Open source — MIT licensed. Built to be self-hosted and auditable.
Your codebase has rules your AI agent doesn't know. Install one skill — it enforces them on every edit it makes.
Two commands to install everywhere:
npm install -g code-auditor-mcpcode-audit install --agent allClaude Code, Cursor, Codex, Gemini CLI, and any SKILL.md agent. Blocking hooks on Claude Code and Codex; MCP reporting everywhere. code-audit install --list shows the matrix.
You declare the rules once. The agent enforces them on every edit — before anything reaches your repo.
You declare the rules once — .codeauditor.json
{
"rules": [
{
"id": "no-lodash",
"kind": "import-ban",
"severity": "critical",
"module": "lodash",
"message": "Use native Array/Object methods instead of lodash"
},
{
"id": "no-new-function",
"kind": "ast-pattern",
"severity": "critical",
"pattern": "new Function($$$)",
"message": "new Function() is eval by another name"
},
{
"id": "tailwind-only",
"kind": "style-mechanism",
"severity": "warning",
"allow": ["tailwind"],
"path": "src/components/**",
"message": "Only Tailwind in src/components/"
},
{
"id": "no-raw-colors",
"kind": "no-raw-values",
"severity": "warning",
"properties": ["color", "background-color"],
"path": "src/pages/**",
"message": "Use design tokens, not raw hex"
}
]
}code-audit install --agent claudeDrops a SKILL.md into your agent — plus a PostToolUse hook and MCP server where the agent supports them.
.codeauditor.jsonImport bans, call constraints, module boundaries, naming, AST patterns, style mechanisms, raw-value bans. Your codebase's laws.
code-audit changed --fail-on criticalThe skill teaches the agent to run code-audit on the files it changed, instead of grep. On Claude Code and Codex, the hook fires it after every Write and Edit.
no-lodash · critical · src/utils/format.ts:3The agent reads the rule id, severity, file, line, and message — fixes it — and only passing code reaches your repo.
TypeScript, JavaScript, Go, and CSS/SCSS — parsed with tree-sitter WASM grammars.
Thirteen analyzers across TypeScript, JavaScript, Go, and CSS/SCSS — the bugs your agent introduces and your review misses.
`SELECT * FROM users WHERE id = ${id}`String-built queries. The data-access analyzer flags injection, tenant leaks, and N+1s before they reach review.
SELECT * FROM orders // no org filterA multi-tenant query missing WHERE org_id = ?. One customer's data, another customer's screen.
import _ from "lodash"You banned lodash. The agent imports it anyway. It finds out in the edit, not the PR.
a.ts → b.ts → a.tsBroken tree-shaking and undefined at import time, caught before it ships.
The five principles, enforced mechanically.
Copy-paste, caught before it's debt.
SQL injection, tenant leaks, N+1s.
Undocumented exports are future bugs.
The mistakes that survive review.
Queries referencing columns that don't exist.
Your team's rules, enforced as hard invariants.
When schema and code disagree.
Endpoints, fields, auth vs the contract.
Cycles, coupling, hubs, orphans.
Token drift, z-index sprawl.
Mines your code's conventions, flags deviations.
What's visible only across boundaries.
Your agent runs code-audit changed on the files it just touched, not the whole project. Each analyzer returns structured violations — file, line, severity, rule id, and a message the agent can read and fix.