Codemore

CodeMore

The static analyzer your AI agent reads.

AI agents ship code fast — and ship bugs fast. CodeMore scans the code, then hands the agent that wrote it a machine-readable report with the exact fix and the criteria to verify it. The agent closes its own findings.

Website · Docs · Rule Catalog · Report Schema · Changelog

npx codemore@latest scan .

64 native rules · 8 external adapters · CLI · MCP server · VS Code extension · GitHub Action — one report, byte-identical on every surface.

---

Table of contents

• Why CodeMore
• Quick start — CLI · MCP server · VS Code · GitHub Action · Hosted
• What it catches
• The report is the product
• Agentic fix loop
• Accuracy, measured honestly
• What CodeMore does *not* catch
• Architecture
• Development · Contributing · License

---

Why CodeMore

AI-assisted coding ships vulnerabilities at a measured, growing rate:

Existing scanners (SonarQube, DeepSource, Snyk) target human reviewers sitting at dashboards. But this code wasn't written by a human — and the LLM that wrote it is fully capable of fixing its own bug, *if the report is shaped for a machine reader*.

That's the wedge. CodeMore is not another SAST dashboard. It's the report contract between a scanner and a coding agent: every finding carries a suggestedFix with a patch template and explicit verificationCriteria — not just "here's a problem," but "here's exactly how to know you fixed it."

The agent that wrote the bug can also write the fix — if it can read the report.

---

Quick start

CLI

npx codemore@latest scan .

Prints a summary to the terminal. Add --json for the full report on stdout, or --out codemore-report.json to write it to disk: every finding pinned to file:line:column with rule citation, fix template, and verification criteria. Pipe it to your agent and watch findings close.

npm install -g codemore                        # once — or prefix each command below with `npx codemore@latest`

codemore update # global install pinned an old version? this pulls latest codemore scan . --fail-on BLOCKER # CI gate: non-zero exit on any BLOCKER codemore scan . --external-tools ruff,biome # opt in to external tools codemore scan . --external-tools all # ruff · golangci-lint · clippy · biome · bandit · gitleaks · npm-audit · pip-audit codemore scan . --format sarif --out codemore.sarif # GitHub code scanning (upload-sarif) codemore fix . --rule --write # agentic fix loop from the CLI (needs an LLM API key) codemore baseline create # adopt on an existing repo without drowning in legacy findings

MCP server — Cursor, Claude Code, Codex, Claude Desktop

npx codemore mcp                              # print config snippet + every client's config path

npx codemore mcp install --client cursor # merge into existing config (backs up first, --dry-run supported)

Manual config snippet

{

"mcpServers": { "codemore": { "command": "npx", "args": ["-y", "codemore@latest", "serve-mcp"] } } }

Six tools exposed: scan_project · scan_file · explain_issue · suggest_fix · apply_fix · validate_fix.

Per-client setup, exact config paths, and verified handshake evidence (Claude Code, Cursor, Claude Desktop, Codex CLI): docs/ide-matrix.md.

VS Code extension

Install CodeMore from the VS Code Marketplace (Extensions → search "CodeMore" → Install), or build the VSIX yourself:

npm run vsce:package                             # builds codemore-<version>.vsix

code --install-extension codemore- .vsix

Inline diagnostics; code-action quick-fix invokes the agentic loop (plan → generate → validate → retry, max 3 attempts).

GitHub Action

# .github/workflows/codemore.yml

on: pull_request: branches: [main] jobs: scan: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps:

• uses: actions/checkout@v4
• uses: abhinavteja123/codemore@v1 with: fail-on: BLOCKER

PR-comment bot; only fails the build on findings new since the committed .codemore-baseline.json. A full copy-paste security gate chaining CodeMore + Ruff + Biome + Bandit + Gitleaks + npm-audit + pip-audit + Checkov lives at templates/.github/workflows/codemore-security-gate.yml (walkthrough).

