model-rot is a zero-dependency Node.js CLI that statically scans an AI repository for hardcoded LLM model identifiers and reports dependency rot against a bundled deprecation registry.
Part of the Corteus AI due-diligence toolkit with wrapper-test and the methodology guide: AI due diligence vs software due diligence.
Run against a local repository:
npx model-rot <path-to-repo>Run from a checkout of this repo:
node bin/model-rot.js <path-to-repo>Print JSON:
npx model-rot --json <path-to-repo>Use a fixed comparison date:
npx model-rot --today 2026-10-01 <path-to-repo>The tool makes no network calls at runtime. It reads local source and configuration files, reports only model identifiers with file and line references, and skips generated directories and credential-like files. Dotenv model configuration files are scanned because hardcoded model pins often live there, but values are never printed.
model-rot looks for string literals and configuration values matching provider model-id patterns:
| Provider | Pattern family |
|---|---|
| OpenAI | gpt-*, o1-*, o3-*, text-*-003, chatgpt-* |
| Anthropic | claude-* |
gemini-* |
It scans code, package manifests, JSON, YAML, TOML, Prisma, and dotenv example/config files. Comments are ignored.
| Verdict | Meaning |
|---|---|
Current |
No deprecated, retiring, or retired model was found. Models the registry does not track are reported but do not lower the verdict. |
Aging |
At least one model is deprecated (announced, but more than 90 days from its retirement date). |
At risk |
At least one model has a known retirement date within 90 days of the comparison date. |
Broken |
At least one found model has reached its retirement date. The CLI exits non-zero. |
Models not present in the registry are reported as unknown. That is a neutral, informational
state — it means the registry has no deprecation record for that identifier, not that the model
is old. A brand-new model the registry has not catalogued yet will never lower the verdict.
If no model identifiers are found, the report says so and does not force a verdict.
Lifecycle data lives in data/deprecations.json. The bundled file is a seed registry that will be replaced or extended with externally verified entries over time. Each entry includes provider, model, status, retirement date, replacement, and an official vendor source URL.
Found model identifiers that are not present in the registry are reported as unknown; they are never treated as retired by default.
Static analysis catches hardcoded model identifiers in source and configuration files. It does not prove which model is used at runtime, and it can miss dynamically constructed model names such as 'gpt-' + version or values loaded from remote configuration.
The registry is best-effort and community-maintained. A clean report means no known hardcoded retired model pins were found by this scanner, not that a production system has no model lifecycle risk.
npm testThe test suite uses fixture repositories under tests/fixtures.