Install

npx codediag scan .

That's it. No config. No account. No server.

Or install globally:

npm install -g codediag

What it checks

codediag auto-detects your stack and runs 5 analyzers:

API Health NestJS

Discovers endpoints from @Get, @Post, @Put, @Delete, @Patch decorators using real AST analysis (ts-morph, not regex). Checks auth guards, typed DTOs, Swagger docs, and return types.

Security

Scans for hardcoded secrets (API keys, Stripe keys, AWS credentials, GitHub tokens), validates .gitignore, checks helmet middleware, CORS configuration, rate limiting, and password hashing.

Dependencies

Runs npm audit, checks lock file existence, flags deprecated packages, validates engine specs and essential npm scripts.

Testing

Detects test files and frameworks (Jest, Vitest, Mocha, Ava), calculates test-to-source ratio, checks for e2e directories and coverage configuration.

Structure

Validates README quality, linter/formatter config, TypeScript strict mode, NestJS module organization, and .env.example presence.

Scoring

Each analyzer scores 0-100. Weighted average determines the grade:

API Health: 25%  ·  Security: 30%  ·  Dependencies: 20%  ·  Testing: 15%  ·  Structure: 10%

| A+ | A | B+ | B | C | D | F | |:--:|:-:|:--:|:-:|:-:|:-:|:-:| | 95+ | 90+ | 85+ | 80+ | 70+ | 60+ | <60 |

CLI

codediag scan .                    # Full report
codediag scan . --format json      # JSON (for CI/CD)
codediag scan . --format md        # Markdown (for PRs)
codediag scan . --ci               # JSON + exit code
codediag scan . --threshold 80     # Fail below 80
codediag scan . --quiet            # Score only
codediag scan . --verbose          # All issues
codediag init                      # Create .codediag.yml

CI/CD

# GitHub Actions
- run: npx codediag scan . --ci --threshold 80

# GitLab CI
codediag:
  script: npx codediag scan . --ci --threshold 80

# Pre-push hook (husky)
npx codediag scan . --quiet --threshold 70

Config

Optional. Create .codediag.yml or run codediag init:

threshold: 70
ignore: [node_modules, dist, .git, coverage]
analyzers:
  api: true
  security: true
  dependencies: true
  testing: true
  structure: true

Supported stacks

| Stack | API Health | Security | Deps | Testing | Structure | |-------|:---------:|:--------:|:----:|:-------:|:---------:| | NestJS | ✅ | ✅ | ✅ | ✅ | ✅ | | Next.js | 🔜 | ✅ | ✅ | ✅ | ✅ | | Express | 🔜 | ✅ | ✅ | ✅ | ✅ | | Node.js | — | ✅ | ✅ | ✅ | ✅ |

How it compares

| | codediag | SonarQube | Snyk | ESLint | |---|:---:|:---:|:---:|:---:| | Zero config | ✅ | ❌ | ❌ | ❌ | | NestJS-aware | ✅ | ❌ | ❌ | ❌ | | Security scan | ✅ | ✅ | ✅ | ❌ | | Dep audit | ✅ | ❌ | ✅ | ❌ | | Test check | ✅ | ✅ | ❌ | ❌ | | Unified score | ✅ | ✅ | ❌ | ❌ | | Offline | ✅ | ❌ | ❌ | ✅ | | Free | ✅ | Partial | Partial | ✅ |

Roadmap

• [x] NestJS API health analyzer
• [x] Security scanner
• [x] Dependency auditor
• [x] Test coverage analyzer
• [x] Project structure analyzer
• [ ] Next.js analyzer
• [ ] Express analyzer
• [ ] SVG badge generator
• [ ] GitHub Action
• [ ] Web dashboard
• [ ] AI-powered fixes
• [ ] VS Code extension

Contributing

git clone https://github.com/scuton-technology/codediag.git
cd codediag && npm install && npm run build
node dist/index.js scan /path/to/project

Use conventional commits: feat:, fix:, docs:, refactor:

License

MIT — Scuton Technology