Your AI agent just broke production.
It didn't know.
mati blocks Claude Code and Codex from touching critical files until they've read the rules that protect them, and logs every decision your auditors will ask for.
Hard enforcement,
not suggestions.
mati intercepts the read at the agent's hook. The agent can't touch the file until it has consulted the rule attached to it. No skip path.
The failure mode
is always the same.
Someone changed code they didn't understand, and the one fact that would have stopped them was in Slack, a stale doc, or nobody's head. mati puts that fact in the agent's way.
Contractor makes a 'minor performance fix' to a data pipeline. No one flags it as HIPAA-covered. Audit exposure 6 months later.
mati blocks the read. The agent consults the gotcha: 'Every read/write to patient_records must call audit_log::record_phi_access.' The audit trail logs the consultation.
Built for teams
handling PHI.
mati generates the audit trail your auditors will ask for. Every deny, consultation, and bypass it catches is logged and timestamped, ready to export.
What your
auditor sees.
Every enforcement decision, cryptographically signed and tamper-evident. Your audit trail started the day you installed mati.
Local hash-chained logs and signed exports ship today; off-host, audit-grade evidence custody is in active development.
The briefing your agent reads first.
12 languages.
Real codebases.
Every resolution rate is verified against a real-world open-source project, each one linked below. No toy fixtures, no synthetic benchmarks. Measured on mati v0.1.1.
The 97% headline figure is the average across the 7 languages with a measured numeric rate; the remaining 5 are supported structurally and not yet fully benchmarked.
What your agent can't see on its own.
Blast radius
Co-change clusters
Staleness propagation
Not a memory tool.
Not a linter.
mati answers a different question: has this actor proven they understand what's dangerous about this file, and can we prove it to an auditor?
| Capability | mati | AI memory | Linters | ADRs |
|---|---|---|---|---|
| Block reads until knowledge consulted | ● | — | — | — |
| Tamper-evident audit trail | ● | — | — | — |
| On-prem, zero network calls | ● | — | ● | ● |
| Per-file gotchas with confidence scoring | ● | — | — | — |
| Works without any LLM calls | ● | — | ● | ● |
Your AI agent just refactored a payment flow and removed the fraud check. With mati, that's blocked by default. The agent can't read the file until it proves it knows about the fraud check.
Free for developers.
Paid for compliance teams.
Cloud compliance tools automate paperwork. mati enforces the rules at the code level, before the code ships.
- 01Full enforcement engine
- 0212-language import resolution
- 03Blast radius & co-change clusters
- 04Enforcement event recording
- 05365-day event retention
- 06Claude Code & Codex support
- 01Signed audit PDF export
- 02Cryptographic chain of custody
- 03License-verified enforcement reports
- 04Extended retention controlsIn development
- 05Direct support from the founder
Signed, hash-chained audit export. Every agent decision, tamper-evident.
Running in your repo in 15 minutes.
Questions, answered.
The short version of how mati works, what it touches, and why it's different.
What is mati?
mati gives you deterministic guardrails for AI coding agents. It blocks Claude Code and Codex from reading or editing critical files until they've consulted the per-file constraints ("gotchas") that protect them, and records every enforcement decision in a tamper-evident local audit trail. mati runs on-prem with zero network calls and works without any LLM calls.
How does mati stop AI agents from breaking production code?
mati intercepts file reads at the hook level and denies access until the agent consults the verified knowledge record for that file. For example, before editing a payments file the agent must acknowledge a constraint such as keeping an idempotency check that was added after a fraud incident, so it cannot silently remove safeguards.
Does mati make LLM calls or send code to the cloud?
No. mati works without any LLM calls and makes zero network calls. It runs entirely on-prem, which is what makes it suitable for regulated environments handling sensitive or compliance-covered code such as HIPAA data.
What programming languages does mati support?
mati supports 12 languages: Rust, Python, TypeScript, Go, Java, C, C++, Ruby/Rails, Haskell, Scala, JavaScript, and Elixir, with knowledge-resolution rates up to 100%.
How is mati different from agent memory, linters, or ADRs?
Unlike agent memory, linters, or ADRs, mati hard-blocks file reads until the required knowledge is consulted, produces a compliance audit trail, and scores per-file gotchas by confidence, all on-prem with zero network calls. Memory and ADRs are passive; mati is enforcement.
Does mati provide a compliance audit trail?
Yes. Every time an agent consults a gotcha before editing a file, mati logs the consultation. Compliance teams get a verifiable audit trail showing exactly what the agent knew before it made each change.
Is mati open source, and what does it cost?
mati is open source under the MIT license, and the full product is free for individual developers: the enforcement engine, the 12-language scan, and the local audit log are all included from the first run. Paid plans add team features like signed audit export and governance.
Which AI coding agents does mati work with?
mati enforces at the hook level with Claude Code and Codex (mati hooks --claude or --codex), so it intercepts file operations before the agent acts. It also exposes its knowledge to any MCP client via mati serve (MCP over stdio).
What is a "gotcha"?
A gotcha is a confirmed, structured rule attached to a specific file: what an agent must do or avoid there, like "never remove the idempotency key." When an agent touches a file that has a confirmed gotcha, mati's hook surfaces it and can block the operation until it has been consulted.
How does mati learn my codebase?
On mati init, it runs a Layer 0 scan with zero LLM calls: tree-sitter parsing across 12 languages, import-graph construction, and co-change clustering from your git history. You confirm the gotchas that matter, and those activate hook enforcement.
What does mati record, and where does it live?
Every enforcement decision is written to a local, hash-chained, append-only log: deny decisions, allow-after-consultation decisions, and consultation receipts. The log stays on your machine and is yours; Enterprise adds a signed export for handing to auditors.