untapped

Scan your codebase, find the vendor features you're paying for but not using — and the manual implementations vendors already ship natively.

npx untapped

Runs from any directory with a package.json. Detects supported vendors, fetches that vendor's knowledge pack, audits your code with Claude, and prints findings.

What you get

Three buckets of findings, every run:

• Unused features — capabilities the vendor ships that your code doesn't use.
• Manual implementations — code you wrote that the vendor already handles natively (and ships in 15 lines instead of 200).
• Opportunities — surfaces in your codebase that don't import the vendor today but should.

Each finding includes file references, a clear "why it matters", and a complete, pasteable suggested change.

Apply with Claude Code

After printing findings, untapped writes them to untapped/{vendor}/{timestamp}.md and offers to hand off to Claude Code. Walk through each finding interactively, or apply them all in one shot — Claude Code reads the file and edits the indicated source files.

Setup

export ANTHROPIC_API_KEY=sk-ant-...
cd /path/to/your/project
npx untapped

The CLI uses your Anthropic key to run the audit. Knowledge packs are fetched from the Untapped platform; vendors publish them at signup.

Flags

| Flag | What it does | |---|---| | --yes | non-interactive — skip all prompts | | --features <text> | pre-supply the "anything new you're planning?" answer | | --apply <interactive\|all\|skip> | post-run mode without prompting | | --latest | also update untapped/{vendor}/latest.md to point at this run | | --no-signals | don't POST anonymized signals to the platform | | --vendor <domain> | scan a specific vendor (skips picker) |

Privacy

Untapped sends anonymized activation signals to the platform after each scan. Each signal carries:

• A non-reversible hash of your repo (repo_hash)
• The finding category and severity
• An anonymized code pattern (strings, paths, URLs stripped)
• Your git user.email so vendors can recognize their customers — set UNTAPPED_NO_EMAIL=1 to suppress

Raw source, file paths, and identifiable tokens never leave your machine.

License

MIT.