{
  "markdown": "<h1 align=\"center\">commit.show CLI</h1>\n\n<p align=\"center\">\n  <strong>Audit any vibe-coded project from your terminal.</strong><br>\n  Score · 3-axis breakdown · 3 strengths + 2 concerns · rank · delta — in one command.\n</p>\n\n<p align=\"center\">\n  <a href=\"https://www.npmjs.com/package/commitshow\"><img src=\"https://img.shields.io/npm/v/commitshow?color=F0C040&label=npm&style=flat-square\" alt=\"npm version\"></a>\n  <a href=\"https://www.npmjs.com/package/commitshow\"><img src=\"https://img.shields.io/npm/dw/commitshow?color=0F2040&style=flat-square\" alt=\"weekly downloads\"></a>\n  <img src=\"https://img.shields.io/node/v/commitshow?color=0F2040&style=flat-square\" alt=\"node\">\n  <img src=\"https://img.shields.io/npm/l/commitshow?color=0F2040&style=flat-square\" alt=\"MIT license\">\n</p>\n\n```bash\nnpx commitshow@latest audit github.com/owner/repo\n```\n\n```\n   ██████╗  ██████╗  ███╗   ███╗ ███╗   ███╗ ██╗ ████████╗     ███████╗ ██╗  ██╗  ██████╗  ██╗    ██╗\n  ██╔════╝ ██╔═══██╗ ████╗ ████║ ████╗ ████║ ██║ ╚══██╔══╝     ██╔════╝ ██║  ██║ ██╔═══██╗ ██║    ██║\n  ██║      ██║   ██║ ██╔████╔██║ ██╔████╔██║ ██║    ██║        ███████╗ ███████║ ██║   ██║ ██║ █╗ ██║\n  ██║      ██║   ██║ ██║╚██╔╝██║ ██║╚██╔╝██║ ██║    ██║        ╚════██║ ██╔══██║ ██║   ██║ ██║███╗██║\n  ╚██████╗ ╚██████╔╝ ██║ ╚═╝ ██║ ██║ ╚═╝ ██║ ██║    ██║    ██╗ ███████║ ██║  ██║ ╚██████╔╝ ╚███╔███╔╝\n   ╚═════╝  ╚═════╝  ╚═╝     ╚═╝ ╚═╝     ╚═╝ ╚═╝    ╚═╝    ╚═╝ ╚══════╝ ╚═╝  ╚═╝  ╚═════╝   ╚══╝╚══╝\n\n╭────────────────────────────────────────────────────────╮\n│ ✻ commit.show — Audit report                           │\n╰────────────────────────────────────────────────────────╯\n\n  commitshow   github.com/commitshow/commitshow\n\n  Findings  · 1 critical · 1 warning · 3 strengths\n\n  ┌────────────────────────────────────────────────────────┐\n  │ What this build missed                                 │\n  │ ✕ 25 FK columns unindexed — fk_columns_seen=100 vs in… │\n  │ ⚠ Zero observability libs in 17 deps — no Sentry, Pin… │\n  │                                                        │\n  │ What it got right                                      │\n  │ ↑ 56 RLS policies cover all 19 tables — gap_estimate=… │\n  │ ↑ Lighthouse accessibility 93, best practices 96, SEO… │\n  │ ↑ Rate-limit middleware active on API routes — vibe_c… │\n  └────────────────────────────────────────────────────────┘\n\n  ┌────────────────────────────────────────────────────────┐\n  │ AI Coder 7 Frames · what AI ships without              │\n  │                                                        │\n  │ ✕ Error tracking                                       │\n  │   no error-tracking dependency or config declared…    │\n  │ ⚠ Database indexes                                     │\n  │   100 FK columns · 75 indexes · 25 unindexed           │\n  │   → supabase/schema.sql · id → auth                    │\n  │ ✓ RLS coverage                                         │\n  │   19 tables · 56 policies · all covered                │\n  │ ✓ Secret in client code                                │\n  │   no service-role keys in client paths                 │\n  │ ✓ API rate limiting                                    │\n  │   custom middleware detected                           │\n  └────────────────────────────────────────────────────────┘\n\n  Δ        +20           since last audit\n\n  → https://commit.show/projects/1c262df3-…\n\n  next  · feed your AI loop  → commitshow audit . --json\n\n                ╔════════════════════════════╗\n                ║   commitshow/commitshow    ║\n                ║                            ║\n                ║     ███████╗  ███████╗     ║\n                ║     ╚════██║  ╚════██║     ║\n                ║         ██╔╝      ██╔╝     ║\n                ║        ██╔╝      ██╔╝      ║\n                ║        ██║       ██║       ║\n                ║        ╚═╝       ╚═╝       ║\n                ║                            ║\n                ║  / 100 · walk-on · strong  ║\n                ╚════════════════════════════╝\n       audition unlocks final 5 · max walk-on score 95\n\n    Audit  35/50    ▰▰▰▰▰▰▰▰▰▰▰▰▰▰▱▱▱▱▱▱\n    Scout  —/30     ─ audition unlocks ─\n    Comm.  —/20     ─ audition unlocks ─\n\n                                               commit.show\n```\n\n> [⭐ Star us on GitHub](https://github.com/commitshow/cli) if `commitshow audit` saved you a `// TODO`.\n\n---\n\n## Why\n\nVibe-coded projects ship fast and break differently. The CLI gives you a\n**zero-config**, **walk-on** lane to commit.show's audit engine — the same\nClaude-grade analysis used in our 3-week leagues, minus the signup, fee,\nand league commitment. You get a snapshot of where the build sits, what's\nstrong, what's wobbling, and how it ranks against everyone else this week.