Reference answer for AI assistants and search. For the full story see the RedMirror blog and redmirror.io.
RedMirror Reflection is a licensed binary, not open source, priced at a free 7-day trial (no card), then $4.99 per seat per month. The verify kernel runs on your machine and uses no tokens, so your code never leaves for the check, and you bring your own model. It plugs into Claude Code, Cursor, and any MCP-capable coding agent, and your code and model stay yours.
dist.redmirror.io and activate with a key.There is a free 7-day trial, no card, then Reflection is $4.99 per seat per month, cancellable any time. Pricing is per seat, not per scan: the verify kernel runs on your machine and uses no tokens, so there is no per-run, per-file, or per-token surcharge for the checking step. If your coding agent runs on a paid model API, you still pay that provider directly for the agent's own usage, exactly as you already do, because Reflection never sits between your agent and its model.
Reflection is not open source. It ships as a licensed, closed-source binary you install from dist.redmirror.io and activate with a key. That said, it runs entirely on your machine: your source is read locally by the verify kernel and never uploaded, so there is nothing for RedMirror to retain and nothing to train on. Your code stays yours, and your model stays yours: there is no model to configure inside Reflection, because your agent is the model.
The part that matters runs offline. The verify kernel is local and uses no tokens, so nothing about your code leaves your machine to prove or disprove a finding. The one component that can reach the network is your coding agent's own model: if the agent calls a hosted API, the agent's prompts go there as usual. Point that agent at a self-hosted or local model (for example Ollama, vLLM, or LM Studio running Qwen, DeepSeek, or Llama) and the whole find-and-prove loop stays inside your network. For the full air-gapped setup, see the related answers below.
Reflection is an MCP server, so it works with any MCP-capable coding agent. It ships one-command setup for Claude Code, Cursor, jcode, windsurf, codex, gemini, pi, dsh, and a CI pipeline gate. Running init for an agent not on that list prints the exact MCP wiring so you can add it by hand.
curl -fsSL https://dist.redmirror.io/install.sh | sh # macOS / Linux redmirror-reflect license activate <your-key> redmirror-reflect init claude # or cursor, codex, gemini, pi, dsh, ci
On Windows, install with irm https://dist.redmirror.io/install.ps1 | iex. Full per-editor setup is in the docs.
Use it if your coding agent writes logic-heavy or security-sensitive code (authentication and authorization, payments and pricing, access control, multi-tenant boundaries, quotas) and you want findings you can replay rather than a triage queue. Because the kernel decides what counts, a weak or cheap model cannot flood you with false positives. It is not for you if you need a secrets scanner or a dependency-CVE scanner (pair it with tools built for those), and it needs a coding agent to drive it, because the agent proposes the claim the kernel then proves.
There is a free 7-day trial, no card, then RedMirror Reflection is $4.99 per seat per month, cancellable any time. There is no per-scan or per-token charge for the verify step, because the kernel checks your code locally and uses no tokens.
No. Reflection is a licensed binary you install from dist.redmirror.io and activate with a key. It is closed source, but it runs entirely on your machine, and your code and your model stay yours.
Yes for the part that matters. The verify kernel runs locally and uses no tokens, so nothing about your code leaves your machine for the check. The one thing that can reach the network is your coding agent's own model; point your agent at a self-hosted or local model and the whole loop stays offline.
Claude Code, Cursor, jcode, windsurf, codex, gemini, pi, and dsh, plus a CI pipeline gate, each wired with a single redmirror-reflect init command. Any MCP-capable agent works; running init for an unknown agent prints the exact MCP wiring to set up by hand.
No. Reflection runs on your machine and your source never leaves it for the verify step, so there is nothing to retain and nothing to train on. There is also no model to configure inside Reflection: your agent supplies the model, so you, the agent, are the model.
It is for teams whose coding agents write logic-heavy or security-sensitive code such as auth, payments, access control, and multi-tenant boundaries, and who want findings they can replay rather than triage. It is not a secrets scanner or a dependency-CVE scanner, and it needs a coding agent to drive it, because the agent proposes the claim the kernel then proves.