Free and open source — MIT licensed. Built to be auditable.
Code Auditor reads your whole codebase and tells you what's wrong with it — including the problems that only exist between files. Install one skill, and your agent keeps it that way on every edit.
Two commands to install everywhere:
npm install -g code-auditor-mcpcode-audit install --agent allClaude Code, Cursor, Codex, Gemini CLI, and any SKILL.md agent. Blocking hooks on Claude Code and Codex; MCP reporting everywhere. code-audit install --list shows the matrix.
Inherited a codebase? Coming back to one you haven't touched in months? Built something fast and now you need to know what's actually in it? Audit once to see the whole picture, then let your agent keep it clean on every edit. Either way, the analysis is deterministic.
code-audit auditRun it against any TypeScript, JavaScript, Go, or CSS/SCSS project and get a complete, structured diagnostic report — a reading for every rule. Fix the real problems, baseline the rest, and start from a clean slate.
Tree-sitter and ast-grep do the analysis — readings are identical every run, with any model or with none at all.
HTML · JSON · CSV · SARIF 2.1.0The coverage panel leads — what was measured — then file, line, severity, rule id, and a message for every reading. Baseline the known issues as debt and only the new ones stand out.
code-audit changedOnce installed, your agent audits only the files it just touched. Readings at a blocking severity — critical and warning by default — are caught and fixed before they reach the repo, without re-reading the whole codebase, so model costs stay low.
code-audit install --agent claudeDrops a SKILL.md plus a PostToolUse hook into your agent — Claude Code and Codex.
code-audit changed --jsonOnly the files that changed, not the whole project. The hook fires after every Write and Edit.
hardcoded-secret · critical · src/login.ts:52The agent reads the rule id, severity, file, line, and message — fixes it — and only code without blocking readings reaches your repo. The severities that block are configurable via gateSeverities in .codeauditor.json.
TypeScript, JavaScript, Go, and CSS/SCSS — parsed with tree-sitter and ast-grep grammars.
Ten analyzers, plus three cross-language analyzers, across TypeScript, JavaScript, Go, and CSS/SCSS. Every example below is a real reading from a real codebase — most of them invisible to any single file.
for (const org of orgs) { await db.select().from(organizations) }A loop issuing one query per iteration, found across a hierarchy walk in a live query module. Every node is another round-trip to the database.
compliance-enhanced.ts — 563 lines, 0 external importers563 lines, zero external importers, superseded by newer siblings and still in the tree. Nothing links to it, so nothing catches it.
SELECT * FROM generation_queue // dropped in migration 0198A migration removed the table, but eight call sites still reference it. The schema moved on; the code didn't.
page.type('#password', 'vyy8AUVvish34Fq')A plaintext password sitting in a script, ready to ship. Found by reading the file — no execution needed.
The five principles, enforced mechanically.
Copy-paste, caught before it's debt.
SQL injection, tenant leaks, N+1s.
Undocumented exports are future bugs.
The mistakes that survive review.
Queries referencing columns that don't exist.
Your team's rules, enforced as hard invariants.
When schema and code disagree.
Endpoints, fields, auth vs the contract.
Cycles, coupling, hubs, orphans.
Token drift, z-index sprawl.
Mines your code's conventions, flags deviations.
What's visible only across boundaries.
Your agent runs code-audit changed on the files it just touched, not the whole project. Each analyzer returns structured readings — file, line, severity, rule id, and a message the agent can read and fix.
Three honest boundaries, stated plainly.
It reports. A human — or an agent — does the editing. Code Auditor tells you what's wrong and where; it never patches your code for you.
Run it alongside ESLint, Prettier, and the rest. A linter reads one file; Code Auditor reads the whole codebase. They answer different questions.
Function length, parameter count, class size — these are measurements you can tune, not judgments. They're readings: the order to act, never a verdict on your code.