# Mori [](https://github.com/Cyberlane/mori/releases/latest) [](https://github.com/Cyberlane/mori/actions/workflows/ci.yml) [](LICENSE) Mori finds source fragments with similar structure—even when they use different names or programming languages—and gives you an explainable shortlist to review. > Mori reports structural evidence. A match is never proof that two fragments > behave the same way or should be merged. | | | | --- | --- | | 🔒 **Local** | Source stays on your machine. No upload or telemetry is required. | | 🌐 **Cross-language** | Compare compatible functions across supported languages. | | 🔎 **Explainable** | See scores, locations, shared shape, and directional differences. | | ⚙️ **Predictable** | Deterministic output, visible coverage, and bounded resource use. | ## Install Download a native archive from the [latest release](https://github.com/Cyberlane/mori/releases/latest), or build from source with Go 1.23+ and a C compiler: ```sh go install github.com/Cyberlane/mori/cmd/mori@latest mori version ``` Official release binaries include complete build provenance and are recommended for CI and auditable reports. Each release also includes checksum-pinned Homebrew, Scoop, and WinGet manifest assets, an SPDX SBOM, and GitHub/Sigstore attestations. Package-index submission is intentionally separate, so verify the release asset before local use. ## Debugging and support Mori v0.33.0 can capture an optional, source-free diagnostic session for a scan. Put `--diagnostics` before other scan options so argument errors can be captured: ```sh mori scan --diagnostics session.json --profile review . mori support bundle --session session.json --output mori-support.zip mori support inspect mori-support.zip ``` Inspect the bundle before attaching it to a support conversation. Nothing is uploaded automatically. See [support reports](docs/guides/support.md) for the exact contents, limits, and optional reviewed-finding labels. ## Quick start From a project root, inventory the source and preview a project setup: ```sh mori inspect . mori setup ``` `mori setup` inventories the project, asks a few focused questions, previews a conservative `.mori.json`, and writes it only after confirmation. Review its exclusions after the first scan; Mori cannot decide which tests, generated files, migrations, or framework repetition are intentional in your project. For a library or monorepository, choose the suggested `library` scope when its source roots match your intent. Choose `application` for broader non-test code, including demos and tooling. Review the proposed roots and exclusions, then run the exact command printed by setup. For an application scope, retain a first review: ```sh mori scan --scope application --format agent --output review.json ``` Keep `review.json` local and inspect its coverage as well as both candidate locations. If you kept the inclusive configuration, omit `--scope application`. For very large layouts, choose a smaller source root before comparison. Library suggestions and future-proof test patterns require Mori v0.33.0 or later. See the [published documentation](https://cyberlane.github.io/mori/) and [focused first-review guide](docs/guides/first-review.md). For a no-write trial: ```sh mori scan --profile review . ``` The review profile starts with same-language code, an 85% threshold, a 40-token floor, generated-source exclusion, and required aggregate coverage. It still includes tests and stories. In a large repository, start with a reviewed source root such as `mori scan --profile review packages/core/src`; inspect both sides of the first groups before deciding which categories to exclude. See the [first-review guide](docs/getting-started.md#run-a-first-review) for scope and staged-review tradeoffs. For a cross-language review, choose it explicitly: ```sh mori scan --threshold 0.70 --cross-language-only examples/email-validation ``` Illustrative cross-language result (scores depend on source and version): ```text 1. 92.7% structural similarity · 1 location pair(s) weighted feature evidence: 114 intersection / 123 union A Validator.java:6-9 [java] looksLikeEmail B validator.js:1-4 [javascript] looksLikeEmail shared shape: 3 calls, 1 return, 2 bindings ``` Always read both locations. Mori does not establish equivalent runtime values, effects, types, external calls, permissions, transactions, or error behavior. ## Choose a workflow | Goal | Start with | | --- | --- | | Review likely same-language duplication | `mori scan --profile review .` | | Explore across languages | `mori scan --profile explore --cross-language-only .` | | Review one language pair | `mori scan --language-pair go,typescript .` | | Review SQL queries | `mori scan --profile sql path/to/sql` | | Produce CI evidence | `mori scan --profile review --format json .