{ "markdown": "\n\n

\n \"Cynical\n

\n\n

Cynical Sally

\n\n

\n Brutally honest code reviews. In your terminal and your AI editor.
\n Because \"You're absolutely right\" is probably absolutely wrong.
\n npm i -g @cynicalsally/cli · MCP server for Claude Code, Cursor & Windsurf\n

\n\n

\n \"Cynical\n \"Sally\n \"npm\n \"npm\n \"MCP\n \"Cursor\n \"Glama\n \"license\"\n

\n\n

\n \n \n \n \"Add\n \n \n

\n\n---\n\nYour AI pair programmer is lying to you. Sally isn't.\n\n

\n \"sally\n

\n\nShe's the senior engineer your code hoped it'd never meet. Scores from 0 to 10, real issues backed by evidence, and fixes you can actually use.\n\nWorks as a CLI tool and as an MCP server in [Claude Code](https://claude.ai/claude-code), [Cursor](https://cursor.com), and [Windsurf](https://windsurf.com).\n\n

\n \"Sally\n \"Sally\n

\n\n## Install\n\n```bash\nnpm install -g @cynicalsally/cli\n```\n\nOr run without installing:\n\n```bash\nnpx @cynicalsally/cli roast ./src/\n```\n\n**Requirements:** Node.js 18+\n\n## See exactly what leaves your machine\n\nSending code to a server you don't control deserves more than \"trust me.\" So Sally lets you **verify it instead**:\n\n```bash\nsally roast --dry-run ./src/\n```\n\n`--dry-run` collects everything *as if* it were about to roast — then sends **nothing**. Instead it prints the exact payload: every file path, byte size, and token estimate; which files were held back and **why** (`.env`, keys, certs, binaries, `.gitignore` matches, size limits); and writes a local **SHA-256 receipt** to `.sally/` so you can verify byte-for-byte what *would* have been uploaded.\n\n```text\nWOULD SEND 3 files · 91 B · ~24 tokens (est.)\n src/app.ts 36 B ~9 tok 68a3be428746…\n\nHELD BACK 2 items — kept on your machine\n ✖ secret (2) — looks like a secret — never leaves your machine\n .env\n server.key\n```\n\nSecret files (`.env`, SSH keys, certs, credential files) are skipped **on your machine before anything is sent** — verify it yourself with `--dry-run`. Only review code you're allowed to upload. Local reports land in `.sally/` — add it to your `.gitignore`:\n\n```gitignore\n.sally/\n```\n\nSee [Privacy & Security](#privacy--security) below for the full data-flow.\n\n## Quick Start\n\n```bash\n# Sally auto-detects what to review\nsally roast\n# → staged changes? reviews those\n# → unstaged changes? reviews those\n# → recent commit? reviews that\n# → nothing? scans the directory\n\n# Roast a file or directory\nsally roast src/utils/auth.ts\nsally roast ./src/\n\n# Roast staged changes before you commit\nsally roast --staged\n\n# Compare your branch against main\nsally roast --diff main\n\n# Deep analysis with issues + actionable fixes\nsally roast ./src/ -m full_truth\n\n# Run deep analysis in the background (OS notification when done)\nsally roast ./src/ -m full_truth --bg\n\n# See exactly what would be sent — and send nothing\nsally roast --dry-run ./src/\n\n# Get a shareable roast card (saved to .sally/)\nsally roast ./src/ --card\n\n# Publish a share link — only the score + sneer go public, never your code\nsally roast ./src/ --share\n```\n\n## Roast Options\n\n```\nsally roast [paths...] [options]\n\n --staged Review only staged git changes\n --diff Compare against another branch (e.g., main)\n -m, --mode \"quick\" (default) or \"full_truth\" (deep dive)\n --tone \"cynical\" (default), \"neutral\", or \"professional\"\n --lang Response language code (default: \"en\")\n --json Output raw JSON (for piping or scripting)\n --fail-under Exit code 1 if quality score is below threshold\n --ci CI mode: compact output, exit codes\n --bg Run Full Truth in background, get OS notification when done\n --dry-run Print the exact payload (files, sizes, tokens, SHA-256) and send NOTHING\n --card Print + save a shareable roast card after the review\n --share Create a public share link (cynicalsally.com/card/…) — score + sneer only, never code\n```\n\n## Get your repo's verdict — and a badge to prove it\n\nLet Sally judge your whole repo and hand you a README badge with the score baked in:\n\n```bash\nsally verdict\n```\n\nShe scores the repo, then prints ready-to-paste badge markdown:\n\n```markdown\n[![Cynical Sally Verdict](https://cynicalsally.com/api/v1/badge/repo/you/repo)](https://cynicalsally.com)\n```\n\nScore an 8 or higher and the badge is a flex worth wearing. Score lower and, well —\nit's an honest signal that you're shipping anyway. Either way the badge links back,\nso every README that wears it does the bragging for you.\n\nToo lazy to copy-paste? Sally will hang it up herself:\n\n```bash\nsally badge --add # inserts the badge into README.md, right under the title\nsally badge # just prints the markdown (and your current score)\n```\n\nThe badge image updates automatically on every new `sally verdict` — add it once,\njudged forever.\n\n---\n\n

