Skip to main content

eigenhelm

Catch low-quality AI-generated code before it lands.

License: AGPL-3.0


The problem

AI agents write working code fast. But "working" isn't "good." Tests pass, the diff looks plausible, and it gets merged — but complexity concentrates in the wrong places, patterns repeat where they should be abstracted, and structure decays toward GitHub average.

LLM reviewers help, but they share the agent's blind spots. They reason from text, not structure. Run the same review twice, get different comments.

The argument against caring: it works, tests pass, ship it. But structural quality isn't aesthetics — it predicts what happens next. High cyclomatic density and concentrated complexity produce more post-merge defects. Agents generate code at machine speed; without measurement, you accumulate structural debt just as fast. And review doesn't scale to agent output volume — the human eye glazes over at 500 lines.

eigenhelm measures code structure using information theory — not an LLM. It parses the AST, extracts a structural fingerprint, and scores how closely the code resembles curated high-quality corpora. Deterministic, trainable on your code, zero API cost.


Before and after

An agent writes a module. eigenhelm evaluates it:

src/pipeline.py
  decision: reject
  score:    0.72
  directives:
    [high] reduce_complexity → process_batch (lines 15-89)
    [high] extract_repeated_logic → validate_row (lines 42-67)

The agent reads the directives, refactors, tests still pass. Re-evaluate:

src/pipeline.py
  decision: accept
  score:    0.35

0.72 → 0.35. Structurally sound. No human reviewed it.

In controlled benchmarks, agents using eigenhelm produced code rated 46% higher on design, robustness, and spec compliance — with zero correctness regressions.


Install

pip install eigenhelm

Or with uv (no venv required):

uv tool install eigenhelm

A bundled model is included — no setup needed.

eh evaluate src/ --rank           # rank files best-to-worst
eh evaluate path/to/file.py --classify   # single-file classification

What the scores mean

  • accept (score < 0.4): Structurally sound. Move on.
  • marginal (score 0.4-0.6): Acceptable; review directives if improvement is straightforward.
  • reject (score > 0.6): Worth reviewing. Read the directives for guidance.

Scores are relative to high-quality open-source training corpora. Most production code scores marginal — that's normal, not a problem.


How is this different from CodeRabbit?

eigenhelm LLM reviewer
Input AST structure (69-dim vector) Source text
Deterministic Yes — same code, same score No
Trainable on your corpus Yes — eh train No
Hard CI gate Yes — with calibrated thresholds Suggestions only
Tracks quality over time Yes — comparable scores No stable metric
Catches logic bugs No Yes
Cost Zero (local) Per-token LLM cost

They're complementary. eigenhelm runs first — in the agent's inner loop. LLM review runs second, on the PR. Full comparison.


Agent integration

eh skill --install

The skill teaches AI agents the correct workflow: evaluate after tests pass, two passes maximum, never sacrifice correctness for score.

Important: Do not loop until accept. Do not optimize for the score. Do not hard-gate merges with default thresholds. eigenhelm is a signal for focusing attention, not a judge.

In a controlled benchmark (3 scenarios, scored by a separate reviewer not involved in generation), agents using the skill produced code rated 46% higher on quality metrics. Full guide.


GitHub Action

Evaluate code quality on every pull request.

# .github/workflows/quality.yml
on: pull_request

jobs:
  quality:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: metacogdev/eigenhelm@v1
        with:
          paths: src/
          sarif-upload: true

Inputs

Input Default Description
paths . Files or directories to evaluate
diff auto Revision range. auto evaluates only changed files on PRs
classify true Show accept/marginal/reject decision labels
fail-on reject When to fail: reject, warn, or never
sarif-upload false Upload results to GitHub Code Scanning
strict false Treat marginal as reject
lenient false Treat marginal as accept
model (bundled polyglot) Path to custom .npz model file
format human Output format: human, json, or sarif
version (latest) eigenhelm version to install (e.g. 0.9.0)
exclude (none) Glob patterns to exclude from evaluation (newline or comma-separated)

Outputs

Output Description
score Mean aesthetic score across evaluated files (0.0–1.0; lower = more complex)
decision Overall decision: accept, warn, or reject
exit-code Raw exit code (0=accept, 1=warn, 2=reject, 3=error)
files-evaluated Number of files evaluated
sarif-file Path to SARIF output (when generated)

CLI Reference

All commands are available as eigenhelm <command> or eh <command>:

Command Description
eh evaluate Evaluate source files against the trained quality model
eh train Train a new eigenspace model from a corpus directory
eh inspect Inspect a saved model's metadata
eh serve Run the evaluation HTTP server
eh harness Run a statistical comparison harness across two code sets
eh skill Install the agent skill file
eh model List, pull, and inspect models — including from the remote registry
eh init Generate a starter .eigenhelm.toml configuration
eh corpus Manage training corpora (sync from manifest)
eh mcp Start the MCP stdio server
eigenhelm-benchmark Run real-world use case benchmarks (standalone entry point, not an eh subcommand)

Run eh --help or eh <command> --help for details.


