Thesmos Governance

1,137 rules. Zero config. Built for the AI-assisted engineering era.

Thesmos is a source-available code governance toolkit that watches AI-generated code for security holes, broken patterns, and architectural mistakes — before they reach production.

Built by Holley Studio — Thesmos governs its own repository; every PR merged here passed its own gate. Check the Actions tab for proof.

Get Pantheon Pro → · 40 specialist agents · 1,075 rules · Free Essentials tier always available

Why Thesmos

AI tools write code faster than humans can review it. Copilot, Cursor, and Claude can ship working features in minutes — but they also hallucinate Prisma clients outside module scope, concatenate user input directly into LLM prompts, and create N+1 query waterfalls without a second thought.

Thesmos closes that gap. 1,137 governance rules covering AI safety, security, performance, and correctness — active the moment you install.

Four Ways to Use It

1. CLI

Scan your whole codebase and get a health grade:

npm install thesmos-governance
npx thesmos scan

Review only staged changes before committing:

npx thesmos review

Run thesmos audit for a detailed JSON + HTML report, or thesmos init to walk through setup interactively.

2. GitHub Action

Adds governance review to every pull request. BLOCKER findings block the merge. Inline comments appear on the exact line.

Copy this to .github/workflows/thesmos-pr.yml:

name: Thesmos Governance

on:
  pull_request:
    types: [opened, synchronize, reopened]

permissions:
  pull-requests: write
  contents: read

jobs:
  governance:
    name: Governance Review
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Thesmos PR Review
        uses: Holley-Studio/thesmos-governance/actions/pr-review@v1
        with:
          github-token: ${{ secrets.GITHUB_TOKEN }}
          fail-on-severity: BLOCKER
          post-inline-comments: 'true'
          update-summary: 'true'

No secrets to configure. No build step. The action is fully self-contained.

3. VS Code Extension

Install from the extensions/vscode/ directory for:

Real-time findings as you write
Health score in the status bar
AI adapters panel — keeps Claude, Cursor, Copilot, and Gemini aware of your governance rules so they generate governed code from the first line

4. Claude Code Plugin

Install directly inside Claude Code — no separate npm install step:

/plugin marketplace add Holley-Studio/thesmos-governance
/plugin install thesmos-governance

Ships the MCP server, the scan / review / advise skills, and the same PreToolUse/PostToolUse/Stop governance hooks the CLI's claude:govern install writes (Node thesmos-guard entry, fail-closed by default) — enabled per-project, off by default.

Beyond the scanner

The rules engine is the front door — behind it ships a full governance platform:

Thesmos Governance

Popularity

What's Inside

README