MunaTrust Code Trust CLI

Your AI writes code. MunaTrust decides if it should ship.

MunaTrust is a local-first trust gate for AI-generated code. The CLI is the fastest way to run that trust review outside the editor and see whether a repo looks safe enough to release.

Works alongside the MunaTrust editor integrations verified in:

• VS Code
• VS Code Insiders
• Cursor
• VSCodium
• Windsurf
• TheiaIDE

The same packaging approach is intended for Theia and other Open VSX-based desktop IDEs that resolve VS Code extensions.

Verified companion integrations:

• JetBrains plugin load verified in IntelliJ IDEA Community
• Neovim plugin runtime verified with :MunaTrustQuickfix
• Zed MCP integration verified with summary and findings flows
• Visual Studio solution wrapper verified for local report generation

Catch dangerous generated code before it surprises you in production. MunaTrust gives you a fast local trust check, actionable findings, and a clean CLI flow for trying it in seconds.

The CLI uses the same upgraded trust surface as the editor integrations: stronger deterministic trust stories, hidden-assumption detection, and release-focused prioritization.

Best fit

Use the CLI when you want a fast answer to questions like:

• Did AI-generated code introduce something fake or unsafe?
• Is this repo safe enough to ship?
• Are there secrets, auth gaps, or deploy blockers hiding in the current state?
• Would a Friday-night release on this codebase be reckless?

Preview and pricing

Every fresh install starts with a local preview:

• Preview
  • 5 Basic Scans total
  • 3 Advanced AI Scans total
  • 2 Full Private Deep Scans total
  • Upgrade when you are ready to keep going
• Solo - $9/month
• Pro - $19/month
• Team - $99/month

Checkout:

• Gumroad: https://balkanbrs.gumroad.com/l/munatrust
• Website: https://munatrust.online

What it does

munatrust scans a local workspace and produces:

• a trust score
• risk level
• actionable findings
• trust chains for release blockers
• secret exposure signals
• hallucination risk signals
• package manifest discovery
• environment file discovery
• recommended next steps

It is especially good at surfacing:

• hallucinated imports or fake helpers
• non-existent API usage patterns
• missing auth around sensitive routes
• public env leaks and browser-visible secret-like values
• risky deploy-time trust issues that look small until production

It does not edit files and does not upload your code by default.

Install

npm install -g munatrust

Usage

Scan the current folder:

munatrust scan

Scan a specific folder:

munatrust scan ./my-project

Get JSON output:

munatrust scan . --json

Example output

• Trust Score
• Risk Level
• Top Findings
• Sub-scores:
  • Deployment Confidence
  • Secret Exposure
  • Hallucination Risk
  • Package Safety
  • Environment Hygiene

Privacy

MunaTrust scans locally and does not upload your code by default.

Optional telemetry is disabled by default and, when enabled, only records privacy-safe workflow events such as installs, scan starts, report opens, preview limits, upgrade clicks, and license activation outcomes.

Licensing

Typical paid flow:

1. Install MunaTrust and use the built-in preview
2. When preview scan limits are reached, choose Solo / Pro / Team
3. Complete checkout
4. Receive your license key by email automatically
5. Use the key in the MunaTrust extension

Support

• GitHub: https://github.com/balkanbrs/munatrust
• Issues: https://github.com/balkanbrs/munatrust/issues