Evolution Engine
Evolution Engine is a local-first command-line tool that detects structural drift in a git repository by correlating git, CI, dependency and deployment signals. Freemium: git and dependency analysis is free, Pro costs 19 USD per developer monthly.
What is Evolution Engine?
Evolution Engine is a command-line tool published by CodeQual LLC on codequal.dev, with terms of service written for version 0.2.x. It installs as a Python package (pip install evolution-engine, Python 3.10 or later) and exposes a single command, evo. Its stated purpose is to know when a codebase drifts before it breaks, and the homepage defines it by what it is not: not a linter, not a scanner. Instead of judging a file line by line, it measures how far the development process has moved away from the repository's own history, using modified z-scores rather than fixed thresholds, calibrated across 48 open-source repositories. The analysis is a five-phase pipeline (events, signals, explanations, patterns, advisory) that runs entirely on the local machine. The free tier reads git signals (files touched, dispersion, change locality, cochange novelty) and dependency signals (count and maximum depth, from pip, npm, go, cargo, bundler and composer lockfiles). The Pro tier adds CI run duration and failures, release cadence, prerelease and asset counts, testing (total tests, failure and skip rates, suite duration), coverage (line and branch rate), Sentry error tracking and Dependabot security findings. Three further families, Monitoring, Incidents and Work Items, are announced as Planned. The point of crossing families, the site argues, is to surface patterns no isolated tool sees, such as CI failing after large dependency updates. Nineteen adapters ship built in, next to a pip plugin ecosystem discovered at runtime and marked with trust badges (built-in, verified, community, local) that can be blocked locally or through a shipped blocklist. The result is an interactive HTML advisory: executive summary, connected and available families, findings comparing Typical with This Time and a deviation multiplier, the triggering commit and correlated evidence. Reports can be produced in English, German or Spanish. The tool itself never calls an AI: it emits an investigation prompt to paste into ChatGPT, Claude, Cursor or Copilot, then re-imports the answer and can verify the fix. It runs manually, as non-blocking git hooks, or as the GitHub Action evolution-engine/analyze@v1 commenting on pull requests. Telemetry is opt-in and off by default, DO_NOT_TRACK is honoured, and the source is public on GitHub under MIT for the CLI and adapter framework and BSL 1.1 for the analysis engine.
What it does
- Detect structural drift as a statistical deviation from the repository's own history, using modified z-scores rather than arbitrary thresholds.
- Correlate signals across families: git, dependencies, CI, deployment, testing, coverage, error tracking and security.
- Produce an interactive HTML advisory report, with a severity and supporting evidence for each finding.
- Generate an investigation prompt ready to paste into your own AI tool (evo analyze . --show-prompt), then feed the answer back in (evo enrich . --from response.txt).
- Re-check after a fix and report what is resolved, improved or still present (evo analyze . --verify).
- Auto-detect the tooling of a repository from configuration files, lockfiles and imports, with no YAML and no setup.
- Run itself automatically as a git hook (post-commit or pre-push) or as a GitHub Action that comments on every pull request.
When to use Evolution Engine / When not to
A quick filter to help you decide if Evolution Engine is the right fit.
When to use Evolution Engine
- Teams that let AI coding agents and assistants write code, and want to see structural drift before something breaks.
- Solo developers and small teams: the permanent free tier covers git and dependency analysis with no server to install.
- Platform and DevOps engineers, with built-in adapters for GitHub Actions, GitLab CI, CircleCI and release feeds.
- SRE and QA engineers, for the Pro-tier Testing (JUnit), Coverage (Cobertura) and Sentry error-tracking signal families.
- Engineering leads and CTOs who want release cadence, build duration and CI failure rate gathered in one HTML report.
When not to use Evolution Engine
- Anyone shopping for a linter or a security scanner: the homepage states it is neither, and it never reviews code line by line.
- Developers working outside version control, or without a terminal: a git repository and Python 3.10 or later are required.