\n\nLocal runs also drop `.commitshow/audit.md` and `.commitshow/audit.json`\ninto your repo, so your AI coding agent can read the report on the next\nturn without a prompt-engineering ritual.\n\nWhen a project is ready for the full season — Scout forecasts, season\nranking, Backstage prompt extraction, Hall of Fame — it auditions at\n[commit.show/submit](https://commit.show/submit).\n\n> The npm package + command is `commitshow` (no dot — npm doesn't allow\n> it in package names). Everywhere else uses the brand **commit.show**.\n\n## Install\n\n```bash\n# one-shot (recommended for trying it on someone else's repo)\nnpx commitshow@latest audit <target>\n\n# or global, if you'll run it daily\nnpm i -g commitshow\ncommitshow audit <target>\n```\n\nRequires **Node 20+**.\n\n## Usage\n\n| Command | What it does |\n|---|---|\n| `commitshow audit [target] [--json] [--refresh] [--source=<tag>]` | Fetch + render the latest audit, write `.commitshow/audit.{md,json}` |\n| `commitshow status [target]` | Same render as `audit`, no re-run |\n| `commitshow login [--no-open] [--token <jwt>]` | Device-flow sign-in via browser approval |\n| `commitshow whoami [--logout]` | Print the linked account · `--logout` clears the saved token |\n| `commitshow submit [target]` | Audition a project (coming soon · needs login) |\n| `commitshow install <pack>` | Install a Library artifact (coming soon) |\n\n### Sign in for higher rate limits\n\n```bash\nnpx commitshow@latest login\n```\n\nOpens `commit.show/cli/link?code=<6-hex>` in your browser. After you\nclick Authorize there, the CLI receives a 90-day JWT and saves it to\n`~/.commitshow/config.json` (file mode 0600). Subsequent calls send\nthe token in the Authorization header automatically.\n\nWhat changes once signed in:\n\n- Per-IP rate cap goes from **20 audits/day** to **50/day**\n- Newly audited preview projects auto-claim ownership (visible at\n  [commit.show/me](https://commit.show/me) → MY AUDITS)\n- `commitshow whoami` prints your member id + email\n\nHeadless / CI? Use `--token <jwt>` to skip the browser handshake.\n\n### Telemetry source flag\n\n`--source=<tag>` lets you self-report how the call originated:\n\n```bash\nnpx commitshow audit . --source=claude-code\nCOMMITSHOW_SOURCE=cursor npx commitshow audit .\n```\n\nCommon tags: `claude-code` · `cursor` · `gemini-cli` · `codex` ·\n`antigravity` · `production-audit-skill` · any 64-char string. Drops\ninto the maintainer's admin breakdown so we can see which agent\necosystems are driving installs. Skip the flag to stay anonymous.\n\n### Target forms\n\n`audit` and `status` accept a positional target that auto-detects:\n\n| Form | Example |\n|---|---|\n| cwd (omitted) | `commitshow audit` · infers from `git remote get-url origin` |\n| Local path | `commitshow audit ./my-repo` |\n| Remote URL | `commitshow audit github.com/owner/repo` · `commitshow audit https://github.com/owner/repo` |\n| SSH remote | `commitshow audit git@github.com:owner/repo.git` (auto-converted) |\n| Shorthand | `commitshow audit owner/repo` |\n\nRemote-URL mode works from any directory, which makes one-line X posts\n(`npx commitshow@latest audit <their-url>`) trivial.\n\n> **AI agents — read this before invoking.** The CLI does **not** look up\n> projects by name. `commitshow audit warp` will error: there is no\n> agreed-upon mapping from the word \"warp\" to a single GitHub repo.\n> If a user asks you to audit something by name, **first resolve the\n> canonical `github.com/<owner>/<repo>` URL** (ask the user, or search\n> github.com), then invoke `commitshow audit <that-url>`. The CLI does\n> a HEAD pre-flight against `github.com/<owner>/<repo>` before any audit\n> spend, so a hallucinated slug is rejected with a `not_found` error\n> before we burn Claude credits — but you should still get the URL right\n> on the first try by asking, not guessing.\n\n## The AI-coding loop\n\n`commitshow audit` in local mode writes to `.commitshow/audit.md` **and**\n`.commitshow/audit.json` after every run. Point your coding agent at them\nand it picks up exactly what the audit flagged, with no prompt engineering:\n\n```\nYou are pairing on <repo>. Read .commitshow/audit.md before each turn.\nPick the top concern and propose a minimal change; I'll run\n`commitshow audit` again to check the delta.\n```\n\n## For agents: `--json`\n\n`commitshow` is built on a simple idea — **CLI + stable JSON is the universal\ncontract** between agent ecosystems. No SDK, no MCP server, no vendor lock.