Axonscanner
Audit whether your codebase is as real as it claims. A zero-dependency static analyzer that grades every module on a verification ladder derived from the code itself — never from commit messages or documentation.
One pip install. Everything happens in your terminal — no dashboard to host, no service to trust, nothing sent anywhere.
A real scan of werkzeug
The actual terminal dashboard axonscanner produced — nothing mocked. The repo was cloned, scanned statically, and deleted. Composed and colored in the terminal with the standard library alone: a stacked verification bar, an at-a-glance panel, heat-mapped risk hotspots, and a per-package rollup.
Verified capability register
Every module, ranked worst-first: its verification tier, size, test count, risk score, and the machine-derived note. This is the report written to .axonscanner/CAPABILITY_REGISTER.md on every scan.
| Status | Module | LOC | Tests | Risk | Note |
|---|---|---|---|---|---|
| claimed-only | routing/map | 972 | 0 | 0.44 | no test path statically proven — verify by hand |
| claimed-only | routing/rules | 956 | 0 | 0.46 | no test path statically proven — verify by hand |
| claimed-only | datastructures/structures | 917 | 0 | 0.40 | no test path statically proven — verify by hand |
| claimed-only | wrappers/response | 846 | 0 | 0.42 | no test path statically proven — verify by hand |
| claimed-only | sansio/response | 822 | 0 | 0.37 | no test path statically proven — verify by hand |
| claimed-only | datastructures/headers | 658 | 0 | 0.36 | no test path statically proven — verify by hand |
| claimed-only | wrappers/request | 657 | 0 | 0.40 | no test path statically proven — verify by hand |
| claimed-only | debug/tbtools | 450 | 0 | 0.41 | no test path statically proven — verify by hand |
| claimed-only | datastructures/accept | 413 | 0 | 0.37 | no test path statically proven — verify by hand |
| claimed-only | datastructures/range | 351 | 0 | 0.36 | no test path statically proven — verify by hand |
See the whole codebase at once premium
The intel command turns the same analysis into a dependency graph — every module sized by LOC, colored by verification status, connected by its real imports. Hover a node for a summary; click it for the full evidence trail. intel is a premium feature — scan, dashboard and the capability register above are free and open source, always.
Comprehension debt
AI writes code 5–7× faster than anyone can read it. Pull requests are up, review time is up, and "done" increasingly means a model said it was done — not that anyone verified it. The sharp edge of that is code which claims to be finished but is a stub, a placeholder, or synthetic data dressed up as real computation.
Each rung is a strictly stronger claim than the one below
It under-credits, never over-credits. If it marks a module verified, it is verified. Its errors only ever hide real tests — they never invent them. That is what makes the output safe to trust.
Structural intelligence, not just a score
- A dependency graph of the whole codebase
- Risk hotspots ranked by churn × unverified × complexity × coupling
- An algorithmically-ranked improvement backlog
- A self-learning loop that measures whether acting on a recommendation actually helped, and reweights itself over time
- Dream mode — a living dashboard, shipped in v0.3.0
Pure standard library. No execution of the code under audit, and no install of it either. It reads your code; it never modifies it.