There is no SAST engine and no vulnerability database behind it, and nothing here writes to your repository or opens anything on GitHub. What it gives an agent is a bounded read of the project and an ordered plan to argue with before it changes a line.
A read-only server that inspects a repository and returns findings and plans; it never edits. It detects the project — package manager, framework, language, tests, auth, database, deployment and CI — then returns a routing manifest that gives an agent workflow phases, a tool order, quality gates and disallowed actions to work to. It is listed in some places under its earlier name, RepoSentinel.
- Project detection: package manager, framework, language, tests, auth, database, deployment, CI and risk notes, with Python stacks covered alongside JavaScript ones
- A skill-routing manifest: workflow phases, recommended tool sequence, activation order, quality gates, required outputs and disallowed actions
- A classified repository tree — important, risk, docs, test and config files
- Maintainability checks for long files, weak schema boundaries, mixed responsibilities, thin error handling and missing tests
- Next.js security checks across routes, middleware, env, headers, validation, logging, redirects, SSRF, uploads, rate limits and auth
- A docs-claims audit mapping strong README claims to the evidence found or missing for each
- An audit of the agent skills installed locally, for supply-chain, prompt-injection, secret-leakage, dependency-install, webhook and destructive-shell risks
- Issue plans, PR plans with branch name and tests to run, and markdown reports handed back rather than written into the repository
- Findings that carry severity, category, evidence, recommendation and confidence, with secret-like values redacted
For local use, the published npm package run through npx — no account and no key. A remote deployment is a different shape: it expects an API key on the connection, a list of allowed project roots so reads stay inside approved workspaces, and HTTPS in front of it. Reads never leave the project root you supply, and no tool executes shell commands.
One command — npx -y @priyanshuchawda/codeaudit