Open source, with thanks

Built on the work of great maintainers

Agnes doesn't analyse your code on its own. Every report and score is built from the output of open-source tools, written and maintained by people who give their time to make the frontend ecosystem better. Thank you to every developer, maintainer and contributor behind them. Agnes wouldn't exist without you.

If these projects are useful to you too, consider starring them, reporting issues, contributing, or sponsoring the maintainers.

Tools that read your code

These run inside a locked-down container with no network. Each one feeds one part of the score.

  • Oxlint

    MIT
    • Code smells

    A very fast linter from the Oxc project. Agnes uses it to flag suspicious and error-prone code patterns, import cycles, and risky TypeScript shortcuts such as any, in JavaScript, TypeScript and the script blocks of Vue, Svelte and Astro files.

  • Biome

    MIT OR Apache-2.0
    • Code smells

    A fast toolchain for the web. Agnes runs its linter in three passes: style problems in CSS and HTML, overly complex code, and Vue, Svelte and Astro components, where it checks templates, unused code and complexity in their scripts. It also checks Astro accessibility.

  • FTA

    MIT
    • Code smells

    The Fast TypeScript Analyzer, written in Rust. It rates how maintainable each file is, based on its complexity and size.

  • Knip

    ISC
    • Code smells

    Finds unused files, exports and dependencies, so dead code doesn't pile up unnoticed.

  • jscpd

    MIT
    • Duplication

    A copy/paste detector. It finds blocks of duplicated code across your project and reports how much of it is repeated.

  • Stylelint

    MIT
    • Code smells

    A modern CSS linter. Agnes runs its recommended rules to catch CSS mistakes such as duplicate selectors and properties or unknown properties, in CSS, SCSS, Sass and Less files and in the style blocks of Vue, Svelte and Astro components.

  • html-validate

    MIT
    • Code smells

    An offline HTML validator with accessibility checks. It flags broken markup, missing alt text or language attributes, and similar problems.

  • axe-core

    MPL-2.0
    • Accessibility

    An accessibility rules engine from Deque. When accessibility checks are on, Agnes runs it over your static HTML pages to find missing labels, missing alt text, invalid ARIA and similar problems. It can't judge colour contrast without a browser, so that is left out.

  • jsdom

    MIT
    • Accessibility

    A JavaScript implementation of the browser DOM. It lets axe-core read your HTML in a plain container, with no browser and without running your page's scripts.

  • ESLint

    MIT
    • Accessibility

    The pluggable JavaScript linter. For the accessibility checks, Agnes runs it with the Vue accessibility plugin and Angular's template accessibility rules on your components.

  • Angular ESLint

    MIT
    • Code smells
    • Accessibility

    Angular's own lint rules, run by ESLint. Agnes uses its recommended rules to flag templates and components that are likely to be wrong, such as negated async pipes or a misspelt two-way binding, and code that has not moved to the current Angular style, in external and inline templates and in the TypeScript. With the accessibility checks on, it also runs Angular's template accessibility rules.

  • eslint-plugin-vue

    MIT
    • Code smells
    • Security

    The official Vue linter. Agnes runs a selection of its rules, the ones that oxlint and Biome do not already cover: props that a component changes, refs used without .value, unused template variables, invalid directives and invalid default props. It also flags v-html, which renders raw HTML, as a security finding to review.

  • eslint-plugin-svelte

    MIT
    • Code smells
    • Security

    The official Svelte linter. Agnes runs a selection of its rules that the Svelte compiler does not already cover: each blocks without a key, store misuse, duplicated directives and objects printed in text. It also flags {@html} and target="_blank" links as security findings to review.

  • Svelte

    MIT
    • Code smells
    • Accessibility

    The Svelte compiler. It warns about accessibility problems in components, and about reactivity mistakes and unused styles; Agnes reads those warnings without generating or running any code.

  • Secretlint

    MIT
    • Security

    Looks for committed secrets such as API keys, tokens and private keys. Agnes reports where one was found, never the secret itself.

Public data we look up

Besides the tools above, two public services tell us about your dependencies. Only package names and versions are sent to them, never your code.

How the score comes together

Each category becomes a score from 0 to 100. The overall score is a weighted mix of the four.

  • 35%
    Code smells
  • 35%
    Dependencies
  • 15%
    Security
  • 15%
    Duplication

If a category can't be analysed, for example because there is no lockfile, it is left out and the weights of the others are scaled up to match.

Accessibility and measured test coverage are optional per project. When switched on they join the mix, at about 10% and 15%, and the others scale down to match.