CodeMore

The static analyzer your AI agent reads.

AI agents ship code fast — and ship bugs fast. CodeMore scans the code, then hands the agent that wrote it a machine-readable report with the exact fix and the criteria to verify it. The agent closes its own findings.

Website · Docs · Rule Catalog · Report Schema · Changelog

Terminal

Copy

npx codemore@latest scan .

64 native rules · 8 external adapters · CLI · MCP server · VS Code extension · GitHub Action — one report, byte-identical on every surface.

Table of contents

• Why CodeMore
• Quick start — CLI · MCP server · VS Code · GitHub Action · Hosted
• What it catches
• The report is the product
• Agentic fix loop
• Accuracy, measured honestly
• What CodeMore does not catch
• Architecture
• Development · Contributing · License

Why CodeMore

AI-assisted coding ships vulnerabilities at a measured, growing rate:

Existing scanners (SonarQube, DeepSource, Snyk) target human reviewers sitting at dashboards. But this code wasn't written by a human — and the LLM that wrote it is fully capable of fixing its own bug, if the report is shaped for a machine reader.

That's the wedge. CodeMore is not another SAST dashboard. It's the report contract between a scanner and a coding agent: every finding carries a suggestedFix with a patch template and explicit verificationCriteria — not just "here's a problem," but "here's exactly how to know you fixed it."

The agent that wrote the bug can also write the fix — if it can read the report.

Quick start

CLI

npx codemore@latest scan .

Prints a summary to the terminal. Add --json for the full report on stdout, or --out codemore-report.json to write it to disk: every finding pinned to file:line:column with rule citation, fix template, and verification criteria. Pipe it to your agent and watch findings close.

npm install -g codemore                        # once — or prefix each command below with `npx codemore@latest`
codemore update                                # global install pinned an old version? this pulls latest
codemore scan . --fail-on BLOCKER              # CI gate: non-zero exit on any BLOCKER
codemore scan . --external-tools ruff,biome    # opt in to external tools
codemore scan . --external-tools all           # ruff · golangci-lint · clippy · biome · bandit · gitleaks · npm-audit · pip-audit
codemore scan . --format sarif --out codemore.sarif   # GitHub code scanning (upload-sarif)
codemore fix . --rule <id> --write             # agentic fix loop from the CLI (needs an LLM API key)
codemore baseline create                       # adopt on an existing repo without drowning in legacy findings

MCP server — Cursor, Claude Code, Codex, Claude Desktop

npx codemore mcp                              # print config snippet + every client's config path
npx codemore mcp install --client cursor      # merge into existing config (backs up first, --dry-run supported)

{
  "mcpServers": {
    "codemore": {
      "command": "npx",
      "args": ["-y", "codemore@latest", "serve-mcp"]
    }
  }
}

Six tools exposed: scan_project · scan_file · explain_issue · suggest_fix · apply_fix · validate_fix.

Per-client setup, exact config paths, and verified handshake evidence (Claude Code, Cursor, Claude Desktop, Codex CLI): docs/ide-matrix.md.

VS Code extension

Install CodeMore from the VS Code Marketplace (Extensions → search "CodeMore" → Install), or build the VSIX yourself:

npm run vsce:package                             # builds codemore-<version>.vsix
code --install-extension codemore-<version>.vsix

Inline diagnostics; code-action quick-fix invokes the agentic loop (plan → generate → validate → retry, max 3 attempts).

GitHub Action

# .github/workflows/codemore.yml
on:
  pull_request:
    branches: [main]
jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@v4
      - uses: abhinavteja123/codemore@v1
        with:
          fail-on: BLOCKER

PR-comment bot; only fails the build on findings new since the committed .codemore-baseline.json. A full copy-paste security gate chaining CodeMore + Ruff + Biome + Bandit + Gitleaks + npm-audit + pip-audit + Checkov lives at templates/.github/workflows/codemore-security-gate.yml (walkthrough).

Web Scanner (hosted)

Sign in at codemore.tech, paste a public GitHub URL or upload a ZIP — same report, same fingerprint, zero install.

What it catches

64 native rules across 6 packs, every rule mapped to a cited real-world incident class — not a hypothetical:

8 external adapters (off by default, opt in via --external-tools): ruff · golangci-lint · clippy · biome · bandit · gitleaks · npm-audit · pip-audit. Findings are namespaced ext:<tool>:<rule-id> — no collision with native rules; a missing binary skips silently instead of crashing.

The walker catches what .gitignore hides. When a developer "hides" a leaked secret file by gitignoring it, most scanners stop seeing it — but it's still on disk, in tarballs, in Docker images. CodeMore always scans secret-shaped filenames (.env*, *.pem, *.key, firebase-adminsdk*.json, credentials.json, .npmrc, .pypirc, …) even when gitignored. This is exactly how the audits found real production OpenAI keys, Google API keys, and Firebase admin SDK creds that other tools silently missed. Opt out with --respect-gitignore-fully.

Per-rule documentation: docs/rules — 64 pages, one per rule.

The report is the product

Every surface emits the same schema-stable codemore-report.json — verified byte-identical (modulo timestamps and instance IDs) on every release by test/parity.test.ts:

CLI    : issues=224  BLOCKER=5  fingerprint=sha256:7f95f2c62e0d3ecea6f23…
MCP    : issues=224  BLOCKER=5  fingerprint=sha256:7f95f2c62e0d3ecea6f23…
Daemon : issues=224  BLOCKER=5  fingerprint=sha256:7f95f2c62e0d3ecea6f23…

One brain, four skins. The schema is the API; surfaces are interchangeable.