The Prospect

A prospector's read of your codebase and your market.

You built fast, and the codebase remembers every day of it. Dependencies that stopped working for a living. The same block of code living in three files. Two vendors billing you for one job. A subsystem you wrote by hand in a weekend that the market now sells as an API. None of it was a bad decision. It accreted, and it has been nobody's job to notice.

That is the ground you own. Then there is the territory: what your industry ships today that your code shows you are still doing the hard way. The credit-repair app parsing PDF reports by regex while report-access APIs deliver structured bureau data with no PDFs anywhere. Every vertical has its version of that, and finding yours is a research job, not a vibe.

The Prospect does both halves.

No terminal? Paste one line to whoever builds for you, or to your own agent: Install and run The Prospect on this project: https://unpkg.com/@bigsteele/the-prospect/docs/install.md. The page it opens is written for the agent: what to run, what never to touch, and how to report back in plain words.

What one run gets you

npx @bigsteele/the-prospect

Step 0 runs offline, reads everything, and writes four files into your repo: the-prospect-<app>.md, .json, .html, and THE-PROSPECT.md, the read itself. Open the .html: the score and the verdict on the first screen, what to do next, then what was found as tables, with everything about the scan itself folded into an appendix. The .md is the same report as text; the .json is every fact with its id. In them:

• Lane 1 - what to subtract. Dependencies with no reference found anywhere, files no entrypoint reaches, duplicated blocks (copies that announce themselves as deliberate are honoured, not flagged), jobs paid for twice, subsystems built by hand where a rail exists, and paid calls that multiply per row, per request, or on a clock. Every finding cites its file. Every line is badged READ.
• The stack cut. Platforms whose job a platform you already run can carry: a vercel.json beside the Cloudflare account that already hosts things, a Clerk bill beside the Supabase plan that includes auth, CI workflows whose every step is an npm script the pushing machine runs free. Both sides of each pair are read from your config files; whether the kept platform's current plan truly carries the load is what the research half verifies, with a source. Publish workflows with a registry identity are never flagged: that is a job a laptop cannot do.
• A score out of 100 and a level, 0 Overgrown to 4 Sharp, with floors a score cannot fake: an unreferenced paid service caps you at 2 no matter how tidy the rest is.
• Your North Star, read, never invented - from NORTH-STAR.md, your planning docs, or PRODUCT.md, with the source named. If none exists, the scan says UNKNOWN instead of guessing.
• Your industry fingerprint - the domain vocabulary your own schema and routes use, which is what the second half researches against.

Step 0 takes seconds, and it is a hypothesis machine: it reads shapes and prints them, every one with an id. It is not the read. Its number is an opening hypothesis, and an agent that stops there hands you a surface scan. The read is THE-PROSPECT.md, dropped beside the report on every run, or the second command:

npx @bigsteele/the-prospect --run        # or --protocol, to paste THE-PROSPECT.md into any agent
npx @bigsteele/the-prospect --skill      # install the agent skill file for Claude Code and OpenClaw

This is a large read, not a quick check, and it says so before it starts. It runs at The Big Sean's depth. The agent spreads the read across sub-agents area by area (dependencies, vendors, what was built by hand, entry points and reachability, cost, the database, the stack), runs your app's own typecheck, lint, tests and build where they cannot write or send anything, probes your live systems read-only where credentials on the machine allow and the repository proves they are yours, and grades 85 checks in ten areas, each PASS, FAIL, UNKNOWN or N/A with evidence and a retest, 18 of them gates where a FAIL means money leaks or a customer's data is exposed. The rubric owes the scan nothing: a read that only rules on what the scan printed has the scan's ceiling. Read-only throughout, it also: establishes your North Star from the pricing page, the schema and the code before it judges anything; takes every Step 0 finding to the code and rules on it, CONFIRMED with evidence, REFUTED with the sentence that names the shape that lied, ON_RECORD with the deciding line, or UNKNOWN with what would settle it; walks the whole tree for the inventories the scan cannot finish on its own - every vendor with the job it does and whose money it touches, every subsystem built by hand and what keeping it buys, every dependency's job, every unreached file's real status, every multiplying call with a price where one is public, the database rulings against the grants, and the shape of the bill; researches your market in six lanes (rails, table stakes, adjacent value, regulatory, the stack cut, and at least three competitors per critical workflow) with sources and dates; ranks everything against the North Star; and writes The Prospect - .md at the repository root with the next ten actions, the inventories in full, the evidence register, and the math, with --html rendering it to a page beside it (the appendices collapsed, the score on top).

Every suggestion keeps the fixed shape - Since you (a fact from your code, file cited), Have you considered (always two options, or one vendor against building it yourself), Because (the industry fact, with a source URL and the year it was checked), Your customer gets (the benefit in the customer's terms), First test (a one-week test needing nobody's permission, and the observation that would kill the idea). A suggestion missing any leg is cut, not softened. And:

npx @bigsteele/the-prospect --check

is the second opinion. It reads the deliverable, .planning/prospect/VERDICTS.json and .planning/prospect/grade.json, fails any rubric check without a grade or with the wrong weight, any PASS or FAIL without evidence from the register, any FAIL, UNKNOWN or N/A without its reason, re-scores the rubric (verified, ceiling, coverage, and the gates) with the math printed, and fails any finding without a ruling, any ruling without evidence, any evidence the report does not show, any unsourced or undated claim, any single-vendor pitch, any advice verb, and recomputes the score from the verdicts with the math printed: a refuted finding costs nothing, a recorded one costs nothing, an unknown one still does. Exit 0 when it holds, 2 when it does not.

The scan's Lane 1 is calibrated on real repositories and the calibration notes say what it got wrong and when it was fixed: a category is not a job (Stripe running Connect beside Square billing the platform is two jobs), one .ilike() is not a search engine, a socket is not a paid call, a revoke ... from anon, authenticated in a migration is a caller check, and a shadcn component nobody imports is scaffold, weighed a quarter.

Standalone

One npx on a cold repository produces the full scan. No sibling scan installed, run, or required.

What it deliberately is not

Not a linter, not a security review, not a design review; it runs nothing. Not a rewrite tool: it writes a report and changes no code. Not a vendor ad: two options minimum, always, with the trade stated. And Step 0 never touches the network - the research half runs only in the agent protocol, where every claim carries a source and a date, and the report marks every line as READ (from your repository) or RESEARCHED (from your market) so you always know which kind of fact you are holding.

Read-only and offline. No network, no database, no shell, and it never opens an .env file. If any output string is shaped like a credential, nothing is written at all: a committed secret is the thing to fix first.

After the report

bigsteele.com/scan - upload the report. You get a written read of the three moves worth making first and what each one buys. No call required to get it, and no pitch inside it. When you want the plan argued with a person: the $497 Scan Analysis call.

Big Steele · bigsteele.com