Repo Anti-Rot

A repository health & decay monitor. It scans a codebase for the kinds of rot that accumulate silently — undocumented env vars, abandoned & vulnerable dependencies, stale branches, aging TODOs, committed secrets, dead & commented-out code, disabled tests, and binary bloat — scores it A–F, and shows everything in a dashboard. An optional AI pass adds recommendations and verification steps via OpenRouter.

Try it

npx repo-janitor scan .

No clone, no install, no signup — a grade and a ranked list of findings for the repo you're standing in. --format json|md|sarif and --output <file> if you want it in a file or in CI. Add --fix to print the top quick-wins first.

Put a card on your README

1. Open repo-anti-rot.onrender.com, scan the public repo, create a share link (consent → Create link).
2. Copy the markdown from the Share dialog — or paste these templates and replace the placeholders:

Large card (github-readme-stats size):

[![Repo Anti-Rot](https://repo-anti-rot.onrender.com/api/card/<owner>/<name>?token=<token>)](https://repo-anti-rot.onrender.com/r/<owner>/<name>/<token>)

Small badge (title-line strip):

[![Repo Anti-Rot](https://repo-anti-rot.onrender.com/api/badge/<owner>/<name>?token=<token>)](https://repo-anti-rot.onrender.com/r/<owner>/<name>/<token>)

Two optional query params: theme=light for a light README, and motion=off to stop the drifting background shapes. There used to be five more — layout switches for the card and the badge — and they are gone: a picture with one good layout does not need a control panel, and the panel was competing for attention with the snippet people actually came for.

The badge and the card both draw faint grey shapes that drift behind the text — small and sparse on the badge, larger and slower on the card. The card's background colour is seeded the same way: the hue identifies the repository and the saturation follows the grade, so an A is quietly tinted and an F is drained to near grey. Every project looks a little different and any one project always looks the same. prefers-reduced-motion is honoured when the SVG is opened on its own, but browsers do not pass that preference into an image embedded in a page — which is how a README shows it — so ?motion=off is the reliable way to turn the movement off.

Website embed (not GitHub — READMEs strip iframes):

<iframe
  src="https://repo-anti-rot.onrender.com/embed/<owner>/<name>/<token>"
  title="Repo Anti-Rot"
  width="420"
  height="228"
  style="border:0;border-radius:12px;overflow:hidden;background:transparent"
  loading="lazy"
></iframe>

Create the snippets on the deployed site (not localhost) and keep Supabase configured so the share token survives redeploys. Re-scanning from the same browser refreshes the snapshot — the README URL stays put.

Everything below is for working on Repo Anti-Rot itself.

Structure

This is a monorepo:

Path	Package	Role
packages/core	@repo-anti-rot/core	Scanner engine, scoring, report schema, reporters
packages/cli	repo-janitor	repo-janitor CLI — clones/scans a repo, emits a report (published to npm)
packages/action	@repo-anti-rot/action	GitHub Action wrapper around the CLI
app/, components/, lib/	—	Next.js dashboard (App Router)

The dashboard's /api/scan route shells out to the built CLI (packages/cli/dist/index.js) to clone and scan repositories.

Prerequisites

• Node.js 22+ (uses the built-in global fetch)
• pnpm (the repo is a pnpm workspace) — or just run corepack enable and the pinned version (packageManager in package.json) is provisioned automatically
• git on PATH (used by the scan engine and by the dashboard to clone repos)

Works the same on macOS, Linux and Windows — every command below is a portable pnpm/node invocation (no shell-specific syntax), the engine shells out to git/node directly (no .cmd/.sh wrappers), and all paths go through Node's path/os.tmpdir() so separators and temp dirs are handled per-OS.

Setup

For a Windows mini-server with Docker, a domain, persistent storage and automatic maintenance, see Self-hosting. Run pnpm setup:server to create a private .env.local without overwriting existing settings. Для переноса на Windows-сервер с доменом repo-janitor.app: инструкция на русском.

The product review records positioning, implemented improvements and remaining work. The standalone auditscout tools are not part of the dashboard or its Docker image.

Important: packages/*/dist is git-ignored, so the compiled CLI is not in the repo. After cloning you must build it once — otherwise the dashboard's "New scan" / "Rescan" buttons will fail with "scan failed" because packages/cli/dist/index.js doesn't exist yet.

The one exception is packages/action/dist/index.cjs, which is committed: a GitHub Action runs straight from the tagged ref with no install step, so the bundle has to be in the repository or uses: resolves to a missing file. CI rebuilds it and fails if the committed copy has drifted from the source.

This is the beginning of the README. Read the rest at the original. Read the full README ↗