Semfora - A new way to monitor your org's health, govern your AI initiative, and more.

Hi, I'm Jeremy, founder of Semfora. We launch here on Tuesday, July 28th, and I have been waiting a long time to write that sentence. The one-sentence version: Semfora maps how a repository changes, supports cited investigation and merge review, and keeps the evidence behind engineering decisions retrievable. We think of it as the code-evidence layer for AI governance in software delivery.

The problem, plainly: AI tools have increased the speed and volume of software change, but engineering leaders still own what reaches production. The tools around you already hold pieces of the evidence, in code hosts, scanners, observability, tickets, and AI reviewers, and the decision record ends up fragmented across all of them.

What is live today

Semfora connects to GitHub and analyzes your repository in a short-lived container, producing a deterministic map of functions, relationships, complexity, and history across 30 languages. There is no LLM in that loop; the same input produces the same inspectable evidence. Everything else in the product runs on that map: portfolio and repository dashboards, cited investigation, work items, change feeds, merge analysis, and an optional pull-request gate.

Two younger features in beta, same map underneath:

Error tracing from Sentry. Feed the engine a Sentry error, even a minified one, and it walks you to a probable root-cause path, deterministically. Turn the AI features off and you see the raw output; it is verbose, and you can pipe it into your own agents to find and fix the error. With AI on, the model validates the trace and writes a human-readable root-cause analysis.

Estimated token cost per domain, tracked over time. Token cost turns out to be a decent proxy for complexity and a few other internal numbers, so this doubles as a map of where to place your best people and your best models.

The governance part

This is why Semfora exists rather than being another dashboard. A CODEOWNERS file gates by path. Semfora's pull-request gate ties specific domains to specific contributors, so your payment happy path stays locked down wherever that code lives in your org.

The waiver flow, recording who bypassed a gate and why, belongs to the larger record we are testing with paid pilot customers right now: keeping the reviewed evidence, the named owner, the go or no-go decision, the exception, and the follow-up in one retrievable place instead of reconstructing them from pull requests and dashboards six months later. To be precise about what exists: the repository evidence and the gate are live; the durable decision-and-exception record is pilot design, not a finished

enterprise governance system.

One number, with its limits attached

Across 1,773 resolvable bug cases from 410 public repositories, a high-risk, high-churn Semfora hotspot captured 541 cases, 30.5%, in 8.4% of matched pre-bug line mass: 3.63x concentration. That supports review triage. It does not predict future bugs, find the exact faulty function, or prove anything about AI-written code. A company selling evidence has to hold its own claims to the same standard.

Where your code goes (and where it does not)

Repository source is processed in short-lived analysis compute. We pull from your git provider on every call that needs it, and the bucket your code sits in temporarily is encrypted with a one-hour token tied to that single runner and never persisted anywhere else, including logs. The clone and temporary index are deleted after the run; the derived records that power your dashboards persist. Deterministic analysis never sends your source to a model. Features you explicitly invoke with AI route relevant excerpts through providers with ZDR and PII controls set, and the one feature that gives AI direct access to your code, code review, is disabled for non-internal users while we work out what it means for keeping your data safe.

That separation costs real CPU time on the runners, which is why you will see different machines at different price points. A free user pulling the entire 60 GB Chromium history would stop the party fast.

Security checklists and signed ZDR agreements(1/8 so far...) are available on request at contact@semfora.ai.

What Semfora does not claim

It does not predict which code will fail next, detect AI-written code, replace engineering judgment, or make you compliant with anything. The promise is better evidence for decisions, not automated certainty.

The ask

Connect a repository you already know well and try to prove Semfora wrong. Follow the citations back to the code. Tell us whether the evidence changed where you would investigate, and where it fell short. This post covers about 10% of what the engine can do, and the website has UI for about 40% of it; the fastest way we close both gaps is your feedback. The part of launching I am most looking forward to is engineers pointing Semfora at repositories we have never seen and telling us exactly what breaks. I will be in the comments all launch week. See you on the 28th.