Status
Read real repo state before any model call.
sober statusThe Raccoon eats AI slop before it ships. 🦝
Open-source · local-first · deterministic · your models
Code review that stays on your machine, runs deterministic, and never auto‑merges.
Local
Pre-push gate on your laptop and Raccoon daemon on your forge. No code leaves your infra.
Proof
Catches secrets, dangerous shell, and prompt injection in milliseconds. Signed evidence, not opinions.
Human
Zero auto-merge paths exist in the binary. The human approves. Always.
Evaluating for a team? Enterprise →
Pre-push gate
Deterministic preflight
Local-first
100% open source
Your models
Forgejo + GitLab
$ sober preflight --staged
✗ sec/secret/aws-access-key
✗ sec/secret/aws-access-key
blocked
1 finding · merge refused
sha256:9f3c… (signed)
Deterministic, not probabilistic.
A model gives you an opinion with a confidence number. Sober gives you a finding ID, a file:line, and a signed verdict. The same diff always produces the same result — no tokens spent, nothing leaving your machine.
$ sober preflight --base HEAD~1
scanning 12 files · 214 added lines
✗ sec/secret/generic-api-key
✗ sec/shell/curl-pipe-sh
✓ 3 rules passed · tree-sitter AST clean
scanning 12 files · 214 added lines
✗ sec/secret/generic-api-key
✗ sec/shell/curl-pipe-sh
✓ 3 rules passed · tree-sitter AST clean
2 findings · blocked
sha256:71ad… · signed · owner@sober
One engine. Three surfaces.
Sober Client is your pre-push gate: local preflight, git hooks, and your own model or cloud subscription, catching slop before it leaves your machine. Sober Gate is the thorough review you point at any repo, on demand. Sober Raccoon Daemon guards the forge: the CE, EE, and EE+ images that watch your repos and help your team iron out software issues. Same scanner underneath; the surface decides where the review runs, never whether a human owns the merge.
Preflight
Secrets, private metadata, shell danger, prompt injection.
sober preflightReview
Route to local or approved remote models under your policy.
sober reviewEvidence
SQLite store keeps runs, findings, jobs, memory, resume packs.
sober plan evidenceForge post
Optional write: one append-only note, optional advisory labels.
sober forge postWhere the Raccoon works
Three surfaces, one scanner. Pick the one that matches how serious you are about not shipping slop.
The pre-push gate
Runs on your machine before you push. Deterministic preflight catches secrets, dangerous shell, and AI slop in milliseconds; git hooks wire it into every commit and push. Bring your own model and cloud subscription, or run fully local. Clean, safe code before it touches a remote.
Point it at anything
The thorough review, on demand. Point the Raccoon at a repo or a diff and it produces findings with file:line, a finding ID, and a signed verdict. One command before you push, or a deep sweep of a repo you maintain. Your rules, your model, your evidence.
The forge guard
The CE, EE, and EE+ container images, protected by a daemon that watches your Forgejo or GitLab day and night. It drains webhook queues, reviews every MR and PR, stores evidence, and helps your team iron out software issues. It never merges, never closes, never deletes.
Free forever. Hardened when your team needs it.
CE, EE, and EE+ are the same deterministic scanner in three container images, all protected by the Sober Raccoon Daemon. Community stays free forever — EE and EE+ add the hardened image and signed rule packs. The gate never auto-merges, at any tier.
Community
0 € · Free forever · Pay what you want
✓ MIT-licensed ✓ No seat cap ✓ No telemetry
- Full rule library in the repo
- Local preflight + review client
- AUR package or source build
- Forge-guardian container image (quarterly)
- Your models, your providers
- No auto-merge path
Free forever isn't a trial. Feed the Raccoon 🦝❤️
Quarterly Stable
299 € per quarterly release
Hardened non-root image + signed rule packs
- Hardened OCI container (non-root, minimal CVE surface)
- Curated, signed rule packs
- 6 months of CVE patches & detector updates
- Self-hosted, no seat limits
- Everything in Community
One-time per release. No auto-renew.
Rolling release
199 €/month · always current
Continuous patches + SOC2 / ISO27001 evidence
- Continuous CVE patches, beta access
- Managed appliance, customer perimeter
- SOC2 / ISO27001 evidence packs
- Fleet-wide vulnerability dashboard
- Everything in EE, always the latest build
Cancel anytime. Self-hosted, your perimeter.
