What tools we use, what we built ourselves, and why. Open by design.
Last updated: 2026-05-25
Present, score, trend — don't reimplement. We delegate to the best-in-class tool for each job. Our value is the unified view: one command, one score, one report across everything. When the dedicated tool isn't installed, we fall back to built-in heuristics so you always get a result.
| Category | Chosen Tool | Fallback | Why This One |
|---|---|---|---|
| Linting | biome or eslint | — | Auto-detected from project config. Biome is fastest; ESLint has 4000+ plugins. We run whichever you have. |
| Type Checking | tsc | — | The only real TypeScript type checker. No alternative exists. |
| Test Execution | vitest or jest | — | Auto-detected. We run your test runner with JSON reporter + coverage. |
| Secret Detection | gitleaks | built-in (14 regex) | 26K GitHub stars, MIT, 800+ patterns, scans git history. Fastest for pre-commit. |
| Duplication | jscpd CLI | built-in (@jscpd/core) | Token-based (Rabin-Karp), maximal clones. The built-in fallback runs jscpd's own @jscpd/core engine over our lightweight tokenizer — same algorithm, ~100 KB instead of the full 2.5 MB language-grammar tokenizer. The opt-in CLI adds 223-format tokenizing + HTML reports. |
| Dep Vulnerabilities | npm audit | — | Zero install, built into every Node.js. For deeper coverage, install Snyk or Socket. |
| React Hooks | eslint-plugin-react-hooks | built-in (regex) | Authoritative (maintained by React team), AST-based, catches all hook violations. |
| Accessibility | eslint-plugin-jsx-a11y | built-in (regex) | Static a11y checking at lint-time. For runtime testing, add axe-core. |
| Security (SAST) | eslint-plugin-security | built-in (36 CWE patterns) | When installed, adds ReDoS, timing attacks, non-literal fs/require. Built-in covers OWASP Top 10: XSS, injection, CORS, credential storage, cookies, redirects. Semgrep/CodeQL for deeper analysis. |
| Architecture | VibeCode QA (unique) | — | Import graph + 6 interactive diagrams. No other tool does this for JS/TS at zero-config. |
| AI Readiness | VibeCode QA (unique) | — | Token density, naming confusion, context sink analysis. Nobody else measures this. |
| Dead Code | knip | — | 30K+ stars, used by Vercel. Finds unused files, exports, and dependencies. Auto-detected if installed. |
| Dart/Flutter | dart analyze | — | Official Dart static analyzer. Detects type errors, lint rules, and deprecated API usage. |
| Complexity | VibeCode QA | — | Per-function cognitive complexity + line count. Complements biome's file-level check. |
| License Compliance | VibeCode QA | — | Scans node_modules for copyleft licenses (GPL, AGPL, SSPL). Flags unknown licenses. license-checker for deeper audit. |
| Coverage Ingestion | VibeCode QA | — | Reads existing coverage-summary.json or lcov.info. Works with --skip-tests. |
npx @vibecodeqa/cli should work instantly. We recommend Semgrep as a "go deeper" tool for security-critical projects.Import graph construction, circular dependency detection, god module identification, fan-in/fan-out metrics, package stability (Martin), and 6 interactive SVG diagrams. No existing tool provides this at zero-config for JS/TS monorepos.
Confusion Index: Levenshtein filename similarity, synonym detection, export collisions, generic variable names. Measures how likely an LLM is to edit the wrong file or call the wrong function.
Context Density: Token count per file, import depth, circular dependency impact on context windows. Measures how expensive each file is for an AI to understand.
Auto-detects pnpm/npm/yarn/bun/lerna/melos workspaces, Turborepo, Nx. Handles YAML with comments, flow-style syntax, and negation patterns. Shows the repo structure on the overview page BEFORE assessing it. All checks are workspace-aware — they scan packages/*/src/, not just root src/. Framework detection aggregates deps from all workspace packages.
Visual SVG diagram showing every module as a box — green (✓ tested) or red (✗ untested) — grouped by directory with a coverage percentage bar. Shows at a glance where test coverage gaps are.
34 checks (25 core + 9 Pro) weighted to 100 points. Composite = Σ(check × weight) / Σ(weight). Skipped checks excluded. All scoring proportional to codebase size — no absolute-count cliffs. Best-practices uses severity-weighted penalties (error=15, warning=8, info=2) so missing nice-to-haves don't tank your score. A single 0-100 score with grade (A-F) that trends over time.
Config file: .vcqa.json to disable checks, ignore paths, set per-check exclusions, and configure thresholds.
PR comments: --pr-comment posts score, trend, and top issues as a GitHub PR comment (upsert, no duplicates).
Diff mode: --diff main filters issues to only changed files — see what your PR introduced.
Output modes: --markdown, --annotations (GitHub Actions inline), --sarif, --json, --badge.
Badge API: <img src="api.vibecodeqa.online/badge/org/repo.svg"> — embeddable anywhere.
Integration API: GET /api/v1/repos/:owner/:repo/latest and POST /api/v1/scan for platform integrations.
