their work before it merges. Full command reference on GitHub.
Install
npm install --save-dev thesmos-governanceOne package, zero config. Works on any JavaScript/TypeScript project.
Teach your AI
thesmos adaptersSyncs the active rule set to Claude, Cursor, Copilot, Gemini, and Codex.
Build normally
Code with whichever AI tool you already use — it's now working from the same rules Thesmos enforces.
Gate every PR
thesmos review --stagedRun as a pre-commit hook or GitHub Actions step. No BLOCKER-severity finding reaches main.
How Clients Benefit
Every project Holley Studio ships is Thesmos-governed.
When we deliver a system, you receive documentation showing every Thesmos rule checked and every BLOCKER finding resolved. You're not trusting us — you're checking the report.
For technical clients, we run Thesmos in your CI pipeline after delivery — gating every future pull request so BLOCKER-severity findings are addressed before they reach main.
Book a call to see it live →Real BLOCKERs caught in AI-generated code
[SEC_001]Supabase admin client in browser bundle
[SEC_002]Row Level Security disabled on tables
[AUTH_007]Admin route with no authentication middleware
[AI_001]LLM API key loaded in client component
[AI_013]User input interpolated directly into system prompt
[VIBE_002]fetch(userInput) — classic AI-generated SSRF pattern
[NEXT_003]cookies() called inside 'use client' component
[DB_001]DROP TABLE in migration without backup strategy
For Agencies
White-label your QA process.
Add Thesmos to your own agency's CI/CD pipeline. Ship AI-generated code confidently. Differentiate from competitors who can't prove their code quality.
Talk about integration →For Developers
Run it on your own codebase.
CLI scanner, GitHub Actions, VS Code extension, npm package. Works on any JavaScript/TypeScript project. Zero config.
View on GitHub →Thesmos applies typed, pattern-based rules — not a formal program verifier. FSL-1.1-MIT: free for open source and internal use today, converts fully to MIT in 2030.
The gods kept governance for themselves.
Now you have it.
2,214 rules. Zero config. Free for open source and internal use. One command away from a governed AI development workflow.
Node.js 18+ · FSL-1.1-MIT (→ MIT 2030) · v4.6.0 · Built by Holley Studio