CODYGIENE

First Scan

This guide walks through running your first CODYGIENE scan.

cd my-project

CODYGIENE scans the current directory by default. You can also specify a path:

codygiene scan ./src

Run the scan

codygiene scan

No configuration is required. CODYGIENE will:

  1. Discover all supported files in the project
  2. Detect frameworks (Next.js, Supabase, Prisma, Drizzle, etc.)
  3. Analyze each eligible file
  4. Run all applicable rules (64 enabled by default out of 70 registered)
  5. Compute scores
  6. Print a prioritized report

What files are analyzed?

CODYGIENE analyzes these file types:

  • .js .jsx .mjs .cjs · JavaScript
  • .ts .tsx · TypeScript
  • .sql · SQL migrations

Files in these directories are excluded by default:

  • node_modules
  • dist build .next out coverage
  • .git
  • Generated and vendored code (generated/, generated-*/, vendor/, third_party/, .yarn/, files with generator banners, etc.)
  • Test files (*.test.*, *.spec.*, __tests__/, __fixtures__/, fixtures/)

Only those exact test patterns are excluded. Other test-adjacent code · e2e/ directories, mocks/ directories, seed files, scripts · is analyzed and can produce findings.

Excluded generated/vendored files are counted in coverage as generatedExcludedFiles. Pass --include-generated to analyze them.

Understanding coverage

The output includes an Analysis Coverage section:

Analysis Coverage
  Files discovered:  452
  Files eligible:   360
  Files analyzed:   360
  SQL files:         26
  Files skipped:     0
  Coverage:          100%
  Status:            COMPLETE
  • COMPLETE · all eligible files were analyzed. Scores are representative.
  • PARTIAL · some files were skipped. Scores may not represent the full repository. A prominent warning appears before the scores.

If you used --max-files, the scan is intentionally partial. Without --max-files, CODYGIENE analyzes all eligible files by default.

Understanding scores

Score
  Overall: 20
  security       10  (96 findings)
  performance    61   (29 findings)
  code-health    10   (483 findings)
  ai-quality     45   (36 findings)

Scores range from 0 to 100. Higher is better. A PARTIAL scan displays a warning that scores may not be representative.

See Scoring for details on how scores are computed.

Understanding findings

Findings are grouped by priority:

  1. Priority findings · Critical/High Security, High Performance
  2. Medium Security & AI Safeguard Divergence
  3. Medium Performance & Structural Code Health
  4. Low-priority Code Health · clustered by rule, not listed individually

Each finding shows:

  • Severity (CRITICAL, HIGH, MEDIUM, LOW)
  • Confidence and tier
  • Rule ID
  • Title
  • File and line number
  • Description
  • Impact
  • Recommendation
  • Fixability

Low-priority findings are clustered by rule to avoid flooding the terminal. Use --format json to see all findings individually.

Export a report

codygiene scan --format json -o report.json
codygiene scan --format sarif -o report.sarif
codygiene scan --format markdown -o report.md

Machine-readable reports contain ALL findings, not just the prioritized subset shown in the terminal.

Next steps