agentscan

Your agent config says the guard is on. The script is gone. Nothing told you.

Linters read the code your agent writes. This reads the agent itself — skills, hooks, MCP servers, lockfiles, and policy files.

npx @chimix/agentscan check

Read the docs GitHub

agentscan check

$ agentscan check
 
WARN    hook:PreToolUse:.claude/hooks/guard-destructive-bash.js
        rule:hook.missing-script
        PreToolUse hook points at a script that does not exist
        evidence: hook PreToolUse @ …/.claude/settings.json
 
Summary: 6 warn · 4 info hidden (--verbose) · score 40/100

How it works

No AI, no heuristics. Read the config, read the disk, compare. Same tree in, same findings out, every time.

No AI — structural checks only, against published specs.
No network — the scan never opens a socket.
Writes nothing — the scanned tree is left untouched.
Every check sourced to a published spec line in docs/spec/.

Why the tool looks like this

Alpha. An earlier build reported 37 findings across 17 real projects of which 25 were false — two checks had been written from what real projects looked like instead of from the spec. Both were deleted, and every check that survived is recorded in docs/spec/ with the URL it came from and the date it was read. That story is the reason this tool exists in its current shape.

Run it in 30 seconds

Point it at a project with agent config. On Node 20.11+ or Bun — the published bin is a single bundled file.

npx @chimix/agentscan check