Özgür Işık Damar
Data & Artificial Intelligence

AI code governance2026

Membrane AI

Checks AI-written diffs, masks the secrets it finds and gates the merge — models optional.

Open source · MIT · Deterministic core built; model tiers stubbed by default

Source on GitHubRead the build notes
membrane-ai · local build

Receipts

services: 6 in Go, 1 in Python
7
services/
default analysis budget before the fallback
1.2 s
services/orchestrator/internal/config/config.go
Go test functions
173
**/*_test.go
entries in the decision log
36
docs/DECISIONS.md

Every number comes from a file in the repository — the path is under it.

The problem

AI coding agents move faster than the review around them, and traditional AppSec tooling usually sees their code only after it is committed or opened as a pull request. Putting an LLM reviewer in the loop adds problems of its own: a key leaked into a diff would travel to the model vendor, frontier-model review on every push is expensive, and a merge gate has to earn a team's trust before it is allowed to block.

The approach

Diffs arrive by webhook or gRPC stream and cross Kafka to a Go Saga that runs a chain of stages within a 1.2-second budget (config default): a Blake3 cache hit skips the chain, and once the analyzer masks the credentials it detects, the masked copy replaces the diff for every later stage. Model tiers run after that hand-off: a transparent heuristic stands in until a vLLM endpoint is set, and Claude and Gemini consensus runs only when the local tier flags a diff as risky and the tier is enabled with keys; if the model stage fails, the verdict carries a warning instead of losing the analyzer's findings. Each verdict is written to Postgres with its outbound event in one transaction; with a GitHub token set, verdicts for a commit are then posted as a commit status, plus a PR comment for pull requests. The Envoy edge, AST checks and AWS deployment in the topology figure are target architecture, not code.

What's built

  1. Once the analyzer masks a secret, every later stage gets the masked diff — a unit test pins the hand-off
  2. When a required stage errs or times out, a local secret scan answers; if that fails too, a human must review
  3. A policy-gateway API rules on MCP tool calls and package installs, denying names one edit off popular ones
  4. Shadow mode reports would-be blocks without failing the check, so teams can watch the gate before enforcing

Architecture

Membrane AI — Target topology, not today's build: Go services, Kafka and webhook/gRPC ingestion exist; the prompt gateway, AWS, Envoy, EKS, S3 tiering and WASM/AST do not; model tiers default to stubs.
Target topology, not today's build: Go services, Kafka and webhook/gRPC ingestion exist; the prompt gateway, AWS, Envoy, EKS, S3 tiering and WASM/AST do not; model tiers default to stubs.

The repo's own landing page pitches Membrane as an immune system for AI-generated code; by default, the local model it names is a keyword heuristic and the Claude + Gemini tier stays off.

1 / 4
// build notesThe masked diff is the only diff — privacy by construction, and where it stopsMembrane AI hands every model stage a masked copy of the diff instead of trusting each one to redact. How it works, what degradation can hide, where it stops.Read the build notes

More 2026 builds