Built for the environments where "auto-merge" is the wrong answer.
Some merges are a convenience. These are a responsibility — a legal act, a security decision, or a promise to every downstream. Sober is designed around the second kind: the human reviews, the human approves, the human owns the outcome. No model gets that authority.
The merge is a security decision
Consensus-critical code, key handling, audit exposure. Every merge can shift economic trust or break a cryptographic invariant. The reviewer must be exact, local-first, and advisory — a model does not get to decide what ships into a ledger.
The merge is a legal act
Mission software, export control, formal review gates. A merge carries a paper trail and a signature. The tool that reviews it must not be a data-exfil path or a rubber stamp — it must leave evidence the operator owns.
Public repos, public blast radius
One bad merge ships to every downstream and every distro rebuild. Maintainers review contributions before they land — and contributors get to review themselves before the world reviews them.
The reviewer must not be a leak
GDPR, DPAs, client confidentiality. Diffs must not be ingested into third-party clouds by default; review must run local-first; evidence must live in the operator's own store — not a vendor database.
Your name goes on the commit. Review yourself first.
Before you push to a public remote, run deterministic preflight on your own diff and a review you control. Sober is the tool for the contributor who wants their own gate before the world's gate — secrets, unsafe shell, and AI slop caught on your machine, in milliseconds, before they ever become public history.
No auto-merge path exists in the binary.
That is a source-level guarantee, not a config flag someone can flip.
Sober posts three advisory labels —
Sober clean,
Sober findings, Sober error — and stops.
The human merges. Always.
State-of-the-art review, without renting your diff
Deterministic guardrails in milliseconds, model review with evidence you can inspect, and a forge daemon that cannot merge. Built for agent-generated code — and for the humans accountable for it.
Deterministic preflight
No model required. Pattern-exact detection of secrets, private
files, unsafe eval()/exec(),
curl|sh, and AI-slop shapes — milliseconds, offline,
zero false-negative drift.
Advisory, never auto-merge
The Raccoon posts evidence and advisory labels. Merge authority stays with the human — structurally, at source level.
Four model routes
local (default), daily,
frontier, security — your keys, your
providers, your call-home policy. Local-first by default.
Tree-sitter across languages
AST facts across Go, Rust, Zig, Janus, Python, JS/TS, C, Bash — with one declarative query file per language.
The Sober Raccoon — forge-side review
A daemon beside Forgejo or GitLab that drains webhook queues, reviews MRs, stores evidence, and posts advisory notes. systemd, podman, or cron. Never merges, never closes, never deletes.
Defense Module — supply-chain defense
Deterministic agent-hook detection for the exact Shai-Hulud surfaces, an install gate before lifecycle scripts run, and self-resolving provider keys. No model required.
Stop paying rent on your own code
Cloud AI reviewers charge per seat to hold your diff on their infrastructure. Sober runs under your policy, on your hardware, with evidence you can inspect.
Greptile
- $20–50/month
- Your code on their servers
- Closed source
- Their models, their rules
- Vendor lock-in
CodeRabbit
- $12–40/month
- Cloud-only
- Closed source
- Limited customization
- Per-seat pricing
Sober
- Free Community forever
- Runs on your machine
- Open source (LSL-1.0)
- Your models, your rules
- No auto-merge path
Install in under a minute
One command per platform — AUR, source, or container — then
sober hooks install all wires preflight into every
commit, merge, and push.
Running a team or a regulated forge? Enterprise editions →
Arch / CachyOS (AUR)
yay -S sober-bin
Any Linux / macOS (source, Go 1.25+)
go install git.sovereign-society.org/Sober/sober/cmd/sober@latest
Forge daemon (CE container, 0 €)
gunzip -c sober-ce_*_linux_amd64.tar.gz | podman load
No public registry — get the CE image tarball first: email link, 0 € is fine
Feed the Raccoon.
Ship clean code.
Deterministic preflight, your own model review, signed evidence you own, and a raccoon that eats AI slop and bugs before they ship. Community free forever; pay what you want, 0 € is fine. Enterprise from 299 € per quarterly release. No auto-merge.