Audit

Score any public GitHub repo 0-100 against the commit.show audit rubric.

Version Control
1stars
No ratings
UpdatedOct 17, 2026

InstallRepository Website

Install Audit

Pick your client, then add it in one click or paste the config.

STDIONode.js

~/Library/Application Support/Claude/claude_desktop_config.json

claude_desktop_config.json

{
  "mcpServers": {
    "audit-5": {
      "command": "npx",
      "args": [
        "-y",
        "commitshow@latest"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

We couldn’t confirm it starts correctly

We ran the install command but it didn't respond within our test window — this can mean a slow first-time install rather than a real problem.

npx -y commitshow@latest

Process exited before answering initialize.

This is an experimental automated check and can have false negatives — missing environment variables, a slow cold install, etc. It doesn’t necessarily mean something’s wrong. Last checked 6d ago.

Overview

Node.js

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 1d ago

Recent health check succeeded.

8/8 checks healthy over the last 46d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 5d ago via OSV.dev · commitshow@latest (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars1Stargazers on the source repository.

npm downloads133Package downloads in the last 30 days.

Last commit1mo agoMost recent push to the default branch.

Install checkInconclusiveDidn't respond in our test window — often a slow first install.

Directory activity2 viewsConfig copies, upvotes, and views on AllMCPs.

From the project README

commit.show CLI

Audit any vibe-coded project from your terminal.
Score · 3-axis breakdown · 3 strengths + 2 concerns · rank · delta — in one command.

Terminal

npx commitshow@latest audit github.com/owner/repo

Code

   ██████╗  ██████╗  ███╗   ███╗ ███╗   ███╗ ██╗ ████████╗     ███████╗ ██╗  ██╗  ██████╗  ██╗    ██╗
  ██╔════╝ ██╔═══██╗ ████╗ ████║ ████╗ ████║ ██║ ╚══██╔══╝     ██╔════╝ ██║  ██║ ██╔═══██╗ ██║    ██║
  ██║      ██║   ██║ ██╔████╔██║ ██╔████╔██║ ██║    ██║        ███████╗ ███████║ ██║   ██║ ██║ █╗ ██║
  ██║      ██║   ██║ ██║╚██╔╝██║ ██║╚██╔╝██║ ██║    ██║        ╚════██║ ██╔══██║ ██║   ██║ ██║███╗██║
  ╚██████╗ ╚██████╔╝ ██║ ╚═╝ ██║ ██║ ╚═╝ ██║ ██║    ██║    ██╗ ███████║ ██║  ██║ ╚██████╔╝ ╚███╔███╔╝
   ╚═════╝  ╚═════╝  ╚═╝     ╚═╝ ╚═╝     ╚═╝ ╚═╝    ╚═╝    ╚═╝ ╚══════╝ ╚═╝  ╚═╝  ╚═════╝   ╚══╝╚══╝

╭────────────────────────────────────────────────────────╮
│ ✻ commit.show — Audit report                           │
╰────────────────────────────────────────────────────────╯

  commitshow   github.com/commitshow/commitshow

  Findings  · 1 critical · 1 warning · 3 strengths

  ┌────────────────────────────────────────────────────────┐
  │ What this build missed                                 │
  │ ✕ 25 FK columns unindexed — fk_columns_seen=100 vs in… │
  │ ⚠ Zero observability libs in 17 deps — no Sentry, Pin… │
  │                                                        │
  │ What it got right                                      │
  │ ↑ 56 RLS policies cover all 19 tables — gap_estimate=… │
  │ ↑ Lighthouse accessibility 93, best practices 96, SEO… │
  │ ↑ Rate-limit middleware active on API routes — vibe_c… │
  └────────────────────────────────────────────────────────┘

  ┌────────────────────────────────────────────────────────┐
  │ AI Coder 7 Frames · what AI ships without              │
  │                                                        │
  │ ✕ Error tracking                                       │
  │   no error-tracking dependency or config declared…    │
  │ ⚠ Database indexes                                     │
  │   100 FK columns · 75 indexes · 25 unindexed           │
  │   → supabase/schema.sql · id → auth                    │
  │ ✓ RLS coverage                                         │
  │   19 tables · 56 policies · all covered                │
  │ ✓ Secret in client code                                │
  │   no service-role keys in client paths                 │
  │ ✓ API rate limiting                                    │
  │   custom middleware detected                           │
  └────────────────────────────────────────────────────────┘

