{
  "markdown": "# cased\n\nStructured code audits for [Claude Code](https://docs.anthropic.com/en/docs/claude-code), Anthropic's agentic coding tool. Ask for an audit, get a report you'd hand to a VP of Engineering. Flow diagrams. Sparklines. Evidence inline. No stoplight charts.\n\n## What it produces\n\n```\nrecord/audits/2026-04-08-full-crate/\n├── recon.yaml        # structural model of the codebase\n├── findings.yaml     # structured findings (machine-readable)\n├── report.html       # interactive HTML report (the deliverable)\n└── assets/           # sparkline SVGs, generated at build time\n```\n\nThe HTML report is a single self-contained file. Open it in a browser. Present it in a meeting. The YAML files are the machine-readable layer for downstream tools, CI checks, and remediation tracking.\n\n## How it works\n\n```\n\"Run a cased audit on this repo\"\n```\n\nCased runs in four phases:\n\n1. **Recon** — maps the codebase: file tree, entry points, dependency graph, git churn, trust boundaries. Writes `recon.yaml`.\n2. **Analysis** — dispatches parallel agents against structured criteria. Each agent returns findings in a shared schema. Writes `findings.yaml`.\n3. **Verification** — a reviewer agent checks that evidence exists at cited locations and remediations are sound. Disputed findings get revised or removed before the report is built.\n4. **Assembly** — renders the verified findings into a single-file HTML report with highlighted evidence, flow diagrams, sparklines, and slide mode.\n\n### Parallel agents\n\nCased dispatches specialist agents based on what it finds in the codebase:\n\n**With a domain skill** (e.g., [crustoleum](https://github.com/claylo/crustoleum) for Rust):\n\n| Agent | What it evaluates |\n|-------|------------------|\n| Safety Auditor | Unsafe soundness, memory management |\n| API & Type Design | Ownership, lifetimes, trait design, idioms |\n| Error & Robustness | Error handling paths, panic risks |\n| Concurrency | Lock ordering, async/sync interactions |\n| Supply Chain & Deps | CVEs, FFI boundaries, dependency fitness |\n| Performance | Allocations, copying, monomorphization costs |\n\n**Without a domain skill** (any language):\n\n| Agent | What it evaluates |\n|-------|------------------|\n| Security | Injection, auth bypass, secrets, input validation |\n| Error Handling | Silent failures, crash risks, error context |\n| Code Quality | Complexity, duplication, dead code, test gaps |\n| Performance | Algorithmic complexity, resource leaks, hot paths |\n| API Design | Public surface consistency, naming, contracts |\n| Dependencies | Outdated versions, advisories, license risks |\n\nDomain skills go deeper — crustoleum brings 84 binary criteria across 13 surfaces. The generic agents cover the fundamentals for any codebase.\n\n## Design principles\n\nReports follow [Edward Tufte's](https://www.edwardtufte.com/) principles:\n\n- **Narratives, not lists.** Findings group into stories about attack surfaces — \"The Auth Surface,\" \"The Error Handling Surface\" — not numbered catalogs sorted by severity.\n- **Evidence inline.** Code appears with the finding. No appendices. The code is right there, with line numbers matching the source file.\n- **Density encodes severity.** Critical findings get more context. Notes get a sentence. Nothing looks the same weight.\n- **Sparklines over dashboards.** Twelve months of commit activity in a tiny SVG next to each finding. See the trend without leaving the story.\n\n## Installation\n\nCased is a Claude Code skill — a prompt-and-script package that Claude Code loads on demand.\n\n```sh\nnpx @anthropic-ai/claude-code-skill install claylo/cased\n```\n\nOr install manually:\n\n```sh\ngit clone https://github.com/claylo/cased.git\nln -s /path/to/cased/skills/cased ~/.claude/skills/cased\n```\n\nThe HTML report renderer ships pre-built in the skill directory. No build step required.\n\n## Multi-platform setup\n\nCased speaks Claude Code tool names by default (`Task`, `TodoWrite`, `Skill`, etc.). Other harnesses need the tool-mapping reference loaded before the skill dispatches subagents, or Phase 2 parallel dispatch silently collapses to sequential single-context analysis.\n\n### Claude Code\n\nNo setup. Tool names are native.\n\n### Codex\n\nEnable subagents in `~/.codex/config.toml`:\n\n```toml\n[features]\nmulti_agent = true\n```\n\nWithout this, `spawn_agent` is unavailable and Phase 2 degrades silently. Then add this line to your project's `AGENTS.md` so the tool mapping loads at session start rather than lazily on first dispatch:\n\n```markdown\nWhen invoking the cased skill, read its `references/codex-tools.md` before dispatching subagents.\n```\n\n### Other platforms\n\nNot yet. Gemini CLI and other harnesses can load the skill file, but\nwithout a tool-mapping adapter Phase 2 parallel dispatch degrades to\nsequential single-context analysis — a worse audit wearing the same\nname. Platform support lands when an adapter exists and the eval\nharness (`evals/`) verifies it, not before.