@submux/codedecay

CodeDecay CLI

Find what your coding agent missed before merge.

CodeDecay is an open-source, local-first CLI and GitHub Action for PR regression-risk analysis, maintainability decay detection, weak-test auditing, and agent handoff workflows.

It does not require telemetry, cloud services, API keys, LLMs, or model calls. Optional LLM, agent, memory, and tool integrations are user-owned and explicit.

Install

npm install -D @submux/codedecay

Run with:

npx codedecay --help
npx codedecay man analyze

Quickstart

npx codedecay analyze --format markdown
npx codedecay analyze --base main --head HEAD --format json
npx codedecay analyze --format sarif --output codedecay.sarif
npx codedecay redteam --base main --head HEAD --format markdown
npx codedecay agent --profile codex --base main --head HEAD --format markdown

Commands

Command	Purpose
codedecay analyze	Deterministic PR risk, impact, and decay report.
codedecay redteam	Merge-safety report with impact, weak-test proof, edge cases, skills, memory, and fix tasks.
codedecay agent	Task bundle for Codex, Claude Code, Cursor, Pi, OpenCode, desktop agents, or MCP clients.
codedecay config	Show normalized config.
codedecay memory	Show local repo memory.
codedecay execute	Run explicitly configured local checks and tool adapters.
codedecay differential	Compare configured base/head behavior probes.
codedecay mcp	Start the local MCP server.
codedecay help	Show root or per-command help.
codedecay man	Show a longer manual page for a command.
codedecay update	Print or apply the recommended upgrade command.
codedecay version	Print the installed CLI version.

Common flags:

--base <ref>
--head <ref>
--cwd <path>
--format json|markdown|sarif
--output <path>
--fail-on low|medium|high
--profile generic|codex|claude-code|cursor|pi|opencode|desktop

Utility examples:

codedecay help analyze
codedecay man update
codedecay version
codedecay update
codedecay update --apply

Reports are written to stdout by default. Relative --output paths resolve from the analysis working directory.

GitHub Action

- uses: SubmuxHQ/CodeDecay/packages/github-action@v0
  with:
    mode: redteam
    base: ${{ github.event.pull_request.base.sha }}
    head: ${{ github.event.pull_request.head.sha }}
    format: markdown
    fail-on: high

Safety

By default CodeDecay:

• does not send telemetry
• does not call hosted services
• does not require API keys
• does not call LLMs or models
• does not execute commands hidden from the user

Configured command execution requires explicit config and safety gates.

Links

• Repository: https://github.com/SubmuxHQ/CodeDecay
• Documentation: https://github.com/SubmuxHQ/CodeDecay#readme
• Issues: https://github.com/SubmuxHQ/CodeDecay/issues
• License: Apache-2.0