Built on the work of great maintainers
Agnes doesn't analyse your code on its own. Every report and score is built from the output of open-source tools, written and maintained by people who give their time to make the frontend ecosystem better. Thank you to every developer, maintainer and contributor behind them. Agnes wouldn't exist without you.
If these projects are useful to you too, consider starring them, reporting issues, contributing, or sponsoring the maintainers.
Tools that read your code
These run inside a locked-down container with no network. Each one feeds one part of the score.
Oxlint
MIT- Code smells
A very fast linter from the Oxc project. Agnes uses it to flag suspicious and error-prone code patterns, import cycles, and risky TypeScript shortcuts such as any, in JavaScript, TypeScript and the script blocks of Vue, Svelte and Astro files.
Biome
MIT OR Apache-2.0- Code smells
A fast toolchain for the web. Agnes runs its linter in three passes: style problems in CSS and HTML, overly complex code, and Vue, Svelte and Astro components, where it checks templates, unused code and complexity in their scripts. It also checks Astro accessibility.
FTA
MIT- Code smells
The Fast TypeScript Analyzer, written in Rust. It rates how maintainable each file is, based on its complexity and size.
Knip
ISC- Code smells
Finds unused files, exports and dependencies, so dead code doesn't pile up unnoticed.
jscpd
MIT- Duplication
A copy/paste detector. It finds blocks of duplicated code across your project and reports how much of it is repeated.
Stylelint
MIT- Code smells
A modern CSS linter. Agnes runs its recommended rules to catch CSS mistakes such as duplicate selectors and properties or unknown properties, in CSS, SCSS, Sass and Less files and in the style blocks of Vue, Svelte and Astro components.
html-validate
MIT- Code smells
An offline HTML validator with accessibility checks. It flags broken markup, missing alt text or language attributes, and similar problems.
axe-core
MPL-2.0- Accessibility
An accessibility rules engine from Deque. When accessibility checks are on, Agnes runs it over your static HTML pages to find missing labels, missing alt text, invalid ARIA and similar problems. It can't judge colour contrast without a browser, so that is left out.
jsdom
MIT- Accessibility
A JavaScript implementation of the browser DOM. It lets axe-core read your HTML in a plain container, with no browser and without running your page's scripts.
ESLint
MIT- Accessibility
The pluggable JavaScript linter. For the accessibility checks, Agnes runs it with the Vue accessibility plugin and Angular's template accessibility rules on your components.
Angular ESLint
MIT- Code smells
- Accessibility
Angular's own lint rules, run by ESLint. Agnes uses its recommended rules to flag templates and components that are likely to be wrong, such as negated async pipes or a misspelt two-way binding, and code that has not moved to the current Angular style, in external and inline templates and in the TypeScript. With the accessibility checks on, it also runs Angular's template accessibility rules.
eslint-plugin-vue
MIT- Code smells
- Security
The official Vue linter. Agnes runs a selection of its rules, the ones that oxlint and Biome do not already cover: props that a component changes, refs used without .value, unused template variables, invalid directives and invalid default props. It also flags v-html, which renders raw HTML, as a security finding to review.
eslint-plugin-svelte
MIT- Code smells
- Security
The official Svelte linter. Agnes runs a selection of its rules that the Svelte compiler does not already cover: each blocks without a key, store misuse, duplicated directives and objects printed in text. It also flags {@html} and target="_blank" links as security findings to review.
Svelte
MIT- Code smells
- Accessibility
The Svelte compiler. It warns about accessibility problems in components, and about reactivity mistakes and unused styles; Agnes reads those warnings without generating or running any code.
Secretlint
MIT- Security
Looks for committed secrets such as API keys, tokens and private keys. Agnes reports where one was found, never the secret itself.
Public data we look up
Besides the tools above, two public services tell us about your dependencies. Only package names and versions are sent to them, never your code.
OSV
- Dependencies
The open source vulnerability database. Agnes checks every package in your lockfile against it and reports known advisories, and whether a patch exists.
npm registry
- Dependencies
The package registry tells us when a dependency you use is deprecated, outdated or hasn't been updated in a long time.
How the score comes together
Each category becomes a score from 0 to 100. The overall score is a weighted mix of the four.
- 35%Code smells
- 35%Dependencies
- 15%Security
- 15%Duplication
If a category can't be analysed, for example because there is no lockfile, it is left out and the weights of the others are scaled up to match.
Accessibility and measured test coverage are optional per project. When switched on they join the mix, at about 10% and 15%, and the others scale down to match.