Skip to content

CodeMetrics v1.0.0 — Production-Ready Code Quality Auditing

Latest
Latest

Choose a tag to compare

View all tags
@KidIkaros KidIkaros released this 03 May 06:07
· 17 commits to master since this release
v1.0.0
1915cc5

CodeMetrics v1.0.0 — Production-Ready Code Quality Auditing

What It Is

CodeMetrics is an AI-native code quality auditing toolkit: ten specialized analysis engines unified under a single CLI, built for CI/CD gatekeeping and autonomous agent workflows.

Born from a rebrand of quality-tools, v1.0.0 stabilizes the engine suite, standardizes outputs (JSON/NDJSON/SARIF), and ships with first-class Hermes Agent skill integration.

Highlights

  • ✅ 10 focused tools — CRAP scoring, mutation testing, debt inventory, risk mapping, doc coverage, taint analysis, fuzz detection, coupling analysis, duplication finding, property coverage
  • ✅ Single CLI — codemetrics <subcommand> replaces 10 separate binaries
  • ✅ Machine-readable output — JSON/NDJSON/SARIF with validated schemas in schemas/
  • ✅ CI-ready — deterministic exit codes, GitHub Actions workflows, SARIF upload to Security tab
  • ✅ AI-ready — Hermes Agent skills under hermes/ for autonomous quality gates
  • ✅ Zero external services — fully local tree-sitter analysis, no cloud dependencies

Breaking Changes vs quality-tools

quality-tools codemetrics v1.0
Separate binaries (crap, mutate, …) Single codemetrics CLI with subcommands
.quality-baseline.sarif .codemetrics-baseline.sarif
~/.quality-history/ ~/.codemetrics-history/
No versioning policy SemVer with documented stability tiers

See UPGRADE.md for full migration instructions.

New Documentation

  • CHANGELOG.md — full history with SemVer tracking
  • UPGRADE.md — step-by-step migration from quality-tools
  • VERSIONING.md — stability tiers, schema evolution policy, deprecation process
  • PROJECT_STATUS.md — current health, known issues, roadmap

Tool Overview

Tool Purpose Output
crap CRAP score per function (complexity × coverage risk) Function-level rankings
mutate Mutation testing — test suite kill rate Score % + surviving mutants
debt Technical debt inventory (TODO/FIXME/HACK/XXX) Author-grouped heatmap
riskmap Churn × complexity hot spots Ranked file list
doccov Public API documentation coverage Module-level %
taint Sensitive data flow tracing (secrets, logs) Paths with source→sink
fuzz Fuzzable entry point detection Fuzzability scores
coupling Dependency analysis (cycles, fan-in/out) Coupling matrix
dupfind AST-based duplication detection Duplicate blocks
propcov Property test coverage Coverage %

Usage Examples

# Full suite on current project (JSON output)
codemetrics run . --format json --output report.json

# Check CRAP risk on src/
codemetrics crap ./src --recursive

# Mutation testing with mutant cap
codemetrics mutate . --max-mutants 50

# SARIF for GitHub Security tab
codemetrics run . --format sarif > results.sarif

Known Limitations

  • ast-parse-ts: Python docstring parser panics on pathological inputs (ignored test, not production-impacting)
  • taint: Secret-type and log-leak detection rules need refinement (improvements planned for v1.1.0)
  • mutate: Requires passing test suite; ignores ignored mutants by default

See PROJECT_STATUS.md for the full list.

Get Started

# Build from source
git clone https://github.com/KidIkaros/codemetrics.git
cd codemetrics
cargo build --release

# Run on your project
./target/release/codemetrics run .

# Or (when published to crates.io)
cargo install codemetrics-cli

AI Agent Integration

CodeMetrics includes Hermes Agent skills directly in the repository (hermes/). Agents can invoke tools autonomously, parse structured results, and act on thresholds.

See hermes/README.md for the skill catalog.

Credits

Built with Rust. Licensed Apache-2.0 / OPL-1.1 (core vs extensions).
Self-hosts on its own codebase at https://github.com/KidIkaros/codemetrics.

⭐ Star us on GitHub — feedback and contributions welcome.

Assets 2
Loading