Unreviewed AI code is already in your production.

Git blame only names the human who committed the line. LineageLens shows the AI that actually wrote it, whether anyone reviewed it before it shipped, and the license, security, and IP risk it carries — across 11 AI coding tools including GitHub Copilot, Cursor, Claude Code, OpenAI Codex, and Gemini. Open source, self-hosted — zero data leaves your environment. Then lineagelens blame annotates any file line-by-line with the AI that wrote it.

Why a company cares which AI wrote what

The flagship risk is the universal one — unreviewed AI code running in production. Knowing the exact model and prompt then pays off five more ways, roughly in order of the money attached:

01. License & IP contamination (M&A · legal)

AI tools can regurgitate GPL/AGPL-licensed code verbatim. In a proprietary codebase that’s a contamination risk that surfaces hardest in M&A due diligence. LineageLens flags the block, its source, and the license match — the difference between a clean audit and a deal-killer.

02. Security & vulnerability triage (AppSec)

Tools and versions have measurable tendencies — insecure defaults, hallucinated packages, missing input validation. Trace a CVE-class pattern to its source and sweep every other block from it, instead of auditing line by line.

03. Compliance & attestation (SOC 2 · EU AI Act)

Regulated industries and frameworks increasingly want a provenance trail: how was this produced, and who reviewed it? “AI-written, human-reviewed, by whom” becomes an auditable record you can attest to.

04. ROI on your AI seats (Spend)

You’re paying for Copilot, Cursor, and Claude seats. See what fraction of merged code they actually produce — and whether it holds up. The one case where the specific vendor maps straight to a renewal decision.

05. Incident forensics (On-call)

When prod breaks, the first question is “what wrote this, and was it reviewed?” The blame engine answers it in seconds instead of an afternoon of git archaeology.

The problem: your codebase is full of AI-generated code and you don’t know where

Who actually wrote this line?

Git blame names the person who committed the code. It can’t tell you the line came from Copilot, Cursor, or Claude — or that no one on the team fully understands it.

What was the AI asked to do?

The prompt is where AI code comes from — and often where the bug comes from too. The moment the chat window closes, that context is gone for good.

Which AI code is risky?

A hallucinated call in your payments flow is not the same as a generated test helper. Until you know what’s AI-written, you can’t tell them apart — until it breaks.

How it works: three layers, one transparent system

01. Install the extension (All tiers)

Add the VS Code extension and it starts recording right away — it spots large AI insertions and stores a provenance record on your machine. For the free Base tier, that’s the whole setup.

02. Point your AI tool at the proxy (Lite · Plus · Max)

Set one environment variable so your AI tool talks to localhost:8788. LineageLens records the full prompt, model, and response, then forwards the request untouched. Your tool sees no difference.

03. Review it on your own backend (Lite · Plus · Max)

Records land in a backend you host — SQLite in one container (Lite) or FastAPI + PostgreSQL (Plus/Max). Dashboard, timeline, lineage graph, and search all run from there. Nothing touches our servers.

Capabilities

Pricing & tiers

Isn’t this just GitLens? No — git blame names a person; LineageLens names the AI

GitLens and git blame tell you which human committed a line. LineageLens tells you the model behind it, the prompt that produced it, and the risk it carries:

Why you can trust it

We’re new and won’t pretend otherwise. Instead of testimonials, here is what you can verify yourself:

Built in the open

LineageLens is one open-source (MIT) monorepo you self-host — not a black box and not a hosted SaaS. 11 AI coding tools captured, a 5-signal confidence engine, 29 backend services, and 460+ automated backend tests. Export and import in the open cursor/agent-trace format so your provenance is never locked in.

Capture

The proxy parses each provider’s native tool-calling protocol — Anthropic tool_use, OpenAI apply_patch, Gemini functionCall — for the full prompt and model. The VS Code extension watches 4+ line inserts with no proxy at all.

Store

Records flow into a FastAPI backend you host — SQLite (Lite), PostgreSQL + pgvector (Plus/Max), or Neo4j for cross-tool graph lineage (Max). Nothing ever touches our servers.

