CodeMetrics

Production-grade code quality, security, and compliance auditing — 21 specialized analysis engines unified under a single CLI, designed for CI/CD gatekeeping and autonomous AI agent integration.

Problem

Most quality tooling falls into one of two buckets:

Both approaches struggle when you need composable, machine-readable quality gates that actually fit into modern automated workflows.

Solution

CodeMetrics is a deliberate collection of focused analyzers — each does one thing well, all speak the same language (JSON/NDJSON/SARIF), and compose cleanly into pipelines.

Built in Rust with zero external runtime dependencies, designed from the start for AI agent consumption and CI/CD integration.

21-Check Engine Suite

Quality — crap · debt · doccov · riskmap · dupfind · coupling · complexity · linelen · halstead · deadcode · cohesion · comments · propcov · typecov · fuzz · mutate

Security — secrets · taint · errhandle · vulnscan · sast · crypto

Compliance — licenses · sbom

Invoke individually (codemetrics crap src/) or run the full battery (codemetrics check .).

Why CodeMetrics

AI-Native Architecture

• Structured JSON/NDJSON output — consumable by agents without text parsing
• Deterministic exit codes signal pass/fail for autonomous decision-making
• First-class Hermes Agent skills included under hermes/

Production-Ready Rigor

• CI-validated on its own codebase (self-hosting)
• Output schemas available in schemas/ for validation
• SARIF support for GitHub Security tab integration

Practical Design

• Zero configuration — auto-detects 15 languages out of the box
• No cloud services — tree-sitter based, fully local analysis
• Single dependency chain (Rust toolchain only)

Getting Started

# Clone and build
git clone https://github.com/KidIkaros/codemetrics.git
cd codemetrics
cargo build --release
export PATH="$PWD/target/release:$PATH"

# 1. Auto-detect your ecosystem and write .quality.toml
codemetrics init

# 2. Run all 21 checks against your project (auto-loads thresholds)
codemetrics check .

# 3. Generate a visual HTML audit report
codemetrics report . --open

# 4. Wire GitHub Actions + pre-commit hook (optional, one-time)
codemetrics init --ci

Or install directly:

cargo install --path crates/codemetrics-cli
cargo install --path crates/codemetrics-server  # optional MCP server

Typical Workflows

• Pre-commit quality gate — fail PRs if crap threshold exceeded or mutation score drops
• Refactoring prioritization — riskmap pinpoints files with highest change-complexity risk
• Security audit — --only sast,secrets,crypto,taint runs the security subset in seconds
• Documentation audit — doccov surfaces undocumented public APIs before release
• Test strength assessment — mutate measures defect detection capability beyond coverage numbers
• Snapshot comparison — codemetrics diff before.json after.json shows regressions and fixes between any two check runs
• CI integration — codemetrics check . --ci outputs JSON, disables colors/progress, exits 1 on failure

AI Agent Integration

CodeMetrics ships with Hermes Agent skill definitions under hermes/. Each skill wraps a tool, parses structured results, and exposes thresholds for autonomous operation.

See AGENTS.md for the skill catalog and usage patterns.

Output Formats

All tools accept --format <json|ndjson|sarif|text>.
Reports: codemetrics report . --format <html|markdown|pdf> [--open].

Project Health

See docs/PROJECT_STATUS.md for roadmap and known limitations.

Documentation

• User Guide — CLI reference and output interpretation
• Developer Guide — crate architecture and extending the suite
• Hermes Integration — wiring CodeMetrics into AI agent workflows
• Schema Reference — JSON/NDJSON/SARIF output contracts

Contributing

CodeMetrics is open source under Apache-2.0 / OPL-1.1 dual licensing. Contributions welcome — see docs/developer-guide.md for development setup and contribution guidelines.