Skip to content

v0.0.1

Choose a tag to compare

View all tags
@bsbodden bsbodden released this 03 Oct 20:22
· 42 commits to main since this release
v0.0.1
3a7ede4

MFCQI v0.0.1 - Initial Release 🎉

The first public release of MFCQI (Multi-Factor Code Quality Index), an evidence-based Python code quality analysis tool that produces a single quality score (0.0-1.0) from 14 research-backed metrics.

Quick Start

pip install mfcqi
mfcqi analyze .

Requirements: Python 3.10+

Highlights

✅ Single Quality Score: One number (0.0-1.0) combining 14 metrics via geometric mean
✅ Empirically Validated: Calibrated against reference libraries (requests: 0.874, click: 0.779)
✅ Python-Specific: Multi-paradigm aware, doesn't penalize Pythonic patterns
✅ Defense-in-Depth Security: 3 independent metrics (SAST, SCA, secrets detection)
✅ CI/CD Ready: SARIF 2.1.0 output, quality gates, badge generation
✅ Research-Backed: 40+ academic sources, transparent methodology

Metrics Analyzed (14 Total)

Complexity: Cyclomatic, Cognitive, Halstead, Maintainability Index
Quality: Duplication, Documentation, Type Safety, Code Smells
Security: Bandit SAST, pip-audit SCA, detect-secrets
OO Metrics (conditional): RFC, DIT, MHF, LCOM, CBO

Key Features

Python-Specific Calibrations

Unlike tools calibrated for Java/C++, MFCQI was empirically validated for Python through controlled experiments:

  • Halstead Volume: Recalibrated for libraries (HV 2000-4000 normal)
  • Maintainability Index: Adjusted thresholds (70/50/30/20 vs 85/65/45)
  • RFC: Library-aware (high RFC acceptable for frameworks)
  • DIT: Multi-paradigm aware (procedural DIT=0 is valid)

Defense-in-Depth Security

  • Bandit SAST (0.70): Code vulnerabilities, CVSS-weighted
  • pip-audit (0.75): Dependency CVEs
  • detect-secrets (0.85): Credential exposure

Coverage: OWASP Top 10, CWE/SANS Top 25

CI/CD Integration

# SARIF output for GitHub/GitLab
mfcqi analyze --format sarif --output results.sarif

# Quality gate
mfcqi analyze --threshold 0.75 --exit-code

# Badge generation
mfcqi badge . -f json -o .github/badges/mfcqi.json

Validation

Reference Library Scores (calculated by MFCQI):

  • requests: 0.874 ✅
  • click: 0.779 ✅
  • mfcqi itself: 0.854 ✅

Documentation

  • Research: docs/research.md - 888 lines, all metrics, calibrations, evidence
  • README: Full guide
  • Validation: mfcqi_validation/reports/ - Empirical studies

Academic Foundation

Based on decades of research:

  • McCabe (1976), Campbell (2018), Coleman et al. (1994), Chidamber & Kemerer (1994)
  • Python-specific: Papamichail et al. (2022), Tempero et al. (2015), Prykhodko et al. (2021)
  • Security: OWASP Top 10 (2021), CWE/SANS Top 25

See docs/research.md for complete 40+ source bibliography.

Links

Made with ❤️ by BSB

Full Changelog: https://github.com/bsbodden/mfcqi/commits/v0.0.1

📦 PyPI Release

This release is now available on PyPI:

Quick Start

pip install mfcqi
mfcqi analyze .

What's New in v0.0.1

See the full changelog above for details.

Assets 2
Loading