  Δ        +20           since last audit

  → https://commit.show/projects/1c262df3-…

  next  · feed your AI loop  → commitshow audit . --json

                ╔════════════════════════════╗
                ║   commitshow/commitshow    ║
                ║                            ║
                ║     ███████╗  ███████╗     ║
                ║     ╚════██║  ╚════██║     ║
                ║         ██╔╝      ██╔╝     ║
                ║        ██╔╝      ██╔╝      ║
                ║        ██║       ██║       ║
                ║        ╚═╝       ╚═╝       ║
                ║                            ║
                ║  / 100 · walk-on · strong  ║
                ╚════════════════════════════╝
       audition unlocks final 5 · max walk-on score 95

    Audit  35/50    ▰▰▰▰▰▰▰▰▰▰▰▰▰▰▱▱▱▱▱▱
    Scout  —/30     ─ audition unlocks ─
    Comm.  —/20     ─ audition unlocks ─

                                               commit.show

⭐ Star us on GitHub if commitshow audit saved you a // TODO.

Why

Vibe-coded projects ship fast and break differently. The CLI gives you a zero-config, walk-on lane to commit.show's audit engine — the same Claude-grade analysis used in our 3-week leagues, minus the signup, fee, and league commitment. You get a snapshot of where the build sits, what's strong, what's wobbling, and how it ranks against everyone else this week.

Local runs also drop .commitshow/audit.md and .commitshow/audit.json into your repo, so your AI coding agent can read the report on the next turn without a prompt-engineering ritual.

When a project is ready for the full season — Scout forecasts, season ranking, Backstage prompt extraction, Hall of Fame — it auditions at commit.show/submit.

The npm package + command is commitshow (no dot — npm doesn't allow it in package names). Everywhere else uses the brand commit.show.

Install

bash

# one-shot (recommended for trying it on someone else's repo)
npx commitshow@latest audit <target>

# or global, if you'll run it daily
npm i -g commitshow
commitshow audit <target>

Requires Node 20+.

Usage

Command	What it does
`commitshow audit [target] [--json] [--refresh] [--source=<tag>]`	Fetch + render the latest audit, write `.commitshow/audit.{md,json}`
`commitshow status [target]`	Same render as `audit`, no re-run
`commitshow login [--no-open] [--token <jwt>]`	Device-flow sign-in via browser approval
`commitshow whoami [--logout]`	Print the linked account · `--logout` clears the saved token
`commitshow submit [target]`	Audition a project (coming soon · needs login)
`commitshow install <pack>`	Install a Library artifact (coming soon)

Sign in for higher rate limits

Terminal

npx commitshow@latest login

Opens commit.show/cli/link?code=<6-hex> in your browser. After you click Authorize there, the CLI receives a 90-day JWT and saves it to ~/.commitshow/config.json (file mode 0600). Subsequent calls send the token in the Authorization header automatically.

What changes once signed in:

Per-IP rate cap goes from 20 audits/day to 50/day
Newly audited preview projects auto-claim ownership (visible at commit.show/me → MY AUDITS)
commitshow whoami prints your member id + email

Headless / CI? Use --token <jwt> to skip the browser handshake.

Telemetry source flag

--source=<tag> lets you self-report how the call originated:

Terminal

npx commitshow audit . --source=claude-code
COMMITSHOW_SOURCE=cursor npx commitshow audit .

Common tags: claude-code · cursor · gemini-cli · codex · antigravity · production-audit-skill · any 64-char string. Drops into the maintainer's admin breakdown so we can see which agent ecosystems are driving installs. Skip the flag to stay anonymous.

Target forms

audit and status accept a positional target that auto-detects:

Form	Example
cwd (omitted)	`commitshow audit` · infers from `git remote get-url origin`
Local path	`commitshow audit ./my-repo`
Remote URL	`commitshow audit github.com/owner/repo` · `commitshow audit https://github.com/owner/repo`
SSH remote	`commitshow audit git@github.com:owner/repo.git` (auto-converted)
Shorthand	`commitshow audit owner/repo`

Remote-URL mode works from any directory, which makes one-line X posts (npx commitshow@latest audit <their-url>) trivial.

