Aura

Aura helps you and your coding agent follow best practices while you vibe code, so your app stays secure, tested and ready to hand off.

Install with your coding agent

Paste this into Claude Code, Codex, Cursor or Pi:

Install Aura in this repo: run `npx getaura@latest init --yes --agent <claude, codex, cursor, pi or replit: whichever you are>` and follow the steps it prints.

Your agent runs the setup and sends you a link to connect your pilot key in the browser, so the key never goes into the chat. It then helps you write your product brief and shows you your Aura score.

Or install it yourself

npx getaura init

init checks git and the GitHub CLI, asks which coding agent you use, opens your browser to connect your pilot key, drafts your product brief, installs the Aura skill, stops Claude Code from opening your .env files, offers to install the aura command and runs your first scan. After that, run aura check from any folder. Every Aura command needs your pilot key; on a new computer, aura login connects it.

To install the aura command yourself: npm install -g getaura. Without it, use npx getaura <command> (for example npx getaura check).

What you get

• An Aura score from deterministic checks across security, agent setup, foundations and structure, explained in plain language.
• Aura knows what you're building. It works out whether each project in the repo is a web app, website, API, mobile app, CLI, library or extension, which tools it uses, who it's for (just you, your team, customers, businesses or developers) and what raises the bar (payments, AI, sensitive data, many customers in one app), and shows this under the score. The checks that protect those people count for more. Beside the readiness level it shows your stage: Explore, Launch (real people use it) or First hire (two or more people commit). aura inventory shows why it thinks so. If it guessed wrong, say so during aura init or run aura config kind <kind>, aura config audience <audience> or aura config overlays <risks> (in a monorepo, add the folder: aura config kind web-app apps/web). The correction is saved in .aura/config.json, so commit it.
• Your setup: what each project has in place (database, sign-in, email, error monitoring, rate limiting, tests, CI…) and what a project like it usually needs but is missing, in aura inventory and the report. It's advice only and never changes the score, and any tool that does the job counts.
• Next steps in priority order. After a scan (or with aura next), tick the ones you want in the terminal and Aura does them.
• Fixes as pull requests you approve: aura apply foundation puts your brief, agent rules, skills, CI and env example in place in one PR, and aura fix <finding> has Aura's agent make code changes on a branch.
• Pull requests that are easy to review: when you're done for the session, aura pr turns everything still uncommitted (your work, your agent's, and Aura's records like who owns each account) into focused pull requests: one concern each, database changes first, Aura's records apart from code, and local files and secrets left out. It shows the plan and opens nothing until you say yes.
• An agent that keeps it that way: the rules and skills Aura installs teach your coding agent your standards, and GitHub Actions re-scans every push.

Ask your coding agent: "Check my Aura score and fix the most serious issue." Or use Aura's commands in it: /aura:check, /aura:fix, /aura:pr and /aura:orchestrate (to talk to the orchestrator that runs your agents) in Claude Code, /aura-check in Cursor and Pi, $aura-check in Codex.

Privacy

Scanning runs on your machine and your repo is never uploaded. Only short, redacted excerpts needed for an explanation or fix go to the Aura API, and secrets are masked before anything leaves your machine.

Commands

init, check, next, apply, fix, pr, guide, inventory, history, summary, login, whoami, config, check-staged. Run aura <command> --help for options.

License

Aura is licensed under the Functional Source License, Version 1.1, MIT Future License (FSL-1.1-MIT). You can use it for your own projects, your company's and your clients', read its code and change it. What you can't do is offer it, or something built from it, as a product that competes with Aura. Two years after each version is released, that version becomes MIT.

Everything Aura writes into your project (skills, agent rules, workflows, configs, guides) is yours, under MIT-0: use, change and share it freely, no attribution needed. Bundled third-party code keeps its own license (notices).