\n\n## Usage\n\n### Full audit\n\n```\n\"Run a cased audit on this repo\"\n```\n\nCased will ask what to focus on: full repo, recent changes, or a specific area. If your request already specifies scope (\"audit the auth module\"), it skips the question.\n\n### Scoped audit\n\n```\n\"Audit the authentication module\"\n\"Review PR #42\"\n\"Evaluate the dependency tree\"\n```\n\n### After the audit\n\nReports live in `record/audits/YYYY-MM-DD-HH-scope-slug/`. Open `report.html` for the interactive version. The report includes:\n\n- **Slide mode** — press S to present findings one at a time\n- **Navigation** — click a finding in the nav bar to jump to it\n- **Flow diagrams** — visual process flows with findings pinned to steps\n- **Sparklines** — 12-month commit activity for each finding's file\n\n### Keeping GitHub language stats honest\n\nAudit reports are large generated HTML files. Check in more than one and\nGitHub's linguist will happily reclassify your Rust crate as an \"HTML\"\nproject. Add this to your repo's `.gitattributes`:\n\n```gitattributes\n# cased audits — generated artifacts: exclude from language stats,\n# collapse in PR diffs\nrecord/audits/**/report.html linguist-generated=true\nrecord/audits/**/findings.yaml linguist-generated=true\nrecord/audits/**/recon.yaml linguist-generated=true\nrecord/audits/**/README.md linguist-generated=true\nrecord/audits/**/CLAUDE.md linguist-generated=true\nrecord/audits/**/AGENTS.md linguist-generated=true\nrecord/audits/**/assets/*.svg linguist-generated=true\n```\n\n`linguist-generated` also collapses these files in pull request diffs —\nreviewers see \"generated file\" instead of 350KB of inline report HTML.\nThe `actions-taken.md` remediation ledger is deliberately absent from the\nlist: it's human-relevant history and belongs in diffs.\n\n### Remediation tracking\n\nAfter fixing findings, record what you did:\n\n```\n\"Let's resolve issues from the latest audit\"\n```\n\nCased appends entries to `actions-taken.md` in the audit directory. Each entry records the date, which findings it addresses, and the disposition: `fixed`, `mitigated`, `accepted`, `disputed`, or `deferred`.\n\n## Extending with domain skills\n\nDomain skills plug into the analysis phase. They bring rubrics, agents, and tool setups for a specific language.\n\n| Language | Skill | What it adds |\n|----------|-------|-------------|\n| Rust | [crustoleum](https://github.com/claylo/crustoleum) | 13 surfaces, 84 criteria, cargo tooling (clippy, audit, deny, geiger, miri, sanitizers) |\n\nTo add a domain skill, install it as a Claude Code skill. Cased detects it by looking for language markers (`Cargo.toml`, `package.json`, etc.) and loads the skill's rubric when it finds a match.\n\n## The findings schema\n\nAll agents produce output in the same format. The schema lives in `skills/cased/references/findings-schema.yaml.md` with a JSON Schema at `skills/cased/references/findings.schema.json`.\n\nKey fields per finding:\n\n| Field | What it is |\n|-------|-----------|\n| `slug` | Kebab-case identifier (`auth-token-no-expiry`) |\n| `concern` | `critical`, `significant`, `moderate`, `advisory`, or `note` |\n| `locations` | File path + `start_line` / `end_line` |\n| `evidence` | Verbatim source code — no added comments, no elisions |\n| `mechanism` | Why this is a problem |\n| `remediation` | How to fix it |\n| `temporal` | When introduced, last modified, 12-month commit sparkline |\n| `chains` | Which findings this enables or is enabled by |\n\nConcern levels are not severity ratings. They describe the *nature* of concern:\n\n| Level | Meaning |\n|-------|---------|\n| `critical` | Active exploitability or data loss path exists now |\n| `significant` | Meaningful risk under realistic conditions |\n| `moderate` | Defense-in-depth gap or robustness issue |\n| `advisory` | Design choice that limits future safety |\n| `note` | Observation worth recording, no action required |\n\n## Tone\n\nReports read like a knowledgeable colleague walking you through what they found. Not a compliance officer. Not an auditor filling a checklist. When a surface is solid, the report says so and moves on. An audit that invents concerns to fill space is wasting your time.\n\n## Development\n\nIf you're modifying the HTML report viewer, rebuild it from source:\n\n```sh\n# Requires Node.js and just (https://just.systems)\nnpm install\njust build-viewer\n```\n\nThis bundles the viewer JS and copies the built assets into `skills/cased/`.\n\n## License\n\nMIT. The shipped skill bundles inline source from third-party packages; their\nlicenses are reproduced in [`skills/cased/THIRD-PARTY-NOTICES.md`](skills/cased/THIRD-PARTY-NOTICES.md),\nregenerated on every `just build-viewer`.\n",
  "bytes": 9525,
  "sha": "e01dbb86496a02a771ec3ebd4712fa9162d40dae3c1972fad47c5e1e2d86a32b",
  "repo_slug": "claylo/cased",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/plg_claylo_cased_962a36c7/readme"
}