AI agents — read this before invoking. The CLI does not look up projects by name. commitshow audit warp will error: there is no agreed-upon mapping from the word "warp" to a single GitHub repo. If a user asks you to audit something by name, first resolve the canonical github.com/<owner>/<repo> URL (ask the user, or search github.com), then invoke commitshow audit <that-url>. The CLI does a HEAD pre-flight against github.com/<owner>/<repo> before any audit spend, so a hallucinated slug is rejected with a not_found error before we burn Claude credits — but you should still get the URL right on the first try by asking, not guessing.

The AI-coding loop

commitshow audit in local mode writes to .commitshow/audit.md and .commitshow/audit.json after every run. Point your coding agent at them and it picks up exactly what the audit flagged, with no prompt engineering:

Code

You are pairing on <repo>. Read .commitshow/audit.md before each turn.
Pick the top concern and propose a minimal change; I'll run
`commitshow audit` again to check the delta.

For agents: `--json`

commitshow is built on a simple idea — CLI + stable JSON is the universal contract between agent ecosystems. No SDK, no MCP server, no vendor lock. Any agent that can shell out to a subprocess can use commit.show.

bash

# Human
commitshow audit github.com/owner/repo

# Agent
commitshow audit github.com/owner/repo --json | jq '.concerns[].bullet'

Example agent workflow

"Check my commit.show score and fix anything under 80."

Code

score=$(commitshow audit --json | jq '.score.total')
if [ "$score" -lt 80 ]; then
  commitshow audit --json | jq -r '.concerns[0].bullet'
  # → agent reads this concern, picks a fix, applies edits, re-audits
fi

Auditing someone else's project (agent recipe)

When a user says "audit warp" or "what does commit.show say about Postiz", don't guess the slug. Walk this loop:

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Audit

audit is an MCP server that scores any public GitHub repository from 0 to 100 against the commit.show audit rubric. It returns a three-axis breakdown, three strengths, two concerns, a rank, and the score delta when available. The underlying audit can be run with commit.show against a GitHub repository.

Provide the public GitHub repository to audit for scoring against the commit.show rubric. The equivalent CLI command is `npx commitshow@latest audit github.com/owner/repo`.

The audit score includes a result from 0 to 100, a three-axis breakdown, three strengths, two concerns, rank information, and a delta from the previous audit when available.

This produces JSON output for feeding the audit results into an AI loop.

Related MCP servers

All in Version Control All alternatives

Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:

Live Dynamic SVG Preview

Markdown (GitHub README)

[![AllMCPs](https://allmcps.com/api/badge/audit-5?style=directory)](https://allmcps.com/mcp/audit-5)

HTML Embed

<a href="https://allmcps.com/mcp/audit-5"><img src="https://allmcps.com/api/badge/audit-5?style=directory" alt="Audit on AllMCPs" /></a>

At a glance

Category: Version Control
Transport: STDIO
Runtime: Node.js
Last updated: Oct 17, 2026

GitHub stars1

Last commit1mo ago

npm / month133

40Quality signal: Fair · 40/100How this signal is calculated ▾

Server availabilityNot measured

Not scored for repo-hosted servers — we can't reach the running server, only its GitHub page. Hosted MCP endpoints are health-checked live.

Verified ownership10/20

Documentation & tools15/30

Adoption & activity5/15

Community engagement0/10

A guidance signal from public completeness & health data — not a user rating. New listings start lower and rise as they add docs, get verified, and grow adoption. Signals we can't observe for a listing are skipped, not counted against it.

Own this project?

This listing is pre-filled from public sources. Claim it via your GitHub README, a site badge, or DNS TXT to edit it and earn the Verified badge.

Free dofollow backlink: add your website and place the AllMCPs badge on it — no claim needed. We detect it automatically.

Claim this listing

Install Audit

Supply-chain signal

Adoption & maintenance

From the project README

commit.show CLI

Why

Install

Usage

Sign in for higher rate limits

Telemetry source flag

Target forms

The AI-coding loop

For agents: --json

Example agent workflow

Auditing someone else's project (agent recipe)

Frequently Asked Questions about Audit

What is the audit MCP server?

How do I audit a public GitHub repository?

What does the audit score include?

Can audit analyze a local repository?

AllMCPs Directory Badge

For agents: `--json`