One tool. All patterns. Any input.

Atheon is a community-driven pattern matching engine. You define what you're looking for. You point it at anything. It finds every match and tells you exactly where returning a clear true or false for every rule, every time.

---

What Atheon is

Atheon is a CLI tool built around a single idea: any pattern, any domain, any input. It doesn't care whether you're scanning for leaked credentials, patient identifiers, financial account numbers, prohibited strings in compliance-scoped code, or anything else you can describe as a rule. If the pattern is clear if it can return true or false Atheon runs it.

The engine itself is deliberately minimal. It has no opinions about what matters. That knowledge lives in the patterns, and the patterns come from the community.

Three ways people use Atheon:

• Pre-commit / pre-push hook — blocks bad commits before they leave the machine. Exit code 1 on any finding, which is all a hook needs to abort.
• MCP server — atheon-mcp speaks the Model Context Protocol. Wire it into Claude, Cursor, or Windsurf and the AI can scan code mid-generation, before it ever reaches a file.
• CI pipeline — drop atheon --categories=secrets . into any pipeline. Native binary, no runtime, no dependencies, runs in milliseconds regardless of pattern count.

---

The Mission

Atheon isn't trying to be the next big secrets scanner. It's not competing to become a giant. It's trying to be a platform.

Here's the idea: a developer on a team is working with sensitive data. They write a pattern for Atheon, contribute it, and it ships in the next release. Now everyone using Atheon has that pattern registered. The next team in a similar situation doesn't have to build it from scratch it's already there.

That's Atheon: a community-driven engine where you, me, and anyone else can add patterns that every user benefits from. The goal is a library of rules that covers every domain where text contains something that matters built not by one company, but by everyone who uses it.

Security. Compliance. Finance. Healthcare. Legal. Operations. Gaming. Anything.

If you can describe the rule, Atheon can run it.

---

See it in action

Skip to 9:36 for the live demo, or watch the whole thing to see what Atheon is about.

Atheon Dev Log and latest features ^^^

The scenario that makes this real

A developer wraps up a sprint and pushes a configuration file. Buried in a comment from a debugging session three weeks ago is a production API key. The commit goes through. The pipeline passes. Two months later, someone notices unusual billing activity.

Atheon, wired into a pre-push hook:

$ atheon ./

openai-api-key  config/app.yaml:47
  # de****4f59

1 finding(s)
scanned 23 file(s)  41.3 KB  4ms

Exit code 1. The push never happens. The key never leaves the machine.

That's it. That's the product.

---

Install

Homebrew (macOS / Linux):

brew tap HoraDomu/atheon
brew install atheon

Scoop (Windows):

scoop bucket add atheon https://github.com/HoraDomu/scoop-atheon
scoop install atheon

Manual: Download the binary for your platform from Releases. No install, no runtime, no dependencies. Drop it in your PATH and run it.

Build from source:

go build -o atheon .

---

Usage

atheon <path>                         scan a directory or file
atheon --file <path>                  scan a single file explicitly
atheon --env                          scan all environment variables
atheon --json <path>                  output findings as JSON
atheon --categories=<c1,c2> <path>   scan specific pattern categories only
atheon --all <path>                   include disabled patterns in scan
atheon list                           list all patterns with enabled/disabled status
atheon list --enabled                 list only enabled patterns
atheon list --disabled                list only disabled patterns
atheon list --category=<cat>          list patterns for a specific category
atheon list categories                list available category names
atheon enable <pattern>               enable a pattern by name
atheon disable <pattern>              disable a pattern by name
atheon update                         download the latest patterns bundle
atheon --version                      show version
atheon --help                         show help

Pipe support — pass - (or --stdin) to read from stdin:

cat file.txt | atheon -
git diff | atheon -
git diff | atheon --stdin

Exit code 0 = clean. Exit code 1 = findings. CI-friendly by default.

---

Category filtering

Patterns are organized into categories. Run only what you need:

atheon --categories=secrets .
atheon --categories=secrets,pii .
atheon list categories
atheon list --category=secrets

This keeps scans fast regardless of how many patterns are in the bundle. A pre-commit hook scanning only secrets costs nothing for PII patterns you don't need in that context.

---

Cross-platform: native binaries for Windows, macOS (Intel + Apple Silicon), and Linux. No runtime, no dependencies.

---

Ignore rules

Directory scans automatically respect .gitignore. Drop a .atheonignore in your project root to exclude anything not already covered — test fixtures, generated files, .env files:

# .atheonignore
test/
*.generated.go
.env

# negation — ignore all of dist/ except this one file
dist/
!dist/keep.yaml

# character class negation — exclude files not ending in .go or .yaml
[!a-z]*.txt

Full gitignore syntax is supported including **, ! negation rules, and [!...] character class negation.

JSON output with flags

--json must be the first flag. It can precede any scan command:

atheon --json ./
atheon --json --file config.yaml
atheon --json --env
atheon --json --categories=secrets ./

---

To suppress a single line without ignoring the whole file, add atheon:ignore anywhere on that line:

DEBUG_KEY=sk-fake-key-for-testing  # atheon:ignore

---

JSON output

Use --json to integrate with other tools or build your own pipeline on top:

atheon --json ./

Output is a JSON array, one object per finding:

[{"pattern":"openai-api-key","file":"config/app.yaml","line":47,"match":"# debug key: sk-..."}]

---

Environment scanning

--env scans every variable in the current environment useful in CI to catch patterns injected at runtime rather than stored in files:

atheon --env

---

Pre-commit / pre-push hook

Drop Atheon into a git hook to block bad commits before they leave the machine:

# .git/hooks/pre-push
#!/bin/sh
atheon ./

Or with category filtering for speed:

#!/bin/sh
atheon --categories=secrets ./

Wire it into whatever hook runner you already use (pre-commit, Husky, Lefthook). Atheon returns exit code 1 on any finding, which is all a hook needs to abort.

