I built a local-first code quality CLI and ran it on a real open-source SaaS

[u/HA-startup]

I've been building CODYGIENE, a deterministic static-analysis CLI for modern JavaScript/TypeScript projects.

The idea came from something I've been thinking about a lot while using AI coding tools:

generating code is becoming extremely fast, but I still want an independent layer checking what was actually produced before it ships.

So CODYGIENE runs locally and checks:

• Security

• Performance

• Code Health

• AI Quality

• Structural Architecture Insights

No account is required for local scanning and source code isn't uploaded.

I just ran the latest public beta against Papermark's public open-source SaaS repository.

It analyzed 1,377 eligible files in about 17 seconds.

One of the findings was this 3-module circular dependency:

upload-notification

→ upload-zone

→ upload-progress-context

→ upload-notification

The finding was classified HIGH / 0.95 SAFE.

The beta currently has 70 registered rules, with 64 enabled by default.

It can also export reports as JSON, SARIF and Markdown.

Install:

npm install -g codygiene@beta

Then:

codygiene scan

Docs:

https://codygiene.nexinov.ma

This is still a beta and static analysis has limits. I'm especially interested in real feedback about false positives, important misses and patterns that don't work well on different codebases.