DEV Community

Adam
Adam

Posted on

I built a local-first code quality scanner. Here's what it found in a real open-source SaaS

#typescript #opensource #webdev #security

AI-assisted coding makes it possible to build software much faster.

But faster code generation also means more code reaches the review stage, and I wanted an independent layer that checks what was actually built before it ships.

So I built CODYGIENE.

CODYGIENE is a local-first deterministic static-analysis CLI for modern JavaScript and TypeScript projects.

It currently analyzes five areas:

  • Security
  • Performance
  • Code Health
  • AI Quality
  • Structural Architecture Insights

Local scans require no account, and source code is not uploaded during analysis.

I tested it on a real open-source SaaS

For this test, I ran CODYGIENE against the public Papermark repository.

The scan processed:

  • 1,544 files discovered
  • 1,377 eligible files
  • 1,377 files analyzed
  • 100% of eligible files analyzed
  • ~17 seconds total scan time 
npm install -g codygiene@beta
codygiene scan
Enter fullscreen mode Exit fullscreen mode

One example: a circular dependency

One of the findings was a circular dependency across three modules:

upload-notification
        ↓
upload-zone
        ↓
upload-progress-context
        ↓
upload-notification
Enter fullscreen mode Exit fullscreen mode

CODYGIENE reported it as:

HIGH [0.95 SAFE]
CH-HEALTH-003
Circular dependency (3 modules, crosses layers)
Enter fullscreen mode Exit fullscreen mode

What I like about this example is that it isn't simply looking for a dangerous function name or matching a string.

The scanner builds an import graph and can identify structural problems across modules.

Not every finding is treated as a confirmed bug

This was important to me while designing the output.

CODYGIENE distinguishes between different confidence levels.

For example:

  • SAFE = high-confidence structural or deterministic signal
  • REVIEW = potentially important, but requires developer review
  • INSIGHT = informational architecture signal, excluded from scores and gates

An example from the same repository:

High change blast radius: lib/utils.ts

426 direct importers
937 transitive dependents
Enter fullscreen mode Exit fullscreen mode

That is useful architectural information, but CODYGIENE does not pretend that the file is automatically "wrong".

Machine-readable reports

The terminal isn't the only output.

The same scan can be exported to:

codygiene scan --format json
codygiene scan --format sarif
codygiene scan --format markdown
Enter fullscreen mode Exit fullscreen mode

That makes the results usable in CI, code-scanning workflows, internal reports, or other tooling.

Current beta

The current public beta has:

  • 70 registered rules
  • 64 enabled by default
  • 6 disabled by default for signal-quality reasons

The scanner currently focuses on modern JS/TS stacks, including patterns around Next.js, React, Node.js, Prisma, PostgreSQL and related tooling.

What CODYGIENE does not claim to do

It is static analysis.

It does not claim:

  • complete security verification
  • runtime vulnerability detection
  • full semantic architecture understanding
  • detection of whether code was written by AI
  • support for every programming language

Findings still require engineering judgment.

Try it

The beta is public:

npm install -g codygiene@beta
codygiene scan
Enter fullscreen mode Exit fullscreen mode

Documentation:

https://codygiene.nexinov.ma

I'm particularly interested in feedback from real repositories:

  • false positives
  • important things it misses
  • noisy rules
  • unsupported framework patterns
  • scan performance on larger codebases

Top comments (0)