Independent · applied AI
RepoLens · AI Codebase Q&A
Ask a repository questions, get cited answers, or an honest refusal.
- Year
- 2026
- Role
- Solo · polishing for release
- Status
- In progress
- Type
- Independent
Retrieval-augmented Q&A over any public GitHub repo where every claim links to the exact file and lines it came from, weak retrieval triggers a refusal instead of a hallucination, and indexing runs entirely on-device with secrets redacted before anything reaches the Claude API.
The problem
Companies accumulate hundreds of repos nobody fully remembers, and the obvious fix, 'chat with your code,' has two trust problems: RAG tools hallucinate confidently when retrieval misses, and most of them upload your codebase to someone else's servers to index it.
RepoLens treats both as the actual engineering problem: answers you can verify line-by-line, refusals that are calibrated rather than vibes, and an indexing pipeline confidential code can safely pass through.
Approach
- Ingests a repo via GitHub tarball (no clone), filters binaries and lockfiles, excludes secret-bearing files (.env, keys, credentials), and runs a gitleaks-style scanner that redacts inline secrets, AWS keys, API tokens, JWTs, private-key blocks, connection strings, before any chunk is stored.
- Embeds locally with transformers.js (bge-small-en-v1.5), so code never leaves the machine to build the index; storage is SQLite locally and Neon Postgres + pgvector on the hosted demo, behind one VectorStore interface.
- A similarity gate calibrated against a golden eval set refuses low-confidence questions before any API call is made, the refusal is free and the hallucination never happens.
- Claude must cite every claim as [path:Lstart-Lend]; the server validates each citation against the chunks the model was actually shown, flags fabricated ones, and the UI renders valid ones as GitHub deep links with a 'how I found it' panel showing retrieved chunks and similarity scores.
- Bring-your-own-key by design: the hosted demo holds no server-side Anthropic key at all, visitors' keys stay in their browser and ride each request, and ingest/ask endpoints are rate-limited with repo size caps.
- A committed eval harness scores refusal correctness, false refusals, citation validity, and faithfulness proxies into a scorecard, so retrieval changes are measured, not guessed.
What it proves
- On the golden set, the calibrated gate refuses 8/8 deliberately unanswerable questions with zero false refusals on the 14 answerable ones.
- Citations are enforced and validated server-side against retrieved chunks, not hoped for in the prompt.
- Only the top-k redacted chunks, a few KB, ever reach the Claude API; the repo itself never leaves the machine.
Stack
App
AI
Data