Sally's Full Suite

\n\n

\n Six tools, three jobs. The most honest code reviewer you'll ever work with — in your terminal and your AI editor.\n

\n\n

\n \"Sally's\n

\n\n

\n Ship faster — review-pr + refactor · \n Be less embarrassing — explain + brainstorm · \n Polish for humans — frontend + marketing\n

\n\n---\n\n### Explain\n\n\"sally\n\nSally reads the spaghetti someone left in your codebase and translates it into plain English. Just the cold, clear truth of what it actually does.\n\n```bash\nsally explain src/utils/auth.ts\n\n# Pipe code directly\ncat legacy-module.js | sally explain\n\n# Explain the current directory\nsally explain\n```\n\n
\n\n---\n\n### Refactor\n\n\"sally\n\nBefore and after, side by side. Sally explains why one of them is going to haunt your 3am on-call rotation.\n\n```bash\nsally refactor src/components/Dashboard.tsx\n\n# Refactor current directory\nsally refactor\n```\n\n
\n\n---\n\n### PR Review\n\n\"sally\n\nSally reviews your PR like a senior engineer who has time, opinions, and absolutely no reason to be polite.\n\n```bash\n# Review PR #42 (requires GitHub CLI)\nsally review-pr 42\n\n# Review current branch vs main\nsally review-pr\n\n# Pipe a diff\ngit diff main | sally review-pr\n```\n\n
\n\n---\n\n### Brainstorm\n\n\"sally\n\nPitch your architecture idea and Sally tells you the three ways it falls apart at scale. Cheaper than a post-mortem.\n\n```bash\nsally brainstorm \"Microservices for a 2-person team?\"\n\n# Brainstorm about the current project\nsally brainstorm\n```\n\n
\n\n---\n\n### Frontend Review\n\n\"sally\n\nSally tells you why your component re-renders on every keystroke and why your z-index is load-bearing.\n\n```bash\nsally frontend src/components/Header.tsx\n\n# Review all frontend code in a directory\nsally frontend ./src/\n```\n\n
\n\n---\n\n### Marketing Review\n\n\"sally\n\nRun your copy by Sally before your customers do. They won't be this constructive about it.\n\n```bash\nsally marketing \"Ship faster with AI-powered code reviews\"\n\n# Review your README and landing page copy\nsally marketing README.md\n```\n\n
\n\n---\n\nEvery tool accepts **file paths**, **raw text**, or **piped stdin**. Each includes **1 free trial**, no account needed.\n\n## CI/CD Integration\n\nGate your pipeline on code quality:\n\n```yaml\n# GitHub Actions\n- name: Sally Code Review\n run: npx @cynicalsally/cli roast ./src/ --fail-under=5 --ci\n```\n\n`--ci` gives compact output with exit codes. `--fail-under` fails the build when the score drops below your threshold. Add `--json` for machine-readable output.\n\n## MCP Server\n\nSally works as an MCP server inside **Claude Code**, **Cursor**, and **Windsurf**.\n\n\"Cynical\n\n### Claude Code\n\n```bash\nclaude mcp add cynical-sally -- npx @cynicalsally/cli mcp\n```\n\n### Cursor\n\nOne click:\n\n\n \n \n \"Add\n \n\n\nOr add to `~/.cursor/mcp.json` (global) or `.cursor/mcp.json` (per project):\n\n```json\n{\n \"mcpServers\": {\n \"cynical-sally\": {\n \"command\": \"npx\",\n \"args\": [\"@cynicalsally/cli\", \"mcp\"]\n }\n }\n}\n```\n\n### Windsurf\n\nAdd to `~/.codeium/windsurf/mcp_config.json`:\n\n```json\n{\n \"mcpServers\": {\n \"cynical-sally\": {\n \"command\": \"npx\",\n \"args\": [\"@cynicalsally/cli\", \"mcp\"]\n }\n }\n}\n```\n\n### Available tools\n\n| MCP Tool | What it does |\n|----------|-------------|\n| `sally_roast` | Code review with score, issues, and fixes |\n| `sally_explain` | Explain code with Sally's personality |\n| `sally_review_pr` | Review PR diffs |\n| `sally_refactor` | Refactoring suggestions with before/after |\n| `sally_brainstorm` | Feedback on ideas and approaches |\n| `sally_frontend` | Frontend/UI code review |\n| `sally_marketing` | Marketing copy review |\n| `sally_usage` | Check quota and account status |\n\n**Roast by path** — the agent can call `sally_roast` with just `paths` (files or directories); Sally reads them locally and skips binaries and secret files, so the agent doesn't have to read and pass content itself.