---

MCP server

Atheon ships a separate atheon-mcp binary that speaks the Model Context Protocol over stdio. Drop it into any MCP-compatible AI tool to let the assistant scan code, files, and directories for pattern matches.

Installation

Download releases:

• Linux: atheon-mcp-linux-amd64 or atheon-mcp-linux-arm64
• macOS: atheon-mcp-darwin-amd64 or atheon-mcp-darwin-arm64
• Windows: atheon-mcp-windows-amd64.exe

Homebrew:

brew tap HoraDomu/atheon
brew install atheon
# Installs both atheon and atheon-mcp

Scoop (Windows):

scoop bucket add atheon https://github.com/HoraDomu/scoop-atheon
scoop install atheon
# Includes both atheon and atheon-mcp

Build from source:

go build -o atheon-mcp ./cmd/mcp

Configuration

Claude Code:

{
  "mcpServers": {
    "atheon": {
      "command": "/path/to/atheon-mcp"
    }
  }
}

Cursor:

{
  "mcpServers": {
    "atheon": {
      "command": "atheon-mcp",
      "args": []
    }
  }
}

Windsurf:

{
  "mcpServers": {
    "atheon": {
      "command": "/usr/local/bin/atheon-mcp"
    }
  }
}

Available Tools

scan_string - Scan text content for patterns:

{
  "name": "scan_string",
  "arguments": {
    "content": "API_KEY=sk-1234567890abcdef",
    "source": "environment",
    "categories": ["secrets"]
  }
}

scan_file - Scan a single file:

{
  "name": "scan_file",
  "arguments": {
    "path": "/path/to/config.yaml",
    "categories": ["secrets", "pii"]
  }
}

scan_dir - Scan entire directories:

{
  "name": "scan_dir",
  "arguments": {
    "path": "/path/to/project",
    "categories": ["secrets", "pii", "code-quality"]
  }
}

Usage Examples

Claude Code Example:

User: "Can you scan the current directory for security issues?"
Assistant: [Uses scan_dir tool] "I found 3 security issues in your codebase..."

Cursor Example:

User: "@Atheon scan this file"
Assistant: [Uses scan_file tool] "Found 2 patterns in config.yaml..."

Categories

Available categories for filtering:

• secrets - API keys, tokens, credentials
• pii - Personal information (SSN, credit cards, etc.)
• code-quality - Debug statements, TODOs, technical debt
• healthcare - Medical identifiers, PHI patterns
• finance - IBAN, ABA routing numbers, SWIFT/BIC codes

Omit the categories parameter to scan all categories.

---

Pattern bundle

All patterns live in community/ as plain YAML files — no Go required. The engine ships with a compiled bundle embedded in the binary. Run atheon update to pull the latest bundle from the release. The update command reports exactly what changed — which patterns were added or removed.

Adding a new pattern is one file:

# community/secrets/my-service.yaml
name: my-service-api-key
match: '\bmsvc_[A-Za-z0-9]{32}\b'
enabled: false   # optional — omit to default to true

Fields:

• name — unique lowercase-hyphenated identifier. Be specific: stripe-live-key, not stripe.
• match — a valid RE2 regex. Use single quotes so backslashes don't need escaping.
• enabled — optional. Defaults to true. Set to false to ship the pattern disabled-by-default (useful for high-false-positive patterns users can opt into).

The folder name is the category. No engine changes, no recompile, no release gate.

---

Pattern state

atheon enable and atheon disable write state to ~/.atheon/pattern_state.json. The state survives binary updates and atheon update — your enabled/disabled preferences are reapplied on top of each new bundle automatically.

atheon enable stripe-live-key
atheon disable console-log
atheon list --enabled
atheon list --disabled

---

Contributing

Patterns are the heart of Atheon. Every pattern is one YAML file — small, fast to review, and immediately useful to every user once merged.

See CONTRIBUTING.md to add your own. See ROADMAP.md for what categories and domains need patterns most.

---

Releases

New versions ship on the 10th and 21st of every month. Releases are fully automated tagging a version builds all platform binaries, generates the patterns bundle, and publishes everything to GitHub Releases, Homebrew, and Scoop automatically.

Latest release: github.com/HoraDomu/Atheon/releases/latest

---

Thank you

Atheon is built by the community. Every pattern contributed ships to every user in the next release. See everyone who has helped make it here: CONTRIBUTORS.md

---

Contact

Questions, pattern requests, or anything else:

Email: dommcpro@gmail.com

---

License

MIT with Additional Terms Copyright © 2026 Dominick Yanez

You are free to fork, clone, study, modify for personal or internal use, and contribute patterns or bug fixes back. That's encouraged.

What you may not do:

• Ship this software, or any derivative of it, as your own standalone product under a different name or brand
• Remove or obscure the author's name or copyright notice from any copy, fork, or derivative work

For permissions beyond this scope: dommcpro@gmail.com

See the full LICENSE file for complete terms.