Athena: Local-First Code Auditing and Verified Release Notes with Open-Weight AI

This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle

What I Built

Athena is an open-source, local-first Git & AST change-intelligence engine and Model Context Protocol (MCP) server built for the Hacktoberfest 2026 - Side Hustle Challenge.

Every developer and engineering team faces the same dread on release day:

• Did a refactoring subtly change a public function signature without bumping SemVer?
• Which downstream callers across our codebase will break if this pull request merges?
• Did someone update a function's parameters without updating the accompanying docstrings or markdown guides?
• Who has the time to read through 150 commits and write structured, evidence-grounded release notes?

I built Athena to turn raw Git history and multi-language syntax trees into structured, mathematically verified change intelligence without ever sending your code to closed third-party cloud APIs.

What Does Athena Do?

• AST-Level Breaking Change Detection: Parses Python and TypeScript syntax trees across Git commit ranges to pinpoint removed exports, altered parameter lists, and modified return types.
• Caller Blast Radius Mapping: Automatically traverses your repository to find every internal file, caller function, and imported symbol affected by a modified signature.
• Documentation Drift Detection: Cross-references modified code symbols against Markdown guides and docstrings to catch stale documentation before shipping.
• Evidence-Grounded Release Notes: Generates categorized changelogs where every bullet point is linked directly to exact commit hashes and file diffs.
• Universal Model Context Protocol (MCP): Plugs natively into Claude Desktop, Cursor, Zed, or any AI coding assistant via standard JSON-RPC 2.0 stdio tools.
• Offline-First & Privacy-Focused: Runs completely on your local machine using Ollama and open-weight models like qwen2.5-coder:7b. Your proprietary codebase never leaves your computer.

Who Would Pay For It?

Athena is built for engineering teams, freelancers, and companies building in regulated environments:

• Freelancers & Dev Agencies: Freelance developers building client backends can run Athena pre-merge to guarantee they never push a breaking change that breaches a client contract or NDA.
• SaaS & Enterprise Engineering Teams: A silent breaking change in a shared internal library costs thousands of dollars in emergency rollbacks and customer downtime. Athena automates pre-merge checks in CI/CD.
• Privacy-Conscious Organizations (FinTech, HealthTech, Defense): Teams who cannot send proprietary code diffs to cloud LLMs can deploy Athena completely offline on developer laptops or air-gapped CI runners.

The Side Hustle Model: An open-core CLI and MCP server for solo developers, paired with an automated GitHub Action bot ($19/month solo / $79/month team) that audits every Pull Request and posts blast-radius warnings directly in PR reviews.

Demo

Athena can inspect any local Git repository (pass . for your current directory, or a path to a project). You can also run python examples/create_demo_repo.py to generate an instant sandbox repo with sample commits, breaking changes, and documentation drift.

1. Detecting Breaking Changes via AST

python -m athena breaking-changes . --base v1.0.0 --target v2.0.0

Found 1 breaking change requiring human review:

[CRITICAL] calculate_metrics (function)
  Location: src/core/calculator.py:42
  Change: Non-optional parameter 'weights' was added to public function
  Evidence: commit 4a8b21c: "feat: add weights support to metrics calculation"
  Suggested SemVer Bump: MAJOR

2. Assessing Caller Blast Radius

python -m athena analyze . --base v1.0.0 --target HEAD

Analysis Summary:
  - Commits analyzed: 12 commits between v1.0.0 and HEAD
  - Files modified: 8 (Python: 5, TypeScript: 2, Markdown: 1)
  - AST Symbol changes: 3 modified signatures, 1 deprecated export
  - Downstream callers affected: 4 internal callers identified

3. Generating Evidence-Verified Release Notes

python -m athena release-notes . --base v1.0.0 --target v2.0.0 --version "v2.0.0"

# Release Notes - v2.0.0

## Potential Breaking Changes
- `calculate_metrics`: Parameter `weights` added without a default value in `src/core/calculator.py` ([commit:4a8b21c](https://github.com/aaryanrwt/athena))

## What's Changed
- Added async worker queue execution engine in `src/engine/worker.py` ([commit:7d9e10f](https://github.com/aaryanrwt/athena))
- Refactored export interfaces in TypeScript client ([commit:b12c40e](https://github.com/aaryanrwt/athena))

## Documentation Drift
- `docs/api_guide.md` references the old 2-argument signature for `calculate_metrics`

4. Interactive AI Editor Integration (MCP Server)

Add Athena to your claude_desktop_config.json or Cursor settings:

{
  "mcpServers": {
    "athena": {
      "command": "python",
      "args": ["-m", "athena", "mcp"]
    }
  }
}

Now your AI editor can directly query Athena for verified blast radiuses and breaking-change assessments before suggesting code edits.

Code

The entire engine is open-source under the MIT license:

aaryanrwt / athena

Deterministic Git & AST change intelligence engine and Model Context Protocol (MCP) server. Detects breaking changes, maps caller blast radius, identifies doc drift, and drafts evidence-grounded release notes with optional local LLM acceleration.

