OpenLore brings local memory and guardrails to AI coding agents

OpenLore is a static-analysis indexing tool designed to give AI coding agents two capabilities: persistent architectural memory and deterministic governance checks. It indexes a codebase once—at install time—by running static analysis across all files, building a knowledge graph of function call structure, types, tests, decisions, and Infrastructure-as-Code. The graph is stored locally; no API key or network access is required. When an agent is given a task, it can query this graph via MCP tools (or the CLI) to ask "orient: what functions and specs does this task touch?" and get back a ranked list of relevant functions, their callers, matching spec sections, and suggested insertion points—all in a single call, with a median latency of ~430 microseconds on a 15,000-node graph.

The key design choice is that OpenLore answers these questions deterministically from the static graph, not by asking an LLM. This means the same question returns the same answer every time, and when the codebase changes (a function is renamed, a file moves), the tool can detect that a cached fact has aged and tell the agent "this information is stale" instead of serving a confident guess. The agent sees this signal through what the tool calls "Epistemic Lease"—context-freshness tracking that prevents the agent from acting on outdated information.

On the governance side, OpenLore certifies code changes before they land. Three tools run on a diff: change_impact_certificate detects when a change newly opens a path into a declared sensitive boundary (differential—only paths created by the change, not pre-existing ones); certify_public_surface classifies every changed export as breaking, non-breaking, or potentially breaking and names the in-repo consumers each break hits; check_architecture answers whether a file is allowed to import from another given your declared layer rules. All three are deterministic, cross-language, and require no LLM. A one-command gate "openlore enforce" resolves all findings through a policy file and blocks only on what you mark as blocking (advisory by default).

Benchmarks from the Spec 14 agent benchmark (claude-sonnet, N=4 medians, measured 2026-06-01) show the trade-off clearly. On large, unfamiliar repos with deep "how does X flow through Y" tasks, OpenLore cuts cost by −7% to −21% and round-trips by −26% (excalidraw: 25→16 round-trips, −21% cost). On small repos (110 files) or shallow "who calls X" questions, it can add overhead: +43% cost and +38% round-trips in Round 1 of the benchmark. The pattern is task-dependent even within the same repo class—the same codebase that saw a −32% win on one task showed a +59% loss on another. The publisher explicitly recommends running "openlore prove --estimate" on your own codebase before committing, and they publish both wins and losses transparently.

Installation is a single command: "npm install -g openlore && openlore install". It auto-detects the agent in use (Claude Code, Cursor, Cline, Continue, or an AGENTS.md file), registers the MCP server, and indexes the repo live—no configuration or API key required. On a fresh clone of ripgrep (235 files, 2,978 functions, 4,329 call edges), the full index built in 14 seconds. An agent then calls orient(task) to start every task already oriented to the relevant functions, callers, specs, and risks. The governance tools run at commit time or in CI, certifying changes before they land. All answers are grounded in static code analysis, not model guesses, so they are deterministic and reproducible.

OpenLore addresses a fundamental cost in AI-assisted coding: the agent's confidence in stale information. A large codebase is too big for a language model to memorize completely, so across a long session the agent gradually acts on "facts" that have become out of date—renamed functions, moved files, changed APIs—without realizing. When those mistakes reach code review, the human pays the cost of iteration. The tool's core insight is that static analysis can answer many of the questions an agent needs ("which functions does this touch," "who calls this") once at setup, store the answers in a graph, and serve them deterministically thereafter. No LLM in that loop means no hallucination, the same answer every time, and the ability to tell the agent when a cached fact has aged (via "Epistemic Lease"). The governance side—detecting breaking changes, architectural violations, and new paths into sensitive code—runs the same logic: differential static analysis instead of a model's best guess.

The benchmarks reveal where this shape wins and loses. On large repos (640–3k files) with complex, multi-hop tasks, the agent saves cost and round-trips because it stops re-deriving the call graph from files: −21% cost on excalidraw, −26% round-trips on tokio. On smaller repos where the model's built-in knowledge is sufficient for shallow questions like "who calls this function," the indexing and lookup overhead can outweigh the gain (+59% loss on express). The publisher is transparent about this: they recommend measuring on your own codebase, and they publish both wins and losses in the Value Scorecard. Adoption depends on honest evaluation, not hype.

No comments yet. Be the first to share your thoughts!