\n\n**Prompts** — Sally also exposes ready-made slash-command intents (`roast`, `review-pr`, `explain`) in clients that surface MCP prompts.\n\nRun `sally mcp` in your terminal to see setup instructions.\n\n## All Commands\n\n| Command | Description |\n|---------|-------------|\n| `sally roast [paths...]` | Review files, directories, or git changes |\n| `sally verdict` | Score your repo + get a README badge |\n| `sally badge [--add]` | Print your badge markdown, or add it to README.md |\n| `sally explain [file]` | Explain what code actually does |\n| `sally refactor [file]` | Refactoring with before/after code |\n| `sally review-pr [pr]` | Review a PR diff |\n| `sally brainstorm \"idea\"` | Feedback on ideas and approaches |\n| `sally frontend [file]` | Frontend/UI code review |\n| `sally marketing \"copy\"` | Marketing copy review |\n| `sally login ` | Log in via magic link |\n| `sally logout` | Clear stored session |\n| `sally usage` | Check your quota and account status |\n| `sally upgrade` | Upgrade to Sally's Full Suite |\n| `sally results` | View background review results |\n| `sally mcp` | MCP server setup instructions |\n\n## Free to Use\n\n90 free roasts per month, no account needed. Every premium tool includes a free trial.\n\n```bash\nsally usage # Check your quota\nsally upgrade # Unlock the Full Suite\n```\n\n## Privacy & Security\n\nYour code is yours. Don't take our word for it — run `sally roast --dry-run` and see the exact payload before anything is sent. Here's what happens to it:\n\n- **Verify before you send.** `--dry-run` prints every file, size, token estimate, and a SHA-256 receipt of exactly what *would* be uploaded — and sends nothing. The MCP `sally_roast` tool has the same `preview` mode.\n- **Sent only to be reviewed.** The files you choose are transmitted over HTTPS and processed in real-time to generate the review — that's the only reason they leave your machine.\n- **Never written to disk, logs, or analytics.** Your source code is processed in memory and discarded after analysis. It is never persisted to a database, never written to application logs or error traces, and never sent to any third-party APM or analytics. We keep the review (score, issues), not your source.\n- **Never trained on, sold, or shared.** Analysis runs through Anthropic's API, which doesn't train on submitted content.\n- **Only what you point at.** Sally doesn't browse your repo, read files you didn't give her, or scan your projects or plans. Secret files (`.env`, keys, certs, credential files) are skipped on your machine *before anything is sent* — and `--dry-run` shows you exactly which ones.\n- **Sharing is opt-in, and never includes code.** Nothing is ever published unless you pass `--share` — and even then the public card contains only the score and Sally's one-liner.\n- **Anonymous by default.** Reviews are tied to a random device ID, not your identity — until you link an email for Full Suite. Config stored locally at `~/.sally/config.json`.\n- **Signed releases.** npm packages are published with [provenance](https://docs.npmjs.com/generating-provenance-statements) — a cryptographic, public attestation linking each release to the exact source commit and CI build that produced it.\n\nFull engineering detail — data-flow diagram, what's retained, subprocessors, and log policy — is in [docs/PRIVACY.md](docs/PRIVACY.md). User-facing summary: [cynicalsally.com/privacy](https://cynicalsally.com/privacy).\n\n## Contributing\n\nFound a bug or have a feature idea? [Open an issue](https://github.com/w1ckedxt/cynical-sally/issues). Sally promises to only judge your issue title a little.\n\n## License\n\n[MIT](LICENSE)\n\n---\n\n

\n cynicalsally.com · npm · issues\n

\n", "bytes": 16147, "sha": "08932514ae3ecbc11bd7ca81a736ca1d6f2e2c24c1e49245f6abb3e161a1c389", "repo_slug": "w1ckedxt/cynical-sally", "fonte": "repo", "truncated": false, "api": "https://agentalog.com/api/listings/mcp_io_github_w1ckedxt_cynicalsally_7a9cce38/readme" }