# audit [Health: Active]
**Category:** ๐ป Developer Tools
**Repository:** https://github.com/commitshow/cli
**GitHub Stars:** 1
**Views:** 0
**Installs:** 0
**Upvotes:** 0
**Directory Page:** https://allmcps.com/mcp/audit-5
## Description
Score any public GitHub repo 0-100 against the commit.show audit rubric.
## Claude Desktop Quick Installation
Install path detected from listing signals. Uses `npx` (confidence: high):
```json
"mcpServers": {
"audit": {
"command": "npx",
"args": ["-y","commitshow@latest"]
}
}
```
## Documentation & README
commit.show CLI
Audit any vibe-coded project from your terminal.
Score ยท 3-axis breakdown ยท 3 strengths + 2 concerns ยท rank ยท delta โ in one command.
```bash
npx commitshow@latest audit github.com/owner/repo
```
```
โโโโโโโ โโโโโโโ โโโโ โโโโ โโโโ โโโโ โโโ โโโโโโโโโ โโโโโโโโ โโโ โโโ โโโโโโโ โโโ โโโ
โโโโโโโโ โโโโโโโโโ โโโโโ โโโโโ โโโโโ โโโโโ โโโ โโโโโโโโโ โโโโโโโโ โโโ โโโ โโโโโโโโโ โโโ โโโ
โโโ โโโ โโโ โโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโ โโโโโโโโ โโโโโโโโ โโโ โโโ โโโ โโ โโโ
โโโ โโโ โโโ โโโโโโโโโโโ โโโโโโโโโโโ โโโ โโโ โโโโโโโโ โโโโโโโโ โโโ โโโ โโโโโโโโโโ
โโโโโโโโ โโโโโโโโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโโโโโโ โโโ โโโ โโโโโโโโโ โโโโโโโโโโ
โโโโโโโ โโโโโโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโ โโโโโโโโ โโโ โโโ โโโโโโโ โโโโโโโโ
โญโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฎ
โ โป commit.show โ Audit report โ
โฐโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฏ
commitshow github.com/commitshow/commitshow
Findings ยท 1 critical ยท 1 warning ยท 3 strengths
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ What this build missed โ
โ โ 25 FK columns unindexed โ fk_columns_seen=100 vs inโฆ โ
โ โ Zero observability libs in 17 deps โ no Sentry, Pinโฆ โ
โ โ
โ What it got right โ
โ โ 56 RLS policies cover all 19 tables โ gap_estimate=โฆ โ
โ โ Lighthouse accessibility 93, best practices 96, SEOโฆ โ
โ โ Rate-limit middleware active on API routes โ vibe_cโฆ โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ AI Coder 7 Frames ยท what AI ships without โ
โ โ
โ โ Error tracking โ
โ no error-tracking dependency or config declaredโฆ โ
โ โ Database indexes โ
โ 100 FK columns ยท 75 indexes ยท 25 unindexed โ
โ โ supabase/schema.sql ยท id โ auth โ
โ โ RLS coverage โ
โ 19 tables ยท 56 policies ยท all covered โ
โ โ Secret in client code โ
โ no service-role keys in client paths โ
โ โ API rate limiting โ
โ custom middleware detected โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
ฮ +20 since last audit
โ https://commit.show/projects/1c262df3-โฆ
next ยท feed your AI loop โ commitshow audit . --json
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ commitshow/commitshow โ
โ โ
โ โโโโโโโโ โโโโโโโโ โ
โ โโโโโโโโ โโโโโโโโ โ
โ โโโโ โโโโ โ
โ โโโโ โโโโ โ
โ โโโ โโโ โ
โ โโโ โโโ โ
โ โ
โ / 100 ยท walk-on ยท strong โ
โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ
audition unlocks final 5 ยท max walk-on score 95
Audit 35/50 โฐโฐโฐโฐโฐโฐโฐโฐโฐโฐโฐโฐโฐโฐโฑโฑโฑโฑโฑโฑ
Scout โ/30 โ audition unlocks โ
Comm. โ/20 โ audition unlocks โ
commit.show
```
> [โญ Star us on GitHub](https://github.com/commitshow/cli) if `commitshow audit` saved you a `// TODO`.