- Users who expect a hosted dashboard, a web or mobile app, or a browser extension: there is none, and the site says so plainly.
- Teams that need monitoring, incident or work-item coverage: the Datadog, PagerDuty, Jira and Linear families are still labelled Planned.
- Free-tier-only users who need CI, deployment, security, testing, coverage or error-tracking signals, and anyone who wants the analysis engine in production without paying: those sit behind Pro, the latter under the Business Source License 1.1.
How to use Evolution Engine
A typical end-to-end flow, from setup to results.
- Install the package: pip install evolution-engine, on Python 3.10 or later.
- Move into a git repository and run evo analyze .
- Let it auto-detect git, lockfiles and CI configuration files, then run the five pipeline phases.
- Read the generated HTML report with evo report, and list connected and available sources with evo sources .
- For the Pro families, export read-scope tokens (GITHUB_TOKEN via gh auth token, GITLAB_TOKEN, CIRCLECI_TOKEN, SENTRY_AUTH_TOKEN with SENTRY_ORG and SENTRY_PROJECT) and run again, or pass evo analyze . --token ghp_...
- Activate a Pro licence with evo license activate KEY, and check it with evo license status.
- Ask for the investigation prompt with evo analyze . --show-prompt, then paste it into your own AI tool.
- Bring the answer back with evo enrich . --from response.txt, and preview a correction with evo fix . --dry-run.
- Check your work after fixing: evo analyze . --verify reports what is resolved, improved or still present.
- Automate it with evo init . --path hooks, --path action or --path all, tune it with evo config set hooks.min_severity critical, and control telemetry with evo telemetry on, off or status.
Pros & Cons
Pros
- Privacy by construction: the analysis is entirely local, no code leaves the machine, no AI API and no key is required.
- Public, auditable source on GitHub, including the client and server telemetry files named explicitly in the privacy policy.
- Trivial to install and to try: one pip install, one command, zero configuration, automatic tool detection.
- A permanent free tier that is usable on its own: git and dependency signals, 11 adapters, 44 patterns, local knowledge base and HTML reports.
- Low and legible Pro pricing: 19 USD per developer per month, billed monthly, cancel at any time, 30-day money-back guarantee.
- An explicit, checkable method (modified z-scores on the repository's own baseline) instead of opaque vendor thresholds.
- Complementary rather than competing: it ingests the output of tools already in place, and can be extended without asking permission (adapter scaffold in one command, free publication on PyPI).
Cons
- Very young product: the terms of service target version 0.2.x, and the first Wayback capture of the domain is 08/05/2026.
- Most signal families sit behind the paid tier: CI, deployment, security, testing, coverage and error tracking are Pro only.
- Three announced families remain Planned (Monitoring, Incidents, Work Items), so the catalogue promises more than what ships.
- Terminal profiles only: a Python CLI, tokens in environment variables, no hosted interface and no dashboard.
- No social proof of any kind on the site: no named customer, no testimonial, no adoption figure.
- Thin institutional footing: no DPA, no subprocessor list, no certification such as SOC 2 or ISO 27001, no about or contact page, no social account, a single channel at info@codequal.dev, and a Sheridan (Wyoming) postal address typical of a registered-agent address rather than an operating office.
- Production use of the analysis engine falls under the Business Source License 1.1, so the free tier is not free for every use; the AI investigation assumes a third-party AI tool and manual copy-paste; and the Pro families depend on user-supplied tokens with a 90-day window, which often produces a Connected but No Data state.
Pricing & Plans
A permanent free plan is available at no charge and covers git and dependency analysis. The cheapest paid entry point is the Pro plan at 19.00 USD per developer per month, billed monthly through Stripe, cancellable at any time and covered by a 30-day money-back guarantee. Taxes are charged in addition (clause 3.5 of the terms). No annual rate, no enterprise tier and no quote-on-request pricing is published, and no free trial is advertised: the free tier is permanent, not a trial period.
- 11 built-in adapters covering git and dependencies
- 44 universal patterns
- local knowledge base
- HTML reports.
