CodeDecay

Appearance

CodeDecayFind what your coding agent missed before merge

Open-source PR red-teaming for AI-built code with user-owned agents, real execution evidence, and local-first workflows.

Start with the CLI
See a sample report
Wire GitHub Action
Read llms.txt
CodeDecay Judge Lab hero showing verified diff evidence

Find real regressions

Follow the changed code into routes, APIs, auth, config, schemas, and downstream product paths before a risky PR lands.

Audit test reality

Separate runtime proof from static references, mocked boundaries, snapshots, and other tests that look safe without proving the production path.

Hand fixes to your agent

Generate evidence-rich bundles for Codex, Claude Code, Cursor, Pi, OpenCode, desktop agents, or MCP-compatible workflows.

Run explicit verification

Bring configured tests, builds, probes, product checks, and OSS tool adapters into the same merge-safety loop when your repo allows execution.

Local-first by default

No hidden telemetry, no required hosted service, and no forced model calls. Deterministic analysis works even when AI is disabled.

Human and agent readable

The same source docs power the site, llms.txt, llms-full.txt, and raw Markdown endpoints so review guidance stays aligned everywhere.

Start Here ​

  • Getting Started: install the CLI and run your first PR analysis
  • GitHub Action: add CodeDecay to pull request workflows
  • Redteam Reports: generate merge-safety reports for yourself or your coding agent
  • Task-Scoped Context: retrieve bounded route, file, test, memory, ADR, owner, and proof context for one task
  • Closed-Loop Orchestration: drive a user-owned agent through fix and re-verify rounds
  • Editor Workflows: surface JSON and SARIF findings in VS Code or other local tools before opening a PR
  • Trend Snapshots: persist repository health snapshots and compare them over time without a hosted dashboard
  • Product Testing: configure live app targets and inspect UI/API failure bundles for agents and PRs
  • Agent Task Bundles: hand deterministic evidence to Codex, Claude Code, Cursor, Pi, OpenCode, or desktop agents
  • MCP Server: expose CodeDecay as a local MCP tool for agent clients
  • Release Policy: understand the current compatibility contract before wiring CodeDecay into CI

For Humans ​

  • Use the sidebar and local search to navigate product docs quickly.
  • Open Sample Reports to see the actual Markdown, JSON, and SARIF outputs before integrating CodeDecay.
  • Use the GitHub edit links to tighten docs in the same repo that ships the code.

For Agents ​

These endpoints are generated from the same source files as the docs site, so humans and agents read the same content instead of drifting copies.

Local-first docs for merge safety, redteam workflows, and agent handoff.

Apache-2.0