Celmis

Celmis

Understand, review, secure and fix your code, in one self-hosted place. One machine. Your model, your network. The code never leaves the company.

Website · Documentation · Quick start · What's new · Results

Celmis puts everything an engineering team needs to work with its code in one place. It indexes all of your repositories once, into a symbol graph built without a model, and every tool reads that same index:

• understand code nobody documented: questions across repositories answered with file:line citations, in the app or from a coding agent (Claude Code, Cursor, Codex) over MCP, plus the team's own skills and checklists for the task at hand;
• review pull requests with what the change touches beyond its own repository;
• secure the dependencies: CVE audit, a CycloneDX SBOM and an evidence pack a third party can verify;
• fix what an alert or a finding points at: an embedded Claude Code session on *your* subscription edits the code and the runner opens a pull request (220 seconds on one measured finding). A person reviews and merges; Celmis never merges or deploys.

It is built for the team that ships the code and answers for it in production. Instead of a separate tool for each of those jobs, each with its own access rules and its own copy of your code, one installation holds them all. The aim is a small team that can run several products and the integrations between them.

What "beyond its own repository" means today. Before a merge, the review checks the other repositories for values the change removes that they still hardcode, for deploy files that point at the changed repository, and for code that calls a changed function by the same name, quoting both sides. These are checks, not a call graph between repositories; that graph is not built yet.

What it does

Install

git clone https://github.com/Celmis-labs/Celmis.git celmis && cd celmis

./scripts/init-env.sh # writes .env and fills every secret docker compose --env-file .env up -d

Then open http://localhost and paste one model provider key under Settings → LLM Setup.

197 seconds from clone to six healthy services on a clean server. Postgres and Qdrant are bundled; about 4 GB of RAM. Details in Quick start. An installation without a licence admits up to five people; see Licensing.

What's new in v3

• Review that earns its comments. Findings below your comment level never reach the pull request; a review with nothing to say approves. Comments are the problem, the reason and the fix, in the repository's language (3.1).
• A reviewer you can talk to. @celmis commands and questions in the thread, remember rules, learning from what the team dismisses, incremental review of each push, Jira acceptance criteria checked in the summary (2.3).
• Knowledge packs. Versioned skills, API examples and checklists per workspace, readable in the app and by coding assistants through brief and skills; celmis-pack publishes them (3.0).
• Access closed by default. A repository nobody has a rule for is invisible; MCP tokens belong to a person; every call is audited (2.3.7). Stricter secret hiding in 3.0.2.
• Sharing between workspaces. For research, for a fixed time, with hidden paths and a ceiling on readers (3.1).
• A developer MCP profile and a Claude Code plugin sized for an editor (2.3.7).

Every release is in the changelog.

Logs, and where the line falls

Celmis does not watch your services; Grafana or whatever you already run does that. The application ingests no logs of its own and starts from the alert. The repository ships an optional observability overlay (Prometheus, Loki, Promtail, Grafana) that does collect them, platform-wide rather than Celmis-only:

docker compose -f docker-compose.yml -f docker-compose.observability.yml up -d

Every port binds to 127.0.0.1 and is reached over an SSH tunnel, because Loki has no authentication. GRAFANA_ADMIN_PASSWORD is required.

What that buys you that a diff-only tool cannot

Ask a question that spans two repositories, and the answer quotes both, as in the screenshot at the top of this page. That is not a search result. The gateway and the payments service are separate repositories with no shared code, and the answer traces the call chain between them — then notices, unprompted, that the Kafka topic name is hardcoded in both and that changing one silently breaks the other.

A reviewer that reads only the diff structurally cannot say that. It never had the other repository open.

---

Nine things people do with it

The first three are the ones a code-review tool does not do at all, and they are the reason this is a platform rather than a reviewer: index once, then read that index from whichever side of the work you are standing on.

Three numbers

That last one is deliberately unflattering, and it stays. It measures one of the surfaces below — pull-request review on isolated single-repository PRs — and that set has no sibling service for a symbol to have consumers in, so the thing this product is built around is not in the number at all. The table, the audit of every finding it scored false, and the command that reproduces both are in Results.

Table of contents

• What it does
• What's new in v3
• What that buys you that a diff-only tool cannot
• Nine things people do with it
• Three numbers
• Quick start
• First user and admin
• Connect a repository
• Ask the code
• Pull-request review
• Dependencies, SBOM and the evidence pack
• Fix from here
• Alerts, and fixing from a phone
• Ask for work across repositories
• Who can see what
• Languages and formats
• Deterministic checks — no model, no false positives
• Connect Claude Code and other MCP clients
• Results
• Audit of the false positives
• Test repositories
• Configuration
• Operations
• Local development
• CLI reference
• Architecture
• Troubleshooting
• Project layout
• Provenance and rights

Quick start

What you need

Postgres and Qdrant are **bundled