Celmis is self-hosted code intelligence. It reads your repositories once and keeps a symbol graph of them. Asking questions, reviewing pull requests, auditing dependencies and generating documentation are all different ways of reading that one index.

Is Celmis open source?

Yes. Celmis is released under the GNU Affero General Public License v3.0, with one exception noted in the licence file. Anyone you run it for over a network is entitled to its source. The repository is at github.com/Celmis-labs/Celmis.

Does Celmis send my code anywhere?

No. It runs on one machine under docker compose with Postgres and Qdrant bundled. The only outbound calls are the ones the operator configures for their chosen model provider. There is no telemetry and no licence check.

How does Celmis score on the Martian Code Review Bench?

17th of 50 on the offline set, stable under all three judges. That figure measures pull-request review on isolated single-repository pull requests, a set in which no symbol has consumers in a sibling service, so the cross-repository work Celmis is built around is not in the number. An audit of the 79 findings the benchmark scored false found 33 were real defects the gold set was silent about.

What does Celmis need to run?

Docker 24 or newer with Compose v2, roughly 4 GB of free RAM, and an API key for one of Google Gemini, Anthropic, OpenAI, OpenRouter, Groq or Mistral. A first install took 197 seconds from git clone to six healthy services on a clean server.

Does Celmis make my product CRA compliant?

No, and it deliberately does not claim to. Celmis produces an evidence pack — a CycloneDX SBOM, findings, a timeline and a manifest of sha256 digests — that a third party can verify without trusting the machine that produced it. Compliance is a judgement about your organisation, not an output a tool can emit.

hover a node — its consumers light up

Celmis

Self-hosted code intelligence.

Ask your codebases, review pull requests, and produce the evidence an auditor asks for.

Install in 197 seconds → Read the source

AGPLv3 · source-available to every user ● self-hosted · one machine 23 languages parsed 18 MCP tools

Celmis reads your repositories once and keeps a symbol graph of them — everything else is a different way of reading that graph. It runs on one machine under docker compose, with the model provider of your choice behind it, and nothing leaves your network except the calls you configure.

In the oldest telling, Kelmis was the smelter — one of three who found how to work iron with fire. The index does the reducing here; the surfaces are what work the result.

What a diff-only tool cannot do

Ask a question that spans two repositories, and the answer quotes both

The gateway and the payments service are separate repositories with no shared code. The answer traces the call chain between them — then notices, unprompted, that the Kafka topic name is hardcoded in both, and that changing one silently breaks the other.

A reviewer that reads only the diff structurally cannot say that. It never had the other repository open.

Celmis answering a question that spans two repositories, citing files in both — One question, two repositories, two languages — with file and line citations on both sides.

Seven things people do with it

Index once, then read it from whichever side of the work you are standing on

You are a PM, a delivery lead or the client, and want to know what state a group of projects is in

Ask it. From any device, anywhere, without booking time from an engineer and without a meeting whose only output is a paragraph. ask the code

A new engineer has a question a senior would have to answer

Every one of those pulls someone experienced out of flow, at the moment they are already covering. The codebase answers instead, with file:line citations. ask the code

Two teams share an integration and neither can read the other's repository

Load it, grant the right to ask, and deny the paths that must stay private. They get answers; the credentials are refused at the source. access rules

A customer or an auditor asks for your SBOM

One button, CycloneDX, plus an evidence pack whose manifest lets them verify it without trusting you. dependencies and evidence

A vulnerability lands in a dependency

Fix with Claude hands an embedded session the repository, the package and the finding. It edits, the runner pushes a branch and opens a pull request. fix it from here

A pull request needs reviewing

Agents read the diff — and, where the graph is built, who else calls what is being changed, including from another repository. pull-request review

Your own agent or editor needs to understand the codebase

Point it at /mcp/. Eighteen tools over the same index, under the same access rules — no second copy of your code anywhere. mcp

The first three are the ones a code-review tool does not do at all, and they are the reason this is a platform rather than a reviewer.

Three numbers

Including the one that does not flatter us

197 s

from git clone to six healthy services, measured on a clean server

$0.118

per pull request reviewed, on the model this ships with

17th of 50

on the Martian Code Review Bench offline set, under all three judges

That last one is deliberately unflattering, and it stays. It measures one of the surfaces above — pull-request review on isolated single-repository pull requests — and that set has no sibling service for a symbol to have consumers in. The thing this product is built around is not in the number at all.

The table, an audit of every finding it scored false, and the command that reproduces both are in the repository. Of the 79 findings the benchmark counted against us, 33 turned out to be real defects the gold set was silent about.

The other surfaces

Same index, read four more ways

Evidence pack contents: CycloneDX SBOM, findings, timeline and a manifest of sha256 digests — **Dependencies, SBOM and the evidence pack.** CycloneDX plus findings, a timeline and a manifest of sha256 digests — so a third party can verify the pack without trusting the machine that produced it. Celmis does not claim regulatory compliance on your behalf, and says so in its own output.

Fix with Claude, pre-filled with the repository, package and finding — **Fix it from here.** The finding hands an embedded session the repository, the package and the context — no copy-pasting the problem into a chat window somewhere else.

A pull request opened on GitHub by the embedded session — **And it lands as a pull request.** The session edits, the runner pushes a branch and opens the PR — the review still belongs to a human.

MCP transcript: one query resolving a symbol across two repositories — **Eighteen tools over MCP.** One query, two repositories, two languages, the same contract symbol — from a client that has never checked either of them out.

Writing

Things worth reading once

Quick start

Docker, a model key, and about four gigabytes of RAM

Postgres and Qdrant are bundled — there is no external cluster to provision, and no Python or Node.js install needed for the Docker flow. A free Gemini key is enough to evaluate.

# clone, then generate every secret in the format it needs
git clone https://github.com/Celmis-labs/Celmis.git celmis
cd celmis
./scripts/init-env.sh

# first boot pulls three images and applies migrations
docker compose --env-file .env up -d
docker compose ps

Terminal transcript of a first install reaching six healthy services — A first install on a clean server, recorded end to end.

Bring your own modelGoogle Gemini, Anthropic, OpenAI, OpenRouter, Groq or Mistral — whichever you already pay for.
Keys go in through the interfaceNot into a file you might commit, and not into an image you might push.
Nothing phones homeThe only outbound calls are the ones you configure. No telemetry, no licence check.

Full instructions in the guide →