Your code stays with you
The analysis engine runs inside the extension, with no server or account required. Optional AI reviews send a summary of the analysis only when you use them.
← Initiatives / Security toolsCodebase health checks,
LOCAL ANALYSIS / VS CODE EXTENSION
Codebase health checks,
inside VS Code.
Analyze your open folder and bring structure, technical debt, security, and dependencies into one report. Analysis runs entirely on your PC.
TypeScript / JavaScript · PHP · Python · Go · Java · C# · Rust · C++ · Swift · Kotlin · Dart supported
Start with reachable risks
Trace external input to dangerous operations. Findings with a reachable input path are distinguished from pattern matches that need review.
The whole picture in one report
God classes, circular dependencies, dependency graphs, SBOM, and vulnerabilities come together in a shareable HTML report. Light and dark modes are supported.
01 / FEATURE TOUR
One folder. Multiple perspectives.
CODES DOCTOR / 01
Score technical debt and security
See technical debt and security scores out of 100, with a ranking of classes that concentrate too many responsibilities.
Try it on your code ↗CODES DOCTOR / 02
Evidence behind every finding
Review complexity, maintainability, circular dependencies, and detected vulnerabilities. Test-code findings are distinguished and excluded from scores.
Try it on your code ↗
CODES DOCTOR / 03
Map your dependencies
Visualize module dependencies and function calls from actual imports.
Try it on your code ↗
CODES DOCTOR / 04
Know the components you use
List direct, transitive, and development dependencies, and check known vulnerabilities using Trivy, or npm audit when Trivy is unavailable.
Try it on your code ↗
CODES DOCTOR / 05
Turn findings into next steps
Optionally configure an OpenAI or Anthropic API key to generate a review of the results and task prompts ready for Claude Code or Cursor.
Try it on your code ↗
02 / NEW IN 4.0
Risk lives where input can reach.
Trace request parameters and command-line arguments through variables to command execution or SQL within each function. Reachable findings show the input path; other pattern matches are marked for review.
INPUT → VARIABLE → SINK
// Illustrative example of an input path
function handler(req, res) {
const input = req.query.command;
const command = input;
exec(command);
}ILLUSTRATIVE FINDINGS
Reachable from input
req.query.command → input → command → exec
A path from external input to a dangerous operation was detected.
Needs review
A pattern matched, but reachability from external input was not confirmed.
Supported for TypeScript / JavaScript, PHP, Python, Go, Java, C#, Rust, and C++. Input paths across separate functions are not yet tracked.
03 / LANGUAGES
Analysis tailored to your language.
Full analysis with dedicated parsers
TypeScript / JavaScript, PHP
Syntax-tree analysis with Tree-sitter
Python, Go, Java, C#, Rust, C++
Basic structure extraction
Swift, Kotlin, Dart
Languages with basic structure extraction are more prone to false positives and missed findings.
04 / GET STARTED
Three steps to a healthier codebase.
Install
Search for “Codes Doctor” in VS Code extensions.
Analyze
Run analysis from the Activity Bar dashboard.
Read the report
Open the results in your browser or inside VS Code.
In CI, use the codes-doctor command-line tool to generate the same report and fail checks when scores fall below your thresholds.
05 / BUILT FOR YOUR WORK
For builders and reviewers alike.
Developers
- Locate risks before changing code
- Findings include files and line numbers
- Create task prompts for AI agents
Tech leads
- Visualize oversized classes and uneven dependencies
- Track improvements with scores
- Enforce thresholds in CI
Reviewers & delivery teams
- One report for pre-delivery checks
- Document components with an SBOM
- Analyze without uploading code
START WITH YOUR CODE
Start with the folder you have open.
Free to install. No registration required.
Install for free ↗Analysis runs locally without uploading source code. Optional AI reviews send a summary of the results to your selected API provider. Known-vulnerability lookups use Trivy or npm audit.
EXPLORE THE APPS / TIP
Three perspectives on your software.
Choose an app to explore its features and how to use it.
01 / CURRENT APP
Codes Doctor
Review code structure, technical debt, and security.
Explore the app
02 / EXPLORE
SBOM Vulnerability Scanner
Generate dependency inventories and check known vulnerabilities.
Explore the app
03 / EXPLORE
LLM Security Scanner
Trace LLM output and external input to risky operations.
Explore the app