agentscan

About agentscan

agentscan is a local command-line linter for agent configuration. 2.0.0 ships 143 checks. It reads skills, skills-lock.json, hooks, MCP server configs, agent definitions, and instruction files such as AGENTS.md, then reports where the config disagrees with the disk.

What 2.0.0 reads

  • Codex: .codex/hooks.json and [hooks] in config.toml, and the same files under --global.
  • Antigravity: rules, skills, and hooks. url is an alias of serverUrl.
  • Cursor: ~/.cursor/hooks.json and ~/.cursor/mcp.json under --global.
  • Gemini: hooks in .gemini/settings.json and in the user file under --global.
  • Kiro: hooks, skills, and agents. SessionEnd, PreCompact, and PostCompact are triggers.
  • Devin CLI: hooks, MCP, and skills, beside the Windsurf contract.
  • Copilot: user mcp-config.json under --global.
  • Cline, Roo, Kilo, and Junie skill directories.
  • VS Code: .github/agents/*.agent.md frontmatter hooks.
  • Claude: user hooks, MCP, and agents under --global. CLAUDE_CONFIG_DIR also moves ~/.claude.json.
  • Every finding carries provenance.

Still unread: Cline hooks and agents, ~/.cursor/skills/, OpenCode's global config, ~/.continue/config.yaml, Windsurf auto-generated memories, Copilot policy hooks, and plugin hooks.json. .claude/settings.json stays Claude. Antigravity httpUrl does not launch a server. Kiro agents are inventory only and add no rule id.

It exists for a specific failure: a hook still registered after its script was deleted. The agent starts. Nothing in the editor, the runtime, or a normal test suite tells you the guard is gone. agentscan compares the config to the filesystem and prints the miss as claude.hook.missing-script at error.

The product is the published npm package @chimix/agentscan (the bare name was rejected as too close to an unrelated package). The command you type is agentscan. Run it with npx @chimix/agentscan@latest on Node 20.11+ or Bun. Scans are read-only: they do not write the tree they scan and they do not open a network connection.

An earlier build reported 37 findings across 17 real projects of which 25 were false, because two checks were written from what projects happened to look like instead of from a published spec line. Those checks were deleted. Spec-required checks now cite a line in docs/spec/. Heuristics stay at info and are labeled. 1.0.0 was the first stable release. 2.0.0 ships 143 checks. 2.0.0 accepts only printed rule ids in ignoreRules, ignoreFindings, and explain. thresholds.skillDescriptionBytes and thresholds.skills are rejected; the listing budget is thresholds.skillListingChars.

This website is the public marketing and docs surface for that CLI. It is not a hosted scanner, not a SaaS dashboard, and not a different company's product. There is no account system on this origin.

Source: https://github.com/SimaAlexandru99/agentscan. License: MIT. Read the docs.