Research into what existing tools miss — the gaps that informed our roadmap.
| Gap | Status | How |
|---|---|---|
| Dead code / unused exports | Delegated | Knip integration (30K+ stars, used by Vercel). Auto-detected, reports unused files, exports, deps. |
| AI-generated code slop | Unique | Our confusion + context checks catch AI-generated naming ambiguity, unnecessary complexity, and over-imported deps. |
| Architecture drift | Unique | 6 interactive diagrams + stability metrics. Trend over time shows when architecture degrades. |
| Naming consistency | Unique | Levenshtein filename similarity, synonym detection, export collision analysis across the codebase. |
| Documentation coherence | Planned (Pro) | LLM-powered comparison of README/JSDoc vs actual code behavior. Detects docs that lie. |
| API boundary health | Planned (Pro) | Track exported interface changes between versions. Detect breaking changes in monorepo packages. |
| Cross-service dependency detection | Planned | In monorepos, detect breaking changes between packages before they ship. |
| Vue/Svelte SFC analysis | Implemented | Script extraction for logic checks, template scanning for a11y + security (v-html, {@html} XSS). |
| Security headers (Helmet) | Implemented | Checks for Helmet.js or manual security headers. Warning for Express/Fastify/Hono without X-Content-Type-Options, HSTS, X-Frame-Options. |
| Input validation | Implemented | Checks for Zod, Joi, Yup, Valibot, class-validator, ajv. Warning for API projects with no validation library. |
| Production readiness | Implemented | Health endpoints (/health, /healthz), graceful shutdown (SIGTERM handler), start script, error tracking (Sentry/Bugsnag). |
| Error info leakage | Implemented | Detects res.json({ error: err.stack }) — sending internal error details to clients. OWASP Error Handling. |
| CORS misconfiguration | Implemented | Permissive Access-Control-Allow-Origin: "*". OWASP CORS Testing. |
| GitHub Actions security | Implemented | 10 checks: pwn requests (pull_request_target + checkout), script injection (untrusted input in run: blocks), write-all permissions, secrets in global env, unpinned actions, self-hosted without containers. Ref: GitHub Security Blog. |
We reviewed every major security checklist (OWASP Top 10, OWASP Node.js Cheat Sheet, Security Journey Checklist, Node.js Security Best Practices) and chose not to add these checks. Here's why:
console.log in the standards check. But whether a project uses structured logging (pino, winston) vs console is a preference, not a security issue. Many Cloudflare Workers and edge functions use console.log because the platform captures it as structured logs automatically. Flagging "no pino installed" would be a false positive for serverless projects. Recommendation: Use pino for Node.js servers that need log aggregation.jwt.sign() includes expiresIn seems simple, but many projects set expiry in a config file, environment variable, or wrapper function — not at the call site. Flagging every jwt.sign() without seeing the full config would produce false positives. Similarly, algorithm choice (RS256 vs HS256) depends on the auth architecture. Recommendation: Use Auth.js or jose which enforce secure defaults.| What | Tool | Install |
|---|---|---|
| Lint + Format | biome | pnpm add -D @biomejs/biome |
| Type Check | tsc | (included with typescript) |
| Tests | vitest | pnpm add -D vitest |
| React Hooks | eslint-plugin-react-hooks | pnpm add -D eslint eslint-plugin-react-hooks |
| Accessibility | eslint-plugin-jsx-a11y | pnpm add -D eslint-plugin-jsx-a11y |
| Secrets | gitleaks | brew install gitleaks |
| Dead Code | knip | pnpm add -D knip |
| Duplication | jscpd | pnpm add -D jscpd |
| E2E | Playwright | pnpm add -D @playwright/test |
| Security SAST | eslint-plugin-security | pnpm add -D eslint-plugin-security |
| Security Headers | helmet | pnpm add helmet |
| Input Validation | zod | pnpm add zod |
| What | Tool | Install |
|---|---|---|
| Lint + Format | biome | pnpm add -D @biomejs/biome |
| Vue Lint | eslint-plugin-vue | pnpm add -D eslint eslint-plugin-vue |
| Type Check | vue-tsc | pnpm add -D vue-tsc |
| Tests | vitest | pnpm add -D vitest @vue/test-utils |
| Secrets | gitleaks | brew install gitleaks |
| Dead Code | knip | pnpm add -D knip |
| What | Tool | Install |
|---|---|---|
| Lint + Format | biome | pnpm add -D @biomejs/biome |
| Type Check | tsc | (included with typescript) |
| Tests | vitest | pnpm add -D vitest |
| Security | semgrep (CI) | pip install semgrep or Docker |
| Secrets | gitleaks | brew install gitleaks |
| Deps | socket + npm audit | pnpm add -D socket |
| Security SAST | eslint-plugin-security | pnpm add -D eslint-plugin-security |
| Security Headers | helmet | pnpm add helmet |
| Input Validation | zod | pnpm add zod |
| What | Tool | Install |
|---|---|---|
| Lint | dart analyze | (included with Dart SDK) |
| Format | dart format | (included with Dart SDK) |
| Tests | flutter_test / dart test | (included) |
| Secrets | gitleaks | brew install gitleaks |
| Deps | dart pub outdated | (included) |
Gives AI coding agents (Claude Code, Cursor, Codex) real-time code health context. CodeScene's research shows AI fixes 90-100% of code health issues when given health data via MCP, vs only 20% without.
Setup: claude mcp add vcqa -- npx @vibecodeqa/mcp
Tools: vcqa_score, vcqa_scan, vcqa_file_health, vcqa_check, vcqa_explain
Install the dedicated tools above. VibeCode QA auto-detects them and uses their output instead of built-in heuristics. More tools installed = more accurate results = higher confidence in your score.
npx @vibecodeqa/cli --top — shows your top issues with which tool found them.