HTTP API

Endpoint Method Description
/health GET Liveness probe
/ready GET Readiness probe (model loaded)
/v1/evaluate POST Evaluate a code unit
/v1/evaluate/batch POST Evaluate multiple code units

Supported Languages

Trained models: Python, JavaScript, TypeScript, Go, Rust.

Parser support (feature extraction available, bring your own model): Java, C, C++, Ruby, Kotlin.


Development Setup

git clone https://github.com/metacogdev/eigenhelm.git
cd eigenhelm
uv sync --extra dev --extra serve
uv run pytest
uv run ruff check .

Architecture

src/eigenhelm/
├── virtue_extractor.py   — Tree-sitter + Lizard → FeatureVector (69 dimensions)
├── critic/               — 5-dim scoring (drift, alignment, entropy, compression, NCD)
├── declarations/         — Declaration-aware scoring (type defs, barrel files, data tables)
├── regions/              — Test/production code region detection
├── parsers/              — Tree-sitter parser loading, language map
├── eigenspace/           — PCA projection and drift scoring
├── attribution/          — Score attribution and directive generation
├── training/             — PCA training, calibration, exemplar selection
├── helm/                 — Threshold-calibrated evaluation and PID steering
├── harness/              — Statistical evaluation harness (Mann-Whitney U)
├── metrics/              — Feature extraction (halstead, cyclomatic, wl_hash)
├── config/               — `.eigenhelm.toml` loader and defaults
├── cli/                  — CLI commands (evaluate, train, inspect, serve, harness, skill, init, corpus, model, mcp)
├── output/               — SARIF and JSON formatters
├── scoring/              — Per-repo scorecard
├── validation/           — Benchmark and validation workflows
├── corpus/               — Corpus sync and manifest handling
├── registry/             — Model registry and resolution
├── mcp/                  — MCP stdio server
├── trained_models/       — Bundled `.npz` models
└── serve/                — HTTP evaluation server (requires `eigenhelm[serve]` extra)

Current Status

  • 5-dim scoring: manifold drift, alignment, entropy, compression, NCD exemplar distance
  • 5 languages: Python, JavaScript, TypeScript, Go, Rust — all discriminating (Cohen's d > 0.5)
  • Human correlation: Spearman rho = 0.54 overall (n = 92, 5 languages), 0.66 Python-only (n = 52)
  • Declaration-aware: Automatically detects type-definition and data-table files, adjusts scoring and directives
  • Agent-tested: Skill contract validated in controlled arena (3 scenarios, 46% quality improvement)

License

eigenhelm is licensed under the GNU Affero General Public License v3.0.

Commercial Licensing

Looking to use eigenhelm in a proprietary SaaS or enterprise product without AGPL-3.0 obligations? A commercial license is available.

Contact us at licensing@eigenhelm.sh to discuss terms.

Metadata

Release files for eigenhelm 1.0.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for eigenhelm 1.0.0
File Size Uploaded Provenance Actions
eigenhelm-1.0.0.tar.gz 1.4 MB With provenance Details for eigenhelm-1.0.0.tar.gz

Built distribution (wheel)

Table of built distributions (wheels) for eigenhelm 1.0.0
File Interpreter ABI Platform Actions
eigenhelm-1.0.0-py3-none-any.whl Python 3 none any Details for eigenhelm-1.0.0-py3-none-any.whl

Total release size: 2.9 MB

Release files / eigenhelm-1.0.0.tar.gz

Download URL eigenhelm-1.0.0.tar.gz
Size 1.4 MB
Tags Source
SHA-256 checksum
How to use checksums
543d84b9e2796e176d655d7addc1becc4193a94a77ae82c0dbae33fd6c2ade03
BLAKE2b-256 checksum
How to use checksums
e974eb84d883164d4e6625c89d7732d1d0a997f82783591178389fd7f276945e
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 12, 2026.

Transparency log

Release files / eigenhelm-1.0.0-py3-none-any.whl

Download URL eigenhelm-1.0.0-py3-none-any.whl
Size 1.5 MB
Tags Python 3
SHA-256 checksum
How to use checksums
709c4249838f0a6d7e1ee206175d5f4ba90e287eccb2c548c7ef628eb323556b
BLAKE2b-256 checksum
How to use checksums
fd269994abe671fc838eddd7a80d3ba25303248853f3a26ef9c1d6af44795fc5
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.14

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 12, 2026.

Transparency log

Security for eigenhelm 1.0.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for eigenhelm-1.0.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Sep 12, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page