legacywhisperer

Audit and refactor legacy code using Groq AI — runs entirely on your machine.

npm install -g legacywhisperer

What it does

Point it at any source file and get back a full technical debt report in seconds:

• Maintainability score — 0–100 health score blending AI reasoning (60%) + Radon static analysis (40%)
• Security audit — OWASP-based risk detection with severity levels (critical / high / medium / low)
• Refactoring suggestions — actionable plan with before/after code snippets
• AI refactor — full clean rewrite of the file, streamed token by token
• 17 languages — Python, JavaScript, TypeScript, Java, Go, Rust, C, C++, C#, PHP, Ruby, Swift, Kotlin, Scala, R, SQL, Bash

Quick start

1. Install

# npm
npm install -g legacywhisperer

# pnpm
pnpm add -g legacywhisperer

2. Get a free Groq API key

→ https://console.groq.com/keys

3. Save your key (once — persists forever)

echo 'GROQ_API_KEY=gsk_...' > ~/.legacywhisperer

Or just run any command — the CLI will ask for it interactively if it's not set.

4. Analyze a file

lw analyze app.py

Commands

lw analyze <file>              # audit technical debt, security risks & complexity
lw audit   <file>              # alias for analyze
lw refactor <file>             # clean rewrite of the file (streamed)
lw refactor <file> -o out.py   # save refactored code to a file
lw info                        # check API key & Radon status
lw --help                      # full command reference

Options

| Flag | Commands | Description | |------|----------|-------------| | -l, --language <lang> | analyze, refactor | Override auto-detected language | | -o, --out <file> | refactor | Write refactored code to a file |

Output example

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
  MAINTAINABILITY SCORE: 42/100
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

SUMMARY
This module handles user authentication but mixes concerns heavily...

COMPLEXITY  (Radon)
  authenticate                    CC=C ⚠  line 12
  validate_token                  CC=B ✔  line 47

SECURITY RISKS
   HIGH   SQL query built with string concatenation → line 34
   MEDIUM  Bare except clause swallows all errors → line 61

REFACTORING SUGGESTIONS
   HIGH   [security]  Use parameterized queries instead of f-strings
   MEDIUM  [complexity]  Extract token logic into a separate service

Static analysis (optional)

For Python files, install Radon to get real cyclomatic complexity metrics:

pip install radon

Without it, the score is based on AI analysis only — still useful, just no Radon metrics.

API key setup options

The CLI looks for your key in this order:

| Method | How | |--------|-----| | ~/.legacywhisperer | echo 'GROQ_API_KEY=gsk_...' > ~/.legacywhisperer | | .env in current dir | GROQ_API_KEY=gsk_... in a .env file | | Environment variable | export GROQ_API_KEY=gsk_... | | Interactive prompt | Just run a command — the CLI will ask |

Web app

Prefer a UI? The same AI engine is available as a web app:

legacy-code-whisperer.vercel.app

License

MIT — github.com/dominguezz05/LegacyCode-Whisperer