Most tools tell you what changed in your code. This tells you what your application can do: every entry point, what data each one touches, and whether anything checks who is asking. It reads without running anything. No account, no upload, no telemetry, one command writes a single HTML file that works offline. Scan again and it reports what changed about the behaviour, not which lines moved. MIT and free. A paid GitHub Action runs the same check on every pull request, free on public repos.
No reviews yetBe the first to leave a review for what it does
Maker
📌
I build software on my own, and over the last year more and more of what I
shipped was written by a model and read by nobody. It worked. It passed review.
I could not have told you what half of it actually did.
So I wrote this. It reads a codebase without running it and reports every way
in — every route, server action and function anything outside can reach — what
data each one touches, and whether there is a visible check on who is asking.
Scan a second time and it tells you what changed about the behaviour, not which
lines moved.
Two things I would rather say up front than have you find:
It cannot see everything. Anything chosen at runtime is invisible to it, and
the absence of a finding is not proof that nothing is wrong. The report says so
on its own front page rather than in a footnote.
It is deliberately narrow. Next.js App Router, Cloudflare Pages Functions and
Supabase Edge Functions today. If it cannot read your project it names the
framework it found and says why it stopped, instead of printing an empty report.
Getting it to stay quiet was most of the work. On a real 4,000-file open-source
monorepo it reports nothing, because there is nothing there to report — a tool
that cries wolf on good code gets uninstalled the same afternoon.
Free forever, MIT, no account, nothing uploaded: npx what-it-does. There is a
paid GitHub Action that runs the comparison on every pull request, free on
public repositories.
The most useful thing you can send me is a case where it said something wrong
about your own code. That is what the accuracy work runs on.
@eriksenlabs - like you I'm a solo developer, mainly working on native apps using swift. I will give the scan ago, but was curious was it built for this type of project or more web technologies?
Report
Maker
@codeandsea Hi Brent - honest answer: no, not yet. It reads JavaScript and TypeScript
only, so a Swift project is outside it today. Specifically: Next.js App
Router, Cloudflare Pages Functions, and Supabase Edge Functions.
It won't waste your time finding out, though. I just ran it on a Swift
package to check before answering you, and it says "This is a Swift
project, we only read JavaScript and TypeScript today, so we cannot tell
you anything about this, which is our limit, not a fact about your code,"
then lists what it can read.
Your question actually caught a bug: that list was naming two frameworks
when there are three. Fixed and going out today, so thank you for that.
On whether Swift ever happens ,I'd rather say "not planned" than string
you along. The whole approach leans on entry points being declared
somewhere readable: a file path becomes a route, an export becomes a
handler. That's what makes it possible to know every way into an app
without running it. Swift doesn't hand you that in the same way, and I'd
be guessing rather than reading.
If you ever have a TS or JS side to your work, a backend, a web
dashboard, some Supabase functions, that's where it'd earn its keep.
@eriksenlabs - Thanks for the honest and detailed explanation, it is very much appreciated. Happy I could help you surface a bug too, If I do ever look at building tools with JS/TS then I may give this a go. Thanks.
Report
Maker
Happy to hear your insights and respond to your questions and feedback.
Mantra Timer
@eriksenlabs - like you I'm a solo developer, mainly working on native apps using swift. I will give the scan ago, but was curious was it built for this type of project or more web technologies?
@codeandsea
Hi Brent - honest answer: no, not yet. It reads JavaScript and TypeScript
only, so a Swift project is outside it today. Specifically: Next.js App
Router, Cloudflare Pages Functions, and Supabase Edge Functions.
It won't waste your time finding out, though. I just ran it on a Swift
package to check before answering you, and it says "This is a Swift
project, we only read JavaScript and TypeScript today, so we cannot tell
you anything about this, which is our limit, not a fact about your code,"
then lists what it can read.
Your question actually caught a bug: that list was naming two frameworks
when there are three. Fixed and going out today, so thank you for that.
On whether Swift ever happens ,I'd rather say "not planned" than string
you along. The whole approach leans on entry points being declared
somewhere readable: a file path becomes a route, an export becomes a
handler. That's what makes it possible to know every way into an app
without running it. Swift doesn't hand you that in the same way, and I'd
be guessing rather than reading.
If you ever have a TS or JS side to your work, a backend, a web
dashboard, some Supabase functions, that's where it'd earn its keep.
Mantra Timer
@eriksenlabs - Thanks for the honest and detailed explanation, it is very much appreciated. Happy I could help you surface a bug too, If I do ever look at building tools with JS/TS then I may give this a go. Thanks.
Happy to hear your insights and respond to your questions and feedback.
Thank you for your support.