` | | Keep JSON while bounding agent context | `mori scan --profile review --format agent --output /tmp/mori-review.json .` | | Enforce the canonical staged review | `mori review staged check .` | | Acknowledge one exact staged review | `mori review staged acknowledge --accept-focused .` | | Produce a concise terminal shortlist | `mori scan --profile review --format compact .` | | Produce editor diagnostics | `mori scan --profile review --format sarif .` | | Save a local visual report | `mori scan --profile review --format html . > mori.html` | | Inspect language coverage | `mori inspect .` | | Check project setup | `mori doctor .` | | Check project-managed Mori assets | `mori project upgrade --check .` | Lower the token floor toward 12 only for deliberate broad exploration; small callbacks and wrappers commonly dominate at that size. Use `mori explain [scan options] .` to reproduce and isolate one reported identity. Text output uses restrained color on terminals; set `--color never` or `NO_COLOR` to disable it. ## Supported source Mori currently supports: - Bash/POSIX shell and Zsh; - C, C++, C#, Dart, GDScript, Go, Hack, Java, JavaScript/JSX, Kotlin, Lua, Luau, PHP, PowerShell, Python, Ruby, Rust, Swift, TypeScript/TSX; - generic SQL queries and explicitly selected PostgreSQL queries. Run `mori languages` for the exact extensions, families, fragment kinds, and extensionless shebangs supported by your installed version. See [Languages and parser limits](docs/reference/languages-and-parser-limits.md) for comparison boundaries and known gaps. ## Editors and AI coding tools The repository includes a dependency-free [VS Code reference client](editors/vscode/README.md). It analyzes unsaved buffers through a local Mori process and reports SARIF diagnostics without uploading source. Install Mori's review skill into a project for compatible coding agents: ```sh mori skill install --project . ``` The skill teaches agents to treat matches as review leads, verify coverage, inspect both source locations, and avoid score-only refactors. After installing a newer Mori binary, coordinate the project pin, embedded skill, configuration and baseline validation, and automation inventory with: ```sh mori project upgrade --dry-run . mori project upgrade --apply . ``` Apply mode updates `.mori-version`, the tracked `.mori-project.json` contract, and only a missing or recognized Mori-managed Agent Skill, with backups. Unknown skill changes fail closed. It does not install the CLI, invent configuration policy, rewrite hooks or CI, commit, push, or release anything. To let a project agent configure Mori without granting hidden write access: ```sh mori setup --agent --format json . ``` The agent can answer the emitted questions and preview the exact configuration before an explicit `--apply`. See [Editors and coding agents](docs/guides/editors-and-agents.md). ## Documentation - [Documentation home](docs/README.md) - [Getting started](docs/getting-started.md) - [Reviewing results](docs/guides/reviewing-results.md) - [SQL and embedded SQL](docs/guides/sql.md) - [Parser compatibility](docs/guides/parser-compatibility.md) - [Automation and baselines](docs/guides/automation-and-baselines.md) - [Editors and coding agents](docs/guides/editors-and-agents.md) - [Project contract and upgrades](docs/guides/project-upgrade.md) - [Project configuration](docs/configuration.md) - [Scoring](docs/scoring.md) - [Machine integration](docs/machine-integration.md) - [Architecture](docs/architecture.md) - [Adding a language](docs/adding-a-language.md) ## Smooth project reviews Start a new integration with [advisory staged review](docs/guides/review-policy.md) to see structural leads without blocking on similarity alone. Existing hooks remain strict. Both policies retain configured coverage requirements; the report separates policy success from analysis completeness. Trust the project version pin and schedule upgrades separately. [Upgrade diagnostics](docs/guides/project-upgrade.md) identify obsolete workflow instructions without rewriting project policy. [Rollout guidance](docs/guides/usability-rollout.md) covers native verification, reviewed project migration and opt-in pilot evaluation. [Local feedback](docs/guides/feedback.md) is off by default. Explicit per-project consent enables bounded measurements; export previews a separate minimized bundle. Mori does not upload feedback. Collection never accepts findings or changes a baseline. `mori feedback summarize` compares explicitly exported bundles offline without counting exports as distinct projects. ## Development ```sh make check ``` See [Contributing](CONTRIBUTING.md) for development policy. The calibration corpus is regression evidence for its reviewed cases, not a universal accuracy claim. ## License [MIT](LICENSE)