kokoro-aegis

Find the holes in AI-made apps before you ship. Static checks plus a "check by hand" table built from your own code and spec — in one command.

npx kokoro-aegis ./my-app
npx kokoro-aegis ./my-app --out report.md

Easiest: ask your AI to run it

No terminal skills needed. If you build with an AI coding tool (Claude Code etc.), just ask it:

Run npx kokoro-aegis . in this project and show me the table it prints.

No API key needed. The command above is for running it yourself in a terminal.

• No AI. Your code never leaves your machine. (If an API key is set, it asks Anthropic / Gemini / OpenAI for their model list only, to check model names. Use --offline to skip.)
• Works on any folder of .js .ts .jsx .tsx .html .vue .svelte files. node_modules, dist, build, .next are skipped.
• Output is a Markdown report. Japanese on Japanese systems, English otherwise (--lang ja|en).

What it checks

By reading the code

| Check | What it finds | |---|---| | catch-empty | Errors swallowed with nothing shown — failures look like success | | catch-console | Errors that only reach the developer console | | truncated | Code that stops midway (typical when generated code hits an output limit) | | ghost-reference | Model names that do not exist (type checks and builds still pass) | | dead-capability | Functions defined but never called | | limit-mismatch | The number shown to people differs from the one enforced nearby | | duplicated-number | The same role's number written in two places |

Findings inside bundled third-party code (e.g. React in a single-file build) are listed separately — not your code.

Check by hand — the things only pressing reveals (blank on open, buttons that do nothing, empty / extreme input, breaking at real data size, order of actions, reopening). It lists your buttons, inputs, storage and limits found in the code, so you know exactly what to press.

With a spec — put a kokoro-spec.md in the folder and the decisions you made are added to the table (older kokoro-仕様.md files are read too).

Zero findings does not mean "no problems". The report always says what it did not check.

Related tools

• npx kokoro-baton "what you want to build" — answer a few choice-based questions and get the spec file (kokoro-spec.md) this tool reads.
• npx kokoro-polish — optional: have Claude Fable read your check.html and write a list of fixes. That one sends your code to an AI; kokoro-aegis never does.

License

PolyForm Shield 1.0.0 — free to use for any purpose, including at work and commercially. You may not use it to build a product that competes with it. See LICENSE.

日本語

AI に作らせたアプリの穴を、出す前に見つける道具です。 読んで見つける検査と、あなたのコードと仕様から作る「手で確かめる表」を、1 行で出します。

npx kokoro-aegis ./自分のアプリ
npx kokoro-aegis ./自分のアプリ --out 紙.md

いちばん簡単な使い方：AI に頼む

ターミナルの操作が分からなくても使えます。Claude Code などの AI と一緒に作っているなら、その AI にこう頼んでください。

このプロジェクトのフォルダで npx kokoro-aegis . を実行して、出てきた表を見せてください。

API キーは要りません。上のコマンドは、ターミナルで自分で打つ人向けです。

• AI は使いません。コードはどこにも送りません。（キーがあれば、モデル名を確かめるために各社のモデル一覧だけを聞きます。--offline で止められます）
• フォルダの中の .js .ts .jsx .tsx .html .vue .svelte を読みます。node_modules dist build .next は読みません。
• 紙は Markdown です。パソコンが日本語なら日本語、それ以外は英語（--lang ja|en で選べます）。
• 仕様の紙（kokoro-spec.md。前の名前の kokoro-仕様.md も読めます）を同じフォルダに置くと、決めたことも表に並びます。Kokoro OS の Baton で作れます。
• 開いて押す検査（6 本）は、Kokoro OS の Aegis が機械で押して調べます。

★ 0 件は「問題なし」ではありません。紙には、調べていないことも必ず書きます。

使ってよい範囲：PolyForm Shield 1.0.0。仕事でも商売でも自由に使えます。これと競合する製品を作るために使うことはできません（LICENSE を見てください）。