ai-project-bootstrap
v1.0.0
Signed out
Some pages show more once you sign in — your licence key, your usage, and what the subscription covers.
Getting started
What this isInstallationThe wizard, question by questionYour first project
Choosing a stack
Describing your idea (Pro)Licensing & open sourcePresetsArchetypesPreset or archetype?Cost estimation
Technology catalogue
Browse all 35 modulesCategories & selection rulesSupabase
CLI reference
generateaddimplementreviewanalyzeupgradedoctorGlobal flags & exit codes
The generated project
File-by-file contractAI rules per toolRegenerating safelyai-project.config.json
Contributing
Adding a technologyAdding an implement providerAdding an archetypeAdding pricing dataChanging the engine
Docs / CLI reference / review

review

A static, AI-oriented pass over an already-generated project, reported across four categories instead of raw linter output.

npx ai-project-bootstrap review
npx ai-project-bootstrap review --report
npx ai-project-bootstrap review --fail-on warning

What it checks

Category
Checks
Architecture
A folder a selected technology declares that no longer exists on disk
Security
.env present but not gitignored; a credential-shaped literal in src/, server/, app/ or api/; eslint-disable, @ts-ignore or @ts-nocheck comments
Performance
Pointers to the stack-specific rule file already generated for each technology — not pass/fail findings
DX
Generated files that would come out differently if regenerated with today's templates
Security
  ✖ .env exists but is not listed in .gitignore.
      .gitignore
      → Add ".env" to .gitignore immediately.
  ! eslint-disable suppresses a check instead of fixing the cause.
      src/lib/analytics.ts:12

What it does not do

This is pattern-based static analysis — grep-like checks, config validation, existence checks. Not a general-purpose static analyzer, and not an LLM call: the package has no AI-provider dependency. It will miss anything needing type information, control-flow analysis, or judgment about your domain. It does not modify anything; run upgrade to act on a DX finding.

Why performance findings are only pointers

Reliably checking re-renders, N+1 queries or bundle size needs runtime profiling or a bundler pass. Neither is something a static scan can honestly do, so it points at the rules instead of guessing.

Exit codes

Non-zero once any finding is at or above --fail-on's severity — critical, warning or info, defaulting to critical. Safe to wire into CI.

Previous
implement
Next
analyze
On this page
What it checksWhat it does not doExit codes
Source: README.md — Reviewing a project