CodeTrust

Verify AI-generated code with deterministic algorithms — No LLM reviewing LLM.

English | 中文

CodeTrust is a fully local CLI tool designed to verify the quality of AI-generated code (Cursor, Copilot, ChatGPT, etc.). Instead of using an LLM to review LLM output, it applies deterministic static analysis to detect common hallucination patterns and quality issues.

Features

• Hallucination Detection — Phantom imports, unused imports, missing await, unnecessary try-catch, over-defensive coding, dead logic branches
• Security Scanning — Hardcoded secrets, eval usage, query-like SQL injection, XSS vulnerabilities
• Structure Analysis — Cyclomatic/cognitive complexity, function length, nesting depth, parameter count
• Style Consistency — Mixed naming convention detection (camelCase / snake_case)
• Coverage Analysis — Detect files missing corresponding test files
• Auto-fix — codetrust fix automatically fixes safe issues (unused imports, debugger, loose equality, unused variables) with dry-run preview
• Five-Dimension Scoring — Security, Logic, Structure, Style, Coverage, weighted into a trust score (0-100)
• Fully Local — No cloud uploads, zero external requests
• Bilingual — Automatic Chinese/English output based on system locale

Install

npm install -g @gulu9527/code-trust

Both code-trust and codetrust commands are available after installation.

Quick Start

# Initialize config file
codetrust init

# Scan git staged files
codetrust scan --staged

# Scan diff against main branch
codetrust scan --diff origin/main

# Scan specific files
codetrust scan src/foo.ts src/bar.ts

# JSON output (for CI/CD)
codetrust scan --staged --format json

# Set minimum score threshold (exit code 1 if below)
codetrust scan --staged --min-score 70

# List all rules
codetrust rules list

# Install pre-commit hook
codetrust hook install

# Auto-fix issues (dry-run by default)
codetrust fix src/

# Apply fixes
codetrust fix src/ --apply

# Fix only a specific rule
codetrust fix src/ --apply --rule logic/type-coercion

Trust Score

CodeTrust evaluates code across five dimensions, weighted into a total score (0-100):

Scoring Model

Each issue deducts points based on severity, with diminishing penalties for repeated issues of the same severity:

For example, 3 high-severity issues deduct 15 + 10.5 + 7.35 = 32.85 (not 45). This prevents a single rule category from dominating the score unfairly.

Each issue is identified by a content-hash fingerprint (SHA256 of rule ID + file path + code snippet), making findings stable across unrelated line shifts.

Grades

Built-in Rules (29)

Hallucination Detection (Logic)

Security Rules

Auto-fix

codetrust fix can automatically fix certain safe issues. It runs in dry-run mode by default — no files are modified until you pass --apply.

Fixable Rules

# Preview fixes (dry-run, no file changes)
codetrust fix src/

# Apply fixes to files
codetrust fix src/ --apply

# Fix only a specific rule
codetrust fix src/ --apply --rule logic/type-coercion

Configuration

Run codetrust init to generate .codetrust.yml:

version: 1

include:
  - "src/**/*.ts"
  - "src/**/*.js"
exclude:
  - "**/*.test.ts"
  - "**/node_modules/**"

weights:
  security: 0.30
  logic: 0.25
  structure: 0.20
  style: 0.10
  coverage: 0.15

thresholds:
  min-score: 70
  max-function-length: 40
  max-cyclomatic-complexity: 10
  max-cognitive-complexity: 20
  max-nesting-depth: 4
  max-params: 5

rules:
  disabled: []
  overrides: {}

Detection Notes

• security/eval-usage is intentionally scoped to executable usage. It still flags eval(...), new Function(...), and string-based setTimeout / setInterval, but it avoids false positives from detector metadata such as pattern: /.../ and from plain string literals that merely mention eval(.
• security/sql-injection requires both SQL keywords and query-like context such as query, sql, statement, stmt, or calls like .query(...) / .execute(...). This keeps real query construction findings while reducing noise from non-query metadata or fingerprint assembly.

CI/CD Integration

GitHub Action (Reusable)

name: CodeTrust
on:
  pull_request:
    branches: [main]

jobs:
  trust-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: GuLu9527/CodeTrust@main
        with:
          min-score: 70

Or install manually:

      - uses: actions/setup-node@v4
        with:
          node-version: '20'
      - run: npm install -g @gulu9527/code-trust
      - run: codetrust scan --diff origin/main --min-score 70

Git Pre-commit Hook

codetrust hook install

Automatically runs CodeTrust scan on every git commit. Use git commit --no-verify to skip.

Language

CodeTrust auto-detects system locale. To override:

# Force Chinese
CODETRUST_LANG=zh codetrust scan --staged

# Force English
CODETRUST_LANG=en codetrust scan --staged

Tech Stack

• Language: TypeScript 5.x
• Runtime: Node.js 20+
• AST Parsing: @typescript-eslint/typescript-estree
• CLI: Commander.js
• Git: simple-git
• Terminal UI: picocolors + cli-table3
• Config: cosmiconfig
• Testing: Vitest
• Build: tsup

License

Apache-2.0