- CI
- deployment and security adapters
- git hooks and CI actions
- AI investigation and fix
- community knowledge-base sync.
- 20+ adapters across 9 signal families
- CI
- deployment
- security and error tracking
- testing and coverage
- git hooks and CI actions
- GitHub Action and GitLab CI integration
- the AI investigation and fix loop
- monthly through Stripe
- cancel at any time
- 30-day money-back guarantee
- the on-site call to action is Get Pro.
- The free tier is installed from PyPI as the evolution-engine package.
Data, GDPR & hosting
A consolidated view of how Evolution Engine handles your data.
GDPR overview
No GDPR compliance is claimed anywhere on the pages collected, and no certification is cited. The word GDPR appears only in an HTML source comment marking the cookie banner, never in visible text. The documented mechanisms are concrete: telemetry is opt-in and off by default; the DO_NOT_TRACK=1 environment variable is honoured and overrides the configuration; cookies serve payment (Stripe) and optional anonymous telemetry only, with no tracking or advertising cookies; a What We NEVER Collect table rules out source code, file paths, repository names, commit messages, identities and IP addresses; the identifier is a random UUID and licence checks use a SHA-256 hash of the email. There is no DPO, no Article 27 EU representative, no DPA and no standard contractual clauses. Delaware law governs, the arbitration and class-action waiver does not apply to EU residents, and the minimum age is 16.
Who owns the data?
Clause 6.2 states that you retain all rights to your data: CodeQual claims no ownership of your source code, repositories or configuration files, and the reports, advisories and patterns produced from them belong to you. Clause 6.1 reserves the software, the compiled binaries, the documentation, the site and the brand to CodeQual. Clause 12.4 adds that the publisher has neither access to nor control over locally stored data, and the privacy policy confirms that no code or repository content is transmitted. Two exceptions are contractual: anonymised patterns pushed to the community registry go to the public domain under CC0-1.0 and cannot be recalled (6.3), and feedback grants CodeQual an irrevocable worldwide licence (6.4).
Reuse rights
Pipeline output, meaning the events, signals, patterns, advisories and HTML reports written to local directories, belongs to you under clause 6.2: no permission is needed to keep it, share it or build on it. The restrictions sit on the software rather than on the output. Clause 5.3 forbids reselling, sublicensing or renting the service, and using it to offer a competing product to third parties. Clause 5.1 forbids reverse-engineering the compiled Cython modules (.so, .pyd, .dylib) except as far as the Business Source License 1.1 allows. Clause 5.2 makes the licence key neither shareable nor transferable. Licensing is split in two by clause 4.1: the CLI wrapper and the adapter framework are MIT, while the analysis engine (phases 2 to 5) and the compiled binaries are under BSL 1.1, free for non-production use but requiring an active Pro subscription in production. The code is source-available on GitHub (github.com/alpsla/evolution-engine), third-party adapters can be published freely on PyPI, and patterns can be shipped as pip packages.
Data retention & training
Hosting summary
The whole analysis pipeline, phases 1 to 5, runs on the user's own machine: events, signals, patterns, advisories and reports are written to local directories. Only three flows leave it, namely opt-in telemetry, licence verification and downloads of public patterns. Telemetry is sent to a Vercel serverless endpoint on codequal.dev; there is no database, and events are kept as log entries in Vercel's infrastructure, capped at 100 events per hour per anonymous identifier, the CLI abandoning the request silently after a two-second timeout. Payment is handled entirely by Stripe, Inc., which means the publisher never sees or stores a card number. The licence key is generated server-side, stored in Stripe customer metadata and validated locally without any server call. Community patterns come from a registry endpoint and PyPI packages, cached locally for 24 hours. No hosting country or region is named anywhere on the pages collected, and no subprocessor list is published: Stripe, Vercel and PyPI are only named in prose. The domain resolves to a US anycast node (AS16509, Amazon), a delivery point rather than a storage location. IP addresses are not logged server-side.