Govern

Search, risk scoring, a tamper-evident SHA-256 hash chain, a signed AI Bill of Materials, RBAC, audit log, and a GitHub Actions risk gate — all running on your own infrastructure.

Security, in the open

We run an autonomous adversarial assessment against our own product — 450+ test cases across 39 attack categories on all three tiers, plus a line-by-line review of every proxy adapter. Overall resistance: 84.9%. Strongest areas: authentication and token security (100%), SQL/Cypher injection and path traversal (98–100%). It withstood JWT algorithm confusion, cross-workspace IDOR, webhook SSRF, and integrity-chain tampering. Honest open findings, disclosed and tracked: rate limiting ships disabled in dev and must be enabled in production; the workspace_id query parameter is ignored on read endpoints (the JWT workspace is always enforced, so no cross-workspace reads); ingest is not yet idempotent; dashboard output-escaping is being hardened; and connection-hold (slowloris) should be mitigated with a front proxy timeout. None of the findings allow access to another workspace’s data — they are operational hardening, fixable without architectural change.

What LineageLens is not

The fastest way to trust a tool is to hear what it won’t do:

Not a SAST scanner

The risk score is heuristic — file path, language, and known-risky patterns. Pair it with Snyk or Semgrep; it does not replace them.

Not certified (yet)

RBAC, SSO, hash-chain integrity, and AI-BOM export all exist — but haven’t been validated against SOC 2 / ISO 27001 controls. Treat it as developer-governance tooling.

Not multi-tenant

One instance serves one workspace tree. Run separate instances for unrelated workspace groups — by design, for isolation.

Cursor & Copilot are partial

Their agent traffic routes through proprietary backends, so you get editor-level capture — the file and inserted lines, but not the prompt or model. We say so up front.

Frequently asked questions

What is LineageLens?

LineageLens is an open-source, self-hosted AI code governance and provenance platform. It tracks which AI tools (like GitHub Copilot, Claude, or ChatGPT) generated specific lines of code, the prompts used, and the associated risk levels.

How much does LineageLens cost?

LineageLens Base (VS Code extension) and Lite (Docker backend) are 100% free and open-source. LineageLens Plus costs $12 per active developer per month, offering team collaboration features. LineageLens Max offers custom enterprise pricing.

Does LineageLens send my code or prompts to external servers?

No. LineageLens is entirely self-hosted. All data, including prompts, code insertions, and metadata, remains on your local machine (Base tier) or within your organization's own infrastructure (Lite, Plus, Max tiers). LineageLens operates no central cloud.

How does the LineageLens proxy capture AI prompts?

LineageLens captures prompts by functioning as a transparent local proxy. Developers configure their AI tool's base URL to point to localhost:8788. LineageLens logs the request metadata and forwards the prompt to the AI provider (e.g., Anthropic, OpenAI) with minimal latency.

What is the difference between LineageLens Base and Lite?

LineageLens Base is a standalone VS Code extension that detects AI code insertions locally via file-watching. LineageLens Lite adds a local Dockerized SQLite backend, a transparent proxy for prompt capture, support for 11 AI adapters, and a web-based dashboard.

Can LineageLens be deployed in an air-gapped environment?

Yes. LineageLens Base is fully functional in air-gapped environments without network access. The Lite, Plus, and Max tiers can also operate air-gapped, requiring internet access only initially to pull the required Docker images.

Is LineageLens a replacement for Snyk or Semgrep?

No. LineageLens provides AI code provenance, not deep security analysis. The LineageLens risk score is a heuristic based on file paths and language density. It should be used alongside SAST tools like Snyk or Semgrep to secure software supply chains.

How is data encrypted in LineageLens?

In LineageLens Base, data is stored in local JSON files protected by OS-level encryption (FileVault, BitLocker). In higher tiers, data resides in SQLite or PostgreSQL, supporting host-level encryption. In-transit proxy connections enforce TLS 1.2 minimum.