▚▞ lemmaflow

Trust engine for production software. Built AI-native — install it as a Claude skill.

Two commands and your coding agent can make any app production ready:

npx -y lemmaflow skill install
npx -y lemmaflow login

(the second is one-time: sign in, paste the universal key it hands you, done forever — it unlocks the AI audit; every scan below works without it too)

Then just tell Claude: "make this app production ready." It scans for trust leakage — PII committed to the repo, leaked secrets, privacy gaps, GDPR basics, data collected forever and deleted never — fixes what's mechanical, offers you the CI gate, and runs the cited regulatory audit.

Prefer to drive it yourself?

npx -y lemmaflow scan

No account. No network. Nothing leaves your machine.

Why

"Production ready" usually means the tests pass. Then the first enterprise customer sends a security questionnaire, or a regulator sends a letter, and you discover production ready also means: no card numbers in fixtures, no sk_live_ in git history, a privacy notice that names your processors, a delete-account endpoint that actually deletes, and a defensible answer to "how long do you keep this?"

Lemmaflow is the engine that gets you there — free local checks now, an AI-native audit against real regulatory instruments when you want the deeper verdict.

Install

npm install -g lemmaflow    # or: npx -y lemmaflow <command>

Then just type:

lemmaflow

The engine activates — an interactive menu over everything below.

Free — runs 100% locally

| Command | What it finds | |---|---| | lemmaflow scan | Everything below, plus a trust score out of 100 | | lemmaflow pii | Real emails, phone numbers, Aadhaar (Verhoeff-validated), PAN, card numbers (Luhn-validated), SSNs in source, seeds and dumps | | --checks secrets | AWS/GitHub/Google/Stripe/Slack/OpenAI/Anthropic keys, private key blocks, JWTs, credentialed connection strings, tracked .env files | | --checks privacy | PII flowing into logs, third-party trackers without consent, session cookies without HttpOnly, tokens in localStorage, plaintext HTTP | | --checks gdpr | Collects personal data with no privacy notice, no deletion path, no export path, pre-checked consent boxes, processor inventory | | --checks retention | PII schemas with no retention lifecycle, soft-delete-forever, database dumps and logs committed to the repo |

Useful flags:

lemmaflow scan --json                 # machine-readable (agents, CI)
lemmaflow scan --report trust.md      # markdown report artifact
lemmaflow scan --fail-on high         # CI gate: exit 2 on high+ findings
lemmaflow scan --checks pii,secrets   # subset

Every finding is checksum- or context-validated where possible — an Aadhaar match must pass its Verhoeff digit, a card number must pass Luhn — because a scanner you can't trust is itself trust leakage.

Pro — the AI-native audit

The free scan is pattern-based. The audit is an AI agent on the Lemmaflow platform that reads your code like an engineer and checks it against a regulatory register of 211 instruments (DPDP Act 2023, CERT-In Directions, SPDI Rules, sector rules and more), citing the instrument, the file and the line behind every finding.

lemmaflow audit

First run walks you through the one-time setup:

1. It prints your auth URL → https://terminal.lemmaflow.io/cli-auth
2. Sign in (GitHub; sign-up is the same button)
3. A universal API key is generated — account-wide, works for every project. Copy it, paste it into the terminal, done. It's saved to ~/.lemmaflow/config.json (never inside your repo) and you're never asked again.

Then audit creates a project, uploads a snapshot, streams the agent's reasoning as it works, and prints cited findings. Also:

lemmaflow init          # link this directory to a platform project
lemmaflow push          # upload a fresh snapshot
lemmaflow findings      # stored findings for the linked project
lemmaflow ask "do we log anything the DPDP Act would call personal data?"

AI-native by design — one line and your agent has it

Lemmaflow bundles a skill, so Claude Code (or any SKILL.md-aware agent) can run the whole engine — scan, interpret, fix, re-scan — on its own.

One-line install, no clone, no account:

npx -y lemmaflow skill install          # → .claude/skills/lemmaflow/ + AGENTS.md (commit both)
npx -y lemmaflow skill install --global # → ~/.claude/skills/ (every project)
npx -y lemmaflow skill install --no-agents  # skip the AGENTS.md pointer

Or as a Claude Code plugin — this repo is its own plugin marketplace:

/plugin marketplace add branecom/lemmaflow
/plugin install lemmaflow@lemmaflow

Then tell your agent: "make this app production ready". It will run npx -y lemmaflow scan --json, fix what's mechanical, flag what needs you (key rotation, history purges), and re-run until the score stops climbing.

CI — the GitHub Action

# .github/workflows/trust.yml
name: trust
on: [push, pull_request]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: branecom/lemmaflow@v0
        with:
          fail-on: high        # fail the job on high+ findings ("" = report only)
          # checks: pii,secrets  # optional subset
          # report: trust.md     # optional markdown artifact

The trust report lands in the job summary on every run, and the action exposes score, grade, findings, critical and high as outputs for downstream steps. Or skip the action and call the CLI directly:

- run: npx -y lemmaflow scan --fail-on high

Privacy promise

• scan / pii are fully local. No telemetry, no phone-home, zero dependencies — read the source, it's small.
• Platform commands (audit, push, ask) upload your code snapshot to your own Lemmaflow project, only when you run them.
• Your API key lives in ~/.lemmaflow/config.json (mode 600), never in the repository. .lemmaflow.json (committed) holds only a project id.

What the score means

| Score | Grade | Meaning | |---|---|---| | 90–100 | A | production ready on the checks run | | 75–89 | B | close — fix the highs before shipping | | 55–74 | C | trust leakage — not production ready | | < 55 | D/F | serious leakage — stop and fix |

A clean 100 means "no pattern-detectable leakage", not "compliant" — that verdict needs the audit, and ultimately qualified counsel. Lemmaflow is not legal advice.

License

Apache-2.0. The scanners, the engine, the CLI and the skill are open source and always will be — the platform's AI audit is the paid layer on top.