Muninn · an Alkhemy product

Your AI saw a lot.Muninn tells you what counts.

Every AI-authored pull request is built on context you never see: memory files, past decisions, retrieved notes. Muninn reviews that context and posts a signed, human-readable Context Receipt on the PR: clean, stale, conflicting, or unsafe. Content-free, before you merge.

Add the GitHub App See how it works

One click installs it. Receipts start posting on your next pull request. No terminal, no config.

Verified receipt

signature: ed25519 verified
governed: 6 of 7 sources
shadow: 1 ungoverned, flagged
sig: 3BhEtDhWI67jXD99…

GitHub-verified identity·ed25519-signed receipts·Zero-trust, content-free·Runs at the edge

The problem

Your memory could be poisoning your agent.

When your AI opens a PR, you review the diff. You never see the context that told it what to change. That context decided the diff, and it is invisible at merge time.

AI coding agents act on accumulated context: memory files, retrieved snippets, prior decisions, project rules. That context drifts. It goes stale, it contradicts itself, and it gets poisoned, by accident or on purpose. The agent cannot tell. It trusts what it is given and ships accordingly.

The lockfile disagrees

The context says one package manager. The lockfile says another. The agent “fixes” the wrong one.

A reversed decision returns

A memory note encodes a decision you reversed months ago. The agent re-introduces the bug you removed.

An instruction that was never yours

A retrieved snippet carries an instruction you never wrote. The agent follows it.

How it works

From hidden context to a signed receipt.

Four beats, one section. Muninn governs the context your agent trusts without ever receiving your code.

Step 1

Your agent writes from hidden context

Session memory, a stale doc, a rule from ten prompts ago. None of it reviewed, all of it steering the diff. You see the pull request. You never see what told the agent to write it.

context.hiddenunreviewed

› ctx://memory/decisions.md#a91f
› ctx://retrieved/snippet#e40c provenance=?
› ctx://memory/notes.md#33d1 age=94d
› ctx://rules/repo.json#1a2b

Trust & security

Controls you can take to your security team.

Content-free by architecture. Every claim here is a shipped mechanism you can check, not a promise. Trust the math, not the vendor.

Content-free by architecture

Muninn never receives your raw code, file contents, file paths, matched strings, secrets, or memory objects. It receives signed, content-free signals and metadata: risk classes, counts, timestamps, and public PR references. What crosses the wire and what a human reads are two different things, by design.

GitHub-verified identity

Identity is established through GitHub App installation and key-binding, not a self-asserted email. The app that signs your receipts is the app you installed.

ed25519-signed Context Receipts

Every receipt is cryptographically signed. Change one byte and the signature breaks. Your tooling can verify it without trusting our word.

A public verifier anyone can run

Receipts conform to a published Context Receipt spec and verify against an independent checker without ever contacting Muninn. You check the evidence, not the UI.

Governed is not the same as approved

A memory being in a repo does not mean anyone approved it to steer your code. Muninn separates governed context (committed, diffable) from trusted context (reviewed and blessed). When they collide, it shows the collision instead of picking a winner.

It warns before it blocks

Muninn starts by warning, never blocking. It blocks only when you turn that on, and only for high-confidence conditions. If it did not observe your context, it says so. It never fails your build over something it could not see.

Add the GitHub App

The difference

The same pull request, one receipt apart.

An AI opened this PR on context you never reviewed. Without Muninn, it merges. With Muninn, a signed receipt reveals the ungoverned context first.

Without MuninnMerged

fix(auth): migrate session store to Redis

#482 · claude-agent wants to merge into main

-store: new MemoryStore()

+store: new RedisStore(env.REDIS_URL)

~// per memory/decisions.md (94d old)

No receipt. The diff was reviewed; the context behind it was not. Ungoverned session memory, a decision reversed months ago, merged into main. Nobody caught it.

With MuninnReview required

fix(auth): migrate session store to Redis

#482 · claude-agent wants to merge into main

-store: new MemoryStore()

+store: new RedisStore(env.REDIS_URL)

~// per memory/decisions.md (94d old)

Context Receipt

verdict: needs review
finding: ungoverned context presented
source: session memory (unsigned)
sig: ed25519:9Kd2Fp…

caught before merge

The receipt reveals which context was governed and which was not. It does not read your code or claim to detect intent. It shows you the ungoverned context behind the diff, and signs it.

Pricing

Metered by the receipt, not the seat.

Start on Proof Run, free, no card. Install the GitHub App and receipts begin posting on your PRs. Upgrades happen inside the dashboard once you are in.

Proof Run

The solo dev or team lead deciding whether this is worth paying for.

$0no card

Start free

25 Context Receipts total (one-time)
1 repository
1 full context audit report
Remediation repair-plan preview (no apply)
7-day receipt history
Receipts posted on your PRs

Builder

Start here

The indie hacker shipping fast with Claude Code, Cursor, Codex, or Copilot.

$19/ mo

Add the GitHub App

500 Context Receipts / month
3 repositories
30-day receipt history
Full PR receipt comments + audit reports
Remediation preview + manual apply
Ungoverned exposure & influence rates, .muninnignore, email support

Team

Small teams and platform leads adopting AI responsibly.

$199/ mo

Add the GitHub App

5,000 Context Receipts / month
25 repositories, 10 users
180-day receipt history
Everything in Builder
Required GitHub checks, team policies, shared approvals
Private receipt archive, priority support

Get started

Two steps to governed context.

Install the GitHub App for signed Context Receipts on every pull request. Run one local check to see what is steering your agent, before it writes a line. Both are live today.

Add the GitHub App

One click. Muninn provisions the repo, opens the first pull request, and starts posting signed Context Receipts. No keys to paste, no config to write.

Add the GitHub App

Run the local context check

One check on your own machine shows you exactly what is steering your agent, before it acts. Content-free by design: nothing about your code ever leaves. Included the moment you install, no account and no keys.

One install. Muninn does the rest and stitches everything together on the backend.

View the script first