---
## Why
Vibe-coded projects ship fast and break differently. The CLI gives you a
**zero-config**, **walk-on** lane to commit.show's audit engine โ the same
Claude-grade analysis used in our 3-week leagues, minus the signup, fee,
and league commitment. You get a snapshot of where the build sits, what's
strong, what's wobbling, and how it ranks against everyone else this week.
Local runs also drop `.commitshow/audit.md` and `.commitshow/audit.json`
into your repo, so your AI coding agent can read the report on the next
turn without a prompt-engineering ritual.
When a project is ready for the full season โ Scout forecasts, season
ranking, Backstage prompt extraction, Hall of Fame โ it auditions at
[commit.show/submit](https://commit.show/submit).
> The npm package + command is `commitshow` (no dot โ npm doesn't allow
> it in package names). Everywhere else uses the brand **commit.show**.
## Install
```bash
# one-shot (recommended for trying it on someone else's repo)
npx commitshow@latest audit
# or global, if you'll run it daily
npm i -g commitshow
commitshow audit
```
Requires **Node 20+**.
## Usage
| Command | What it does |
|---|---|
| `commitshow audit [target] [--json] [--refresh] [--source=]` | Fetch + render the latest audit, write `.commitshow/audit.{md,json}` |
| `commitshow status [target]` | Same render as `audit`, no re-run |
| `commitshow login [--no-open] [--token ]` | Device-flow sign-in via browser approval |
| `commitshow whoami [--logout]` | Print the linked account ยท `--logout` clears the saved token |
| `commitshow submit [target]` | Audition a project (coming soon ยท needs login) |
| `commitshow install ` | Install a Library artifact (coming soon) |
### Sign in for higher rate limits
```bash
npx commitshow@latest login
```
Opens `commit.show/cli/link?code=<6-hex>` in your browser. After you
click Authorize there, the CLI receives a 90-day JWT and saves it to
`~/.commitshow/config.json` (file mode 0600). Subsequent calls send
the token in the Authorization header automatically.
What changes once signed in:
- Per-IP rate cap goes from **20 audits/day** to **50/day**
- Newly audited preview projects auto-claim ownership (visible at
[commit.show/me](https://commit.show/me) โ MY AUDITS)
- `commitshow whoami` prints your member id + email
Headless / CI? Use `--token ` to skip the browser handshake.
### Telemetry source flag
`--source=` lets you self-report how the call originated:
```bash
npx commitshow audit . --source=claude-code
COMMITSHOW_SOURCE=cursor npx commitshow audit .
```
Common tags: `claude-code` ยท `cursor` ยท `gemini-cli` ยท `codex` ยท
`antigravity` ยท `production-audit-skill` ยท any 64-char string. Drops
into the maintainer's admin breakdown so we can see which agent
ecosystems are driving installs. Skip the flag to stay anonymous.
### Target forms
`audit` and `status` accept a positional target that auto-detects:
| Form | Example |
|---|---|
| cwd (omitted) | `commitshow audit` ยท infers from `git remote get-url origin` |
| Local path | `commitshow audit ./my-repo` |
| Remote URL | `commitshow audit github.com/owner/repo` ยท `commitshow audit https://github.com/owner/repo` |
| SSH remote | `commitshow audit git@github.com:owner/repo.git` (auto-converted) |
| Shorthand | `commitshow audit owner/repo` |
Remote-URL mode works from any directory, which makes one-line X posts
(`npx commitshow@latest audit `) trivial.
> **AI agents โ read this before invoking.** The CLI does **not** look up
> projects by name. `commitshow audit warp` will error: there is no
> agreed-upon mapping from the word "warp" to a single GitHub repo.
> If a user asks you to audit something by name, **first resolve the
> canonical `github.com//` URL** (ask the user, or search
> github.com), then invoke `commitshow audit `. The CLI does
> a HEAD pre-flight against `github.com//` before any audit
> spend, so a hallucinated slug is rejected with a `not_found` error
> before we burn Claude credits โ but you should still get the URL right
> on the first try by asking, not guessing.
## The AI-coding loop
`commitshow audit` in local mode writes to `.commitshow/audit.md` **and**
`.commitshow/audit.json` after every run. Point your coding agent at them
and it picks up exactly what the audit flagged, with no prompt engineering:
```
You are pairing on . Read .commitshow/audit.md before each turn.
Pick the top concern and propose a minimal change; I'll run
`commitshow audit` again to check the delta.