Web Scanner (hosted)

Sign in at codemore.tech, paste a public GitHub URL or upload a ZIP — same report, same fingerprint, zero install.

---

What it catches

64 native rules across 6 packs, every rule mapped to a *cited real-world incident class* — not a hypothetical:

8 external adapters (off by default, opt in via --external-tools): ruff · golangci-lint · clippy · biome · bandit · gitleaks · npm-audit · pip-audit. Findings are namespaced ext: : — no collision with native rules; a missing binary skips silently instead of crashing.

The walker catches what `.gitignore` hides. When a developer "hides" a leaked secret file by gitignoring it, most scanners stop seeing it — but it's still on disk, in tarballs, in Docker images. CodeMore always scans secret-shaped filenames (.env*, *.pem, *.key, firebase-adminsdk*.json, credentials.json, .npmrc, .pypirc, …) even when gitignored. This is exactly how the audits found real production OpenAI keys, Google API keys, and Firebase admin SDK creds that other tools silently missed. Opt out with --respect-gitignore-fully.

Per-rule documentation: docs/rules — 64 pages, one per rule.

---

The report is the product

Every surface emits the same schema-stable codemore-report.json — verified byte-identical (modulo timestamps and instance IDs) on every release by test/parity.test.ts:

CLI    : issues=224  BLOCKER=5  fingerprint=sha256:7f95f2c62e0d3ecea6f23…

MCP : issues=224 BLOCKER=5 fingerprint=sha256:7f95f2c62e0d3ecea6f23… Daemon : issues=224 BLOCKER=5 fingerprint=sha256:7f95f2c62e0d3ecea6f23…

One brain, four skins. The schema is the API; surfaces are interchangeable.

Full report example — codemore-report.json v1.0.0

{

"schemaVersion": "1.0.0", "tool": { "name": "codemore", "version": "0.3.0" }, "project": { "root": ".", "framework": "next.js", "language": "typescript", "fingerprint": "sha256:7f95f2c62e0d3ecea6f23…" }, "summary": { "issuesTotal": 42, "bySeverity": { "BLOCKER": 2, "CRITICAL": 5, "MAJOR": 15, "MINOR": 18, "INFO": 2 }, "byCategory": { "security": 12, "bug": 7, "…": "…" }, "filesAnalyzed": 87, "linesOfCode": 12450, "technicalDebtMinutes": 1840 }, "issues": [ { "id": "vibe-supabase-rls-disabled", "ruleVersion": "1.2.0", "instanceId": "01HZ…", "severity": "BLOCKER", "confidence": 0.95, "category": "security", "title": "Supabase table has no RLS policy", "evidence": { "file": "supabase/migrations/001_init.sql", "line": 14, "column": 1, "endLine": 14, "endColumn": 60, "snippet": "create table profiles (id uuid primary key, …);", "matchedPattern": "create-table-without-rls" }, "whyItMatters": "Public Supabase client can read/write all rows. 70 % of Lovable apps leak data through this.", "citation": "https://codemore.tech/rules/vibe-supabase-rls-disabled", "suggestedFix": { "type": "code-patch", "instructions": "Add ALTER TABLE profiles ENABLE ROW LEVEL SECURITY; plus at least one policy scoped to authenticated users.", "patchTemplate": "…", "verificationCriteria": [ "Migration contains ALTER TABLE … ENABLE ROW LEVEL SECURITY", "At least one CREATE POLICY exists for the table", "Re-scan no longer reports vibe-supabase-rls-disabled for this file" ] }, "suppression": { "available": true, "directive": "// codemore-ignore: vibe-supabase-rls-disabled", "scope": "same-line | next-line | file" } } ], "agentInstructions": { "preamble": "You are fixing issues found by CodeMore. Apply patches one issue at a time. After each, request re-scan via validate_fix.", "orderingHint": "blockers → criticals → majors", "doNotTouch": ["node_modules/**", "*.lock", ".env*"], "stopOn": "first-validator-failure" }, "meta": { "rulesEnabled": 64, "packsLoaded":