Complete guide to what VibeCode QA checks, which tools it uses, and what metrics matter for TypeScript + React projects.
npx @vibecodeqa/cli
npx @vibecodeqa/cli init # creates .github/workflows/vibecodeqa.yml npx @vibecodeqa/cli fix # auto-fix lint issues + show fix suggestions
Auto-detects: TypeScript, React, Vite/webpack, vitest/jest, Biome/ESLint, pnpm/npm/yarn.
| Check | What | Tool | Metric |
|---|---|---|---|
| Structure | package.json, tsconfig, LICENSE, lockfile, src/ dir, test ratio | built-in | missing files count |
| Lint | Runs your linter with JSON output | biome or eslint | errors + warnings |
| Type Check | Runs tsc --noEmit | tsc | type errors |
| Type Safety | as any, : any, @ts-ignore, @ts-nocheck, !. | built-in | unsafe patterns per KLOC |
| Standards | File naming, file size, code smells (console.log, var, ==) | built-in | violations per file |
| Check | What | Tool | Metric |
|---|---|---|---|
| Complexity | Cognitive complexity per function, line count | built-in | % functions over threshold |
| Duplication | Copy-pasted blocks (6+ lines) | jscpd or built-in | duplication % |
| Error Handling | Empty catch, throw string, floating promises, unsafe JSON.parse | built-in | issues per file |
| React Patterns | Conditional hooks, missing keys, index keys, prop spreading, useEffect deps | eslint-plugin-react-hooks or built-in | violations per component |
| Accessibility | img alt, click on div, form labels, autoFocus, tabIndex, html lang | eslint-plugin-jsx-a11y or built-in | violations per component |
| Docs | README quality, JSDoc coverage, CHANGELOG presence | built-in | % exports documented |
| Best Practices | CI/CD, OIDC, supply chain, repo hygiene, pre-commit hooks | built-in | practices followed % |
| Check | What | Tool | Metric |
|---|---|---|---|
| Testing | Pyramid (unit/integration/component/E2E), execution, coverage, pairing, quality | vitest or jest | 6 sub-dimensions |
Test pyramid layers detected: Unit tests (any .test.ts), Component tests (@testing-library), Integration tests (real API calls), E2E (Playwright/Cypress).
| Check | What | Tool | Metric |
|---|---|---|---|
| Secrets | Hardcoded API keys, tokens, private keys, .env audit | gitleaks or built-in (14 patterns) | secrets found |
| Security | 36 CWE patterns: XSS, injection, crypto, SSRF, localStorage, prototype pollution | built-in | CWE violations |
| Dependencies | npm audit + outdated packages | npm audit | critical/high vulns |
| Check | What | Tool | Metric |
|---|---|---|---|
| Architecture | Import graph, circular deps, god modules, orphans, fan-out | built-in (unique) | structural issues |
| Performance | Barrel imports, heavy deps, dynamic import opportunities, CSS-in-JS | built-in | optimization opportunities |
6 interactive diagrams: Dependency graph (click to highlight), DSM matrix (hover rows), Sequence diagram, Layer diagram, Package diagram, Container diagram.
| Check | What | Tool | Metric |
|---|---|---|---|
| Confusion | Filename similarity (Levenshtein), synonym pairs, generic names, export collisions | built-in (unique) | confusion index |
| Context | Token density per file, import depth, circular dep impact on LLM context | built-in (unique) | files over 4K tokens |
Install these for maximum accuracy. VibeCode QA auto-detects and delegates to them.
# Core (probably already have these) pnpm add -D typescript @biomejs/biome vitest # React-specific (enables AST-level checking) pnpm add -D eslint eslint-plugin-react-hooks eslint-plugin-jsx-a11y # Security (optional, boosts secret detection) brew install gitleaks # E2E (optional, detected for test pyramid) pnpm add -D @playwright/test
VibeCode QA auto-detects pnpm-workspace.yaml, npm/yarn workspaces, Turborepo, Nx, and Lerna. When detected:
packages/*/src/, not just root src/All scoring is proportional to codebase size. No absolute-count cliffs.
Grade: A (90+), B (75+), C (60+), D (40+), F (<40). Premium AI Analysis checks (doc-coherence, code-coherence) have 0% weight.