```
## For agents: `--json`
`commitshow` is built on a simple idea โ **CLI + stable JSON is the universal
contract** between agent ecosystems. No SDK, no MCP server, no vendor lock.
Any agent that can shell out to a subprocess can use commit.show.
```bash
# Human
commitshow audit github.com/owner/repo
# Agent
commitshow audit github.com/owner/repo --json | jq '.concerns[].bullet'
```
### Example agent workflow
> "Check my commit.show score and fix anything under 80."
```
score=$(commitshow audit --json | jq '.score.total')
if [ "$score" -lt 80 ]; then
commitshow audit --json | jq -r '.concerns[0].bullet'
# โ agent reads this concern, picks a fix, applies edits, re-audits
fi
```
### Auditing someone else's project (agent recipe)
When a user says "audit warp" or "what does commit.show say about Postiz",
**don't guess the slug.** Walk this loop:
```
1. Ask the user (or search github.com) for the canonical
`github.com//` URL. Don't invent one โ repo names are
ambiguous and a single wrong guess wastes an audit call.
2. Run:
commitshow audit --json
3. If stdout starts with `{"error":"not_found"`, the URL was wrong.
Re-confirm with the user before retrying.
4. Otherwise parse `score.total`, `score.band`, `concerns[]` and
answer the user with those exact numbers โ don't paraphrase the
score.
```
The CLI HEAD-checks `github.com//` before any audit spend,
so a hallucinated slug fails fast with a clear `not_found` envelope.
The friendly error in the message body explicitly tells you to ask the
user instead of guessing again.
### JSON shape (v1 schema)
Stable by contract โ additive fields don't bump `schema_version`; breaking
changes do. Known keys: `project`, `score`, `standing`, `strengths`, `concerns`,
`snapshot`. See `commitshow audit --json` output for the canonical example.
### Works with
- **Claude Code**, **Cursor**, **Windsurf** โ any agent with shell access
- **GitHub Actions** โ gate PRs on score band or axis scores
- **n8n / Zapier** โ trigger workflows when scores move
- **AutoGPT / crewAI / LangChain** โ subprocess tool node
- **Your own script** โ 10 lines of bash + jq is the whole integration
## What's in the report
Top-to-bottom, what each section gives you:
- **COMMIT.SHOW masthead** ยท ANSI Shadow wordmark on terminals โฅ 100 cols. The thin rounded `โญ โป commit.show โ Audit report โฎ` strip is always rendered as the title fallback.
- **Findings counter** ยท `Findings ยท 1 critical ยท 1 warning ยท 3 strengths` โ scan one line, you know the tone before reading the bullets.
- **What this build missed** ยท errors-first box. First concern is `โ` scarlet (highest-impact), the rest are `โ ` gold. Engine ranks them by decision-impact, not by severity tier.
- **What it got right** ยท `โ` teal ยท 3 bullets ยท for context only. Don't lead with these.
- **AI Coder 7 Frames** ยท the deterministic pillar โ RLS coverage, secret-in-bundle, API rate limiting, prompt-injection surface, DB indexes, mock data in prod, error tracking. Pass / warn / fail per frame, with file paths.
- **ฮ since last audit** ยท positive = improving ยท negative = regressed ยท null on first run.
- **`next:` hint** ยท one-line nudge to feed `--json | jq .concerns` into your coding agent.
- **Trophy block** ยท score billboard (metallic-gold gradient ยท ANSI Shadow digits) with the repo slug embedded so a screenshot crop is self-contained. Axis bars (Audit / Scout / Community) sit directly under it as the per-pillar breakdown. `commit.show` wordmark anchors the bottom-right.
Walk-on auditions cap the `Audit` axis at `45/50` and lock `Scout` / `Community` behind the audition gate; the captions explicitly call this out.
## Roadmap
- `0.1` โ โ read-only audit ยท status ยท `--json` ยท target auto-detect ยท sidecar files
- `0.3` โ โ device-flow login ยท `--source` telemetry ยท User-Agent self-report ยท MCP server (`commitshow-mcp`)
- `0.4` โ `commitshow submit` ยท `--watch` mode ยท CI exit-code gate ยท refresh-token flow
- `0.5` โ `commitshow install ` with {{VARIABLE}} substitution
## Links
- Home โ
- Source โ
- Issues โ
- The platform repo โ
---
Built one repo at a time. commit.show
MIT ยฉ 2026 commit.show