Athena (athena-mcp)

Local-First, Evidence-Backed Git & AST Release-Readiness and Change-Intelligence MCP Server

Athena is an open-source, local-first Model Context Protocol (MCP) server and developer CLI that delivers verifiable, ground-truth code-change intelligence. By combining deterministic Git diff analysis, Python Abstract Syntax Tree (ast) and TypeScript/JavaScript structural signature comparison, downstream caller blast-radius tracing, and documentation-drift detection, Athena eliminates the hallucination and superficiality of conventional AI release-note generators.

---

Key Differentiators

1. Deterministic-First Core (100% LLM-Independent): Athena works out-of-the box completely offline without Ollama, without an external AI API, and without any network connection. All Git inspections, AST symbol deltas, caller blast-radius graphs, doc-drift warnings, and release notes execute deterministically with 0ms LLM wait time.
2. Ground-Truth Evidence Citations: Every reported change story and potential breaking change is bound to verified EvidenceRecord items containing the 40-character commit SHA, commit subject, file path, exact base/target line spans, unified diff hunk…

View on GitHub

• 33 / 33 Real-World Automated Tests Passing (covering positional-only / markers, staticmethods, Windows NTFS stream protection, and TypeScript multiline interfaces)
• Zero Cloud API Requirement: 100% offline-first with deterministic AST fallbacks.

How I Built It

Athena is engineered around a strict hybrid architecture:

[ Git History & Diff Engine ]
              |
  [ Multi-Language AST Parsers (Python + TypeScript) ]
              |
 [ Deterministic Verification & Blast Radius Engine ]
              |
     [ Ollama Local LLM (qwen2.5-coder:7b) ] (Optional Acceleration)
              |
   [ Standard MCP Server / CLI Output ]

Open-Source AI at the Core

Athena uses Ollama with the open-weight qwen2.5-coder:7b model running locally on consumer hardware (tested on an NVIDIA RTX 4050 Laptop GPU with 6GB VRAM). The model synthesizes multi-commit diffs, grouping disparate changes into cohesive business narratives and technical release themes.

Why Deterministic-First Engineering Matters

LLMs can invent code that does not exist. Athena solves this with a two-tier pipeline:

1. Deterministic Rule Engine: AST parsing and blast-radius tracing run entirely via Python's native ast module and TypeScript syntax tokenizers. The breaking-change verdict is 100% mathematical truth.
2. Evidence Grounding: Any summary produced by the local AI must cite an actual commit SHA and file path. Athena's verifier checks each citation against the real Git log; any hallucinated claims are automatically pruned.
3. Deterministic Fallback: If Ollama is offline or not installed, Athena seamlessly switches to deterministic mode, ensuring 100% CLI and MCP server reliability without any AI runtime.

Why Does Open Innovation Matter?

For a developer tool like Athena, open innovation is the entire business enabler:

• Client Privacy & Zero NDA Breaches: Freelancers and agencies handling enterprise code cannot send client intellectual property to OpenAI, Anthropic, or external cloud endpoints without written consent. Running open-weight models locally on the laptop guarantees 100% data sovereignty. Client code never leaves the machine.
• Viable Unit Economics for a Side Hustle: Sending 50,000-line diffs across 20 pull requests a day to proprietary cloud APIs would rack up hundreds of dollars in token bills each month, destroying margin. With open-weight models running on consumer hardware, the marginal cost per audit is $0.00.
• Offline & Air-Gapped Autonomy: Developers code on flights, commuter trains, and secure air-gapped corporate intranets. Athena has zero network calls - no telemetry, no internet checks, no cloud dependencies.
• No Vendor Lock-In: Because Athena is built on open standards (Git, standard ASTs, and the open Model Context Protocol), users can swap the local model from Qwen to Llama 3 or Gemma 2 at will.

My First User

To test Athena in a real-world setting, I shared it with a freelance backend developer who maintains a micro-service billing API for a retail client.

The Test:
We ran Athena against an upcoming v2.0.0 refactor branch containing 38 commits.

What Happened:
Athena immediately flagged a CRITICAL breaking change: a helper method format_tax_rate had been changed into a @staticmethod and received a new positional argument without a default value. While the author's new unit tests passed, Athena's Blast Radius tool identified 3 legacy webhook processors in other files that were calling the old 1-argument signature. Merging that PR would have broken live customer invoice generation.

Their Feedback:

"Catching that before the client saw it saved my reputation. In my freelance work, a broken webhook means angry emails and lost retainers. I'd easily pay $29 a month for a tool that automates this across my client repos."

What They Asked for Next:
A native GitHub Action that automatically comments the blast radius report directly on pull requests.

Prize Categories

• Week 2: Side Hustle - A local-first change intelligence and release management engine with a clear commercial path for freelancers, agencies, and micro-SaaS teams.
• Best Open-Source AI Application - Combining open-weight models (qwen2.5-coder:7b) via Ollama with deterministic AST static analysis to deliver verifiable, private developer tooling.

Comments

[Marcus Kim]

Adding weights without a default and catching the old two-argument example in docs/api_guide.md makes the release risk concrete. I'd keep the same precision in the blast-radius report: four identified internal callers tells me where to start, but external consumers and dynamically resolved calls can still sit outside that map. The deterministic core working without Ollama is useful here because CI can enforce those checks independently of prose generation. For a paid PR bot, making analysis coverage and unresolved calls visible would help teams decide how much confidence to place in a clean report.