I built a CLI that diagnoses your code before you ship
Every NestJS project I’ve worked on had the same problems:
POST endpoints without auth guards
Hardcoded API keys in source code
.env not in .gitignore
Zero tests
No Swagger documentation
I was tired of catching these manually in code reviews. So I built codediag.
What it does
bashnpx codediag scan .
One command. It auto-detects your stack and runs 5 analyzers:
codediag — Diagnostic Report
Project: my-nestjs-app
Stack: nestjs + typescript + prisma
Score: B+ (87/100)
API Health ███████████████░░░░░ 78
Security ██████████████████░░ 92
Dependencies ██████████████████░░ 91
Testing ████████████████░░░░ 82
Structure █████████████████░░░ 88
The 5 Analyzers
- API Health (NestJS)
This is the differentiator. codediag uses ts-morph to do real AST analysis of your NestJS decorators — not regex pattern matching.
It discovers every endpoint from @get(), @post(), @Put(), @Delete(), @Patch() decorators and checks:
Auth guards: Does this endpoint have @UseGuards()? Especially important for mutating endpoints.
DTO validation: Is the @body() parameter typed with a DTO class?
Swagger docs: Are @ApiOperation() and @ApiResponse() present?
Return types: Is there an explicit return type annotation?
- Security
The stuff that ends up on HackerNews for the wrong reasons:
Hardcoded secrets (API keys, Stripe keys, AWS keys, GitHub tokens)
.env in .gitignore
Helmet middleware for HTTP security headers
CORS wildcard (origin: ‘*’) detection
Rate limiting package installed
Password hashing library present
- Dependencies
Your node_modules is a supply chain. codediag treats it like one:
npm audit vulnerabilities
Lock file existence
Deprecated packages
Engine specification
Essential scripts
- Testing
Test file existence and count
Framework detection (Jest, Vitest, Mocha, Ava)
Test-to-source file ratio
E2E test directory
Coverage threshold configuration
- Structure
README quality
Linter configuration (ESLint or Biome)
Formatter configuration (Prettier)
TypeScript strict mode
NestJS module organization
.env.example presence
Scoring
Each analyzer scores 0-100. The total is a weighted average:
AnalyzerWeightAPI Health25%Security30%Dependencies20%Testing15%Structure10%
Security gets the highest weight because shipping vulnerable code is the worst bug.
CI/CD
One line in your GitHub Actions:
yaml- run: npx codediag scan . –ci –threshold 80
Exits with code 1 if the score drops below your threshold.
What’s next
Next.js analyzer
Express route analyzer
Web dashboard with trend tracking
AI-powered fix suggestions
VS Code extension
Try it
bashnpx codediag scan .
Zero config. MIT licensed. 33KB bundled.
GitHub: https://github.com/scuton-technology/codediag
npm: https://www.npmjs.com/package/codediag
I’d love to hear what checks you’d want added. Drop a comment or open an issue!