Things to keep in mind
Risks and trade-offs to weigh before adopting Evolution Engine.
- The advisories are informational by contract: clause 8 rules out relying on them as the sole basis for a decision, and clauses 8 and 9.1 leave the user responsible for reviewing any AI output before acting on it.
- Delegating engineering judgement to a statistic: a deviation from a baseline is a signal to look at, not a fault, and treating it as a verdict is the easiest way to misuse the tool.
- Process metrics such as files touched, dispersion, release cadence and failure rate can be turned on people instead of systems, which is a management risk rather than a technical one.
- The Pro families rely on read-scope tokens you supply, so those calls travel to GitHub, GitLab, CircleCI or Sentry under their own terms (clause 7.3), and anything pasted into your AI provider leaves the local perimeter entirely (clause 7.4).
- Patterns pushed to the community registry are irrevocable and dedicated to the public domain under CC0 (clause 6.3): you can stop contributing, but you cannot withdraw what is already shared.
- Badly tuned thresholds produce alert fatigue, especially with hooks configured to notify and open a report on every commit.
- Community adapters installed from PyPI execute third-party code locally; trust badges, evo adapter validate --security and a shipped blocklist exist, but review is not systematic. Liability is capped at the greater of 100 USD or twelve months of subscription (clause 9.2), with AAA arbitration and a class-action waiver outside the EU (clause 14).
Setup & Integrations
Technical difficulty
Low on the free tier: one install (pip install evolution-engine, Python 3.10 or later), then evo analyze . in a git repository, with automatic detection, no YAML and no dashboard. Moderate on Pro, where read-scope tokens must be created and exported as environment variables (GITHUB_TOKEN, GITLAB_TOKEN, CIRCLECI_TOKEN, SENTRY_AUTH_TOKEN with SENTRY_ORG and SENTRY_PROJECT), with the required scopes documented. Automation takes one command, evo init . --path hooks, action or all, and evo setup offers a wizard. Real prerequisites: a terminal, Python, a git repository and some familiarity with personal access tokens. Writing an adapter requires Python skills.
Deployment
Integrations
Supported languages
Behind Evolution Engine
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Evolution Engine.
Frequently asked questions
Does my code leave my machine?
Do I need an AI API key?
What is included in the free tier?
How much does Pro cost, and is there a free trial?
How do I install and run it?
Which tools does it support?
How is it different from Snyk, SonarQube or Datadog?
Can I automate it?
Can telemetry be switched off?
Why does it report a token set but no data collected?
Should you pick Evolution Engine?
Evolution Engine occupies an unusual position: it measures the drift of a development process rather than the quality of a file, comparing a repository against its own past instead of against a vendor's thresholds. Its main asset is verifiability: the pipeline runs locally, no code is uploaded, no AI key is needed, and the source is public on GitHub. The entry point costs nothing and commits to nothing, since the free tier is permanent and needs a single command. At 19 USD per developer per month the Pro tier is inexpensive, but it also holds most of what makes the product interesting: CI, deployment, security, testing, coverage and error tracking all sit on that side of the line, and three further families (Monitoring, Incidents, Work Items) are still only announced as Planned, so the catalogue runs ahead of what is delivered. The product is also very young, with terms written for version 0.2.x dated 20/02/2026 and a first Wayback capture on 08/05/2026, and its publisher is barely documented: CodeQual LLC, a Wyoming registered-agent address, no social account, no named team. Practically, this is a tool for technical teams: a terminal, Python, and read-scope tokens for the paid signals. The AI investigation loop stays manual and assumes you already pay for an assistant elsewhere. The contract is candid about its own limits, giving no warranty on the accuracy of the advisories (clause 8) and capping liability at the greater of 100 USD or twelve months of subscription (clause 9.2). Read as what it claims to be, a statistical drift detector that complements existing tools rather than replacing them, it is coherent and cheap to test; read as a guarantee of code quality, it will disappoint.
- Choosing a selection results in a full page refresh.
- Opens in a new window.