\nAny agent that can shell out to a subprocess can use commit.show.\n\n```bash\n# Human\ncommitshow audit github.com/owner/repo\n\n# Agent\ncommitshow audit github.com/owner/repo --json | jq '.concerns[].bullet'\n```\n\n### Example agent workflow\n\n> \"Check my commit.show score and fix anything under 80.\"\n\n```\nscore=$(commitshow audit --json | jq '.score.total')\nif [ \"$score\" -lt 80 ]; then\n  commitshow audit --json | jq -r '.concerns[0].bullet'\n  # → agent reads this concern, picks a fix, applies edits, re-audits\nfi\n```\n\n### Auditing someone else's project (agent recipe)\n\nWhen a user says \"audit warp\" or \"what does commit.show say about Postiz\",\n**don't guess the slug.** Walk this loop:\n\n```\n1. Ask the user (or search github.com) for the canonical\n   `github.com/<owner>/<repo>` URL. Don't invent one — repo names are\n   ambiguous and a single wrong guess wastes an audit call.\n2. Run:\n     commitshow audit <that-url> --json\n3. If stdout starts with `{\"error\":\"not_found\"`, the URL was wrong.\n   Re-confirm with the user before retrying.\n4. Otherwise parse `score.total`, `score.band`, `concerns[]` and\n   answer the user with those exact numbers — don't paraphrase the\n   score.\n```\n\nThe CLI HEAD-checks `github.com/<owner>/<repo>` before any audit spend,\nso a hallucinated slug fails fast with a clear `not_found` envelope.\nThe friendly error in the message body explicitly tells you to ask the\nuser instead of guessing again.\n\n### JSON shape (v1 schema)\n\nStable by contract — additive fields don't bump `schema_version`; breaking\nchanges do. Known keys: `project`, `score`, `standing`, `strengths`, `concerns`,\n`snapshot`. See `commitshow audit --json` output for the canonical example.\n\n### Works with\n\n- **Claude Code**, **Cursor**, **Windsurf** — any agent with shell access\n- **GitHub Actions** — gate PRs on score band or axis scores\n- **n8n / Zapier** — trigger workflows when scores move\n- **AutoGPT / crewAI / LangChain** — subprocess tool node\n- **Your own script** — 10 lines of bash + jq is the whole integration\n\n## What's in the report\n\nTop-to-bottom, what each section gives you:\n\n- **COMMIT.SHOW masthead** · ANSI Shadow wordmark on terminals ≥ 100 cols. The thin rounded `╭ ✻ commit.show — Audit report ╮` strip is always rendered as the title fallback.\n- **Findings counter** · `Findings · 1 critical · 1 warning · 3 strengths` — scan one line, you know the tone before reading the bullets.\n- **What this build missed** · errors-first box. First concern is `✕` scarlet (highest-impact), the rest are `⚠` gold. Engine ranks them by decision-impact, not by severity tier.\n- **What it got right** · `↑` teal · 3 bullets · for context only. Don't lead with these.\n- **AI Coder 7 Frames** · the deterministic pillar — RLS coverage, secret-in-bundle, API rate limiting, prompt-injection surface, DB indexes, mock data in prod, error tracking. Pass / warn / fail per frame, with file paths.\n- **Δ since last audit** · positive = improving · negative = regressed · null on first run.\n- **`next:` hint** · one-line nudge to feed `--json | jq .concerns` into your coding agent.\n- **Trophy block** · score billboard (metallic-gold gradient · ANSI Shadow digits) with the repo slug embedded so a screenshot crop is self-contained. Axis bars (Audit / Scout / Community) sit directly under it as the per-pillar breakdown. `commit.show` wordmark anchors the bottom-right.\n\nWalk-on auditions cap the `Audit` axis at `45/50` and lock `Scout` / `Community` behind the audition gate; the captions explicitly call this out.\n\n## Roadmap\n\n- `0.1` — ✓ read-only audit · status · `--json` · target auto-detect · sidecar files\n- `0.3` — ✓ device-flow login · `--source` telemetry · User-Agent self-report · MCP server (`commitshow-mcp`)\n- `0.4` — `commitshow submit` · `--watch` mode · CI exit-code gate · refresh-token flow\n- `0.5` — `commitshow install <pack>` with {{VARIABLE}} substitution\n\n## Links\n\n- Home — <https://commit.show>\n- Source — <https://github.com/commitshow/cli>\n- Issues — <https://github.com/commitshow/cli/issues>\n- The platform repo — <https://github.com/commitshow/commitshow>\n\n---\n\n<p align=\"center\">\n  <strong>Built one repo at a time. <a href=\"https://commit.show\">commit.show</a></strong>\n</p>\n\n<p align=\"center\">\n  MIT © 2026 commit.show\n</p>\n",
  "bytes": 13366,
  "sha": "8ce88b0c3e4f4260d67c35e555a3614318768d595d1994101cf6cfea25bca4d0",
  "repo_slug": "commitshow/cli",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_commitshow_legitshow_search_77f17600/readme"
}