Docs / CLI reference / analyze
analyze
review needs ai-project.config.json to know the stack. analyze does not — it works against any repository, inferring the stack from dependencies and config files.
npx ai-project-bootstrap analyze
npx ai-project-bootstrap analyze --dir ../someone-elses-repo
npx ai-project-bootstrap analyze --report
Detection is a guess, and says so
high
An exact package.json dependency match against a module's own dependencies.json
medium
Only a config file's presence — requirements.txt says 'some Python framework', not which
never used
A package name declared by more than one module. react alone cannot tell Next.js, Vite and React Native apart, so it is excluded entirely rather than guessed at
Scoring rubric
Category
Points out of 100
Architecture
A recognised source directory (30) · tests present (30) · a lint config (20) · a build script plus a test or lint script (20)
Security
Starts at 100. −25 per hardcoded-looking credential · −30 for an ungitignored .env · −5 per lint suppression, capped at −20 · −10 for no .gitignore
Performance
.gitignore excludes node_modules (30) · a recognised bundler config (40) · no committed image over 1MB (30)
Documentation
README.md (40) · CONTRIBUTING.md (20) · a LICENSE (15) · a docs/ directory with markdown (15) · package.json description filled in (10)
An honest limitation
Architecture and documentation scoring is JS/TS-shaped throughout. A Python or Go repo will score low on 'source directory' and 'lint config' regardless of how well organised it actually is.
What it excludes
Dependency-vulnerability scanning needs a live registry lookup, and this command stays fully offline — run npm audit yourself. There is no auto-fixing: analyze reports, the same boundary review draws. If the target has an ai-project.config.json it says so and points at review, but still runs its own generic pass rather than refusing.