Title: I built a CLI that diagnoses your code before you ship

I built a CLI that diagnoses your code before you ship

Every NestJS project I've worked on had the same problems:

POST endpoints without auth guards

Hardcoded API keys in source code

.env not in .gitignore

Zero tests

No Swagger documentation

I was tired of catching these manually in code reviews. So I built codediag.

What it does

bashnpx codediag scan .

One command. It auto-detects your stack and runs 5 analyzers:

codediag — Diagnostic Report

Project: my-nestjs-app

Stack: nestjs + typescript + prisma

Score: B+ (87/100)

API Health ███████████████░░░░░ 78

Security ██████████████████░░ 92

Dependencies ██████████████████░░ 91

Testing ████████████████░░░░ 82

Structure █████████████████░░░ 88

The 5 Analyzers

1. API Health (NestJS)
   This is the differentiator. codediag uses ts-morph to do real AST analysis of your NestJS decorators — not regex pattern matching.
   It discovers every endpoint from @get(), @post(), @Put(), @Delete(), @Patch() decorators and checks:

Auth guards: Does this endpoint have @UseGuards()? Especially important for mutating endpoints.

DTO validation: Is the @body() parameter typed with a DTO class?

Swagger docs: Are @ApiOperation() and @ApiResponse() present?

Return types: Is there an explicit return type annotation?

1. Security
   The stuff that ends up on HackerNews for the wrong reasons:

Hardcoded secrets (API keys, Stripe keys, AWS keys, GitHub tokens)

.env in .gitignore

Helmet middleware for HTTP security headers

CORS wildcard (origin: '*') detection

Rate limiting package installed

Password hashing library present

1. Dependencies
   Your node_modules is a supply chain. codediag treats it like one:

npm audit vulnerabilities

Lock file existence

Deprecated packages

Engine specification

Essential scripts

1. Testing

Test file existence and count

Framework detection (Jest, Vitest, Mocha, Ava)

Test-to-source file ratio

E2E test directory

Coverage threshold configuration

1. Structure

README quality

Linter configuration (ESLint or Biome)

Formatter configuration (Prettier)

TypeScript strict mode

NestJS module organization

.env.example presence

Scoring

Each analyzer scores 0-100. The total is a weighted average:

AnalyzerWeightAPI Health25%Security30%Dependencies20%Testing15%Structure10%

Security gets the highest weight because shipping vulnerable code is the worst bug.

CI/CD

One line in your GitHub Actions:

yaml- run: npx codediag scan . --ci --threshold 80

Exits with code 1 if the score drops below your threshold.

What's next

Next.js analyzer

Express route analyzer

Web dashboard with trend tracking

AI-powered fix suggestions

VS Code extension

Try it

bashnpx codediag scan .

Zero config. MIT licensed. 33KB bundled.

GitHub: https://github.com/scuton-technology/codediag

npm: https://www.npmjs.com/package/codediag

I'd love to hear what checks you'd want added. Drop a comment or open an issue!