Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.
2026-11-14
ดาว
—
เครื่องมือ
—
อัปไทม์
—
Illustrative output for a fictional project. The gate fails (exit code 1) on findings in changed files. Findings that existed before the change are excluded.
fallow builds a repository graph of modules, exports, dependencies, functions, and styling tokens. Its analyses use that graph to find complexity, architecture drift, duplication, unused code, and risks in a pull request.
fallow runs in four places. All four read the same config file and use the same analysis engine.
Mutation testing: small changes in the source that no test detects (opt-in, runs the project tests)
fallow mutation
Which code paths are risky?
Security candidates, ranked by reachability from entry points (opt-in)
fallow security
Which functions do the same job?
Functions with the same intent and different syntax (opt-in, uses a local model that you download once)
fallow similar-code
Where are the feature flags?
Feature-flag patterns across the codebase
fallow flags
npx fallow viz opens an interactive HTML map of the project with lenses for health, duplication, architecture, and unused code.
Add --type-aware for exact TypeScript symbol identity across aliases, re-exports, and packages. This optional pass removes false positives from interfaces and base classes (how type-aware analysis works). Runtime coverage from production is an optional add-on that fallow merges into health and audit reports.
The CLI reference lists every command. fallow schema prints all commands, flags, output formats, and exit codes as JSON.
Why teams can depend on fallow
fallow keeps these properties from release to release:
The same input gives the same output, with a stable fingerprint for each finding. There is no AI inside the analyzer. Only the opt-in similar-code command uses a pinned local model.
fallow audit fails only on findings that a change introduces. Existing findings do not fail the check.
It is fast on large codebases. fallow finds the unused code in the next.js monorepo (20,558 files) in 2.95s. Measured on fallow 2.100.0. BENCHMARKS.md has the method and all results, and CodSpeed tracks performance on each change.
fallow reads npm, yarn, and pnpm workspaces, and --workspace <name> scopes a run to one package.
Over 100 built-in framework plugins find entry points and framework conventions, so the first run needs no config.
Each command has a typed JSON output, documented exit codes, and a published output schema.
Analysis runs on your machine or CI runner. Telemetry is opt-in (what fallow collects).
The analyzer is written in Rust and uses Oxc for syntactic analysis. Static analysis needs no TypeScript compiler and no Node.js runtime.
In your terminal
npx fallow # health, duplication, and unused code in one run
npx fallow audit # only the findings that your change introduces
npx fallow fix --dry-run # preview the auto-fixes, then run `npx fallow fix`
npx fallow health --score # health score with the largest deductions
npx fallow dead-code --trace src/api.ts:client # prove an export is unused before you delete it
To keep fallow in the project, install it as a dev dependency:
npm install --save-dev fallow
The npm package includes the fallow, fallow-lsp, and fallow-mcp launchers. For pnpm, yarn, cargo install fallow-cli, and Docker, see the installation guide.
To check each commit before it leaves your machine, install the managed pre-commit hook:
npx fallow hooks install --target git
Adopt fallow on an existing codebase
You do not have to fix every finding before you add fallow to CI.
Run npx fallow recommend. It detects the stack and proposes a config. It changes no files.
Use fallow audit in pull requests. It compares each pull request with its base branch and blocks only the findings that the pull request adds. It needs no baseline file.
For full runs of fallow, dead-code, dupes, or health, save a baseline once with npx fallow --save-baseline fallow-baseline.json. Pass --baseline fallow-baseline.json on each later run, so that only new findings fail.
Reduce the backlog when your team has time. fallow fix --dry-run shows the fixes and changes no files. fallow fix applies them.
If findings are caused by missing entry points or generated files, add the missing entry points and exclude the generated files in the config:
// fallow-ignore-file <issue-type> suppresses a whole file. JSDoc tags (@public, @internal) keep intentional library API quiet. npx fallow suppressions lists every suppression in the project.
fetch-depth: 0 is the recommended setup. A default shallow checkout also works for command: audit: the Action fetches the commits that it needs to find the merge base.
To start in report-only mode, add fail-on-issues: false. Remove it when the team is ready for a gate. With command: audit, a pull request fails only on findings that it introduces. Without command: audit, the Action runs the full pipeline, and any finding fails the job (fail-on-issues defaults to true). In a pull request, the Action scopes the analysis to the changed files, so its output can differ from a full local run.
The Action installs the fallow version that the project's package.json names. Pin an exact version there to use the same version in CI and on your machine. It can post a PR comment and inline review comments, and it can upload SARIF to GitHub Code Scanning. Other output formats are CodeClimate, GitHub annotations, and Markdown. The GitLab template URL names a release tag, because GitLab includes a file from a fixed ref. The CI guide covers inputs, permissions, and a staged rollout.
For a PR comment or review comments, give the job these permissions. id-token: write is optional: it lets the Action post as the fallow bot. Without it, the comments come from github-actions[bot].
Exit code 0 means no error-severity findings, or an audit result of pass or warn. Exit code 1 means error-severity findings, or an audit result of fail. In CI, exit code 1 fails the job, and that is the gate. The rule severity in the config (error, warn, off) sets which findings count. Exit code 2 means invalid input or an execution error. A script that reads the JSON output can treat 0 and 1 as a completed run, but must not hide exit code 2 with || true.
Exit code
Meaning
0
Clean, or audit result pass or warn
1
Findings, or audit result fail (a normal outcome)
2
Validation or runtime error (JSON error on stdout with --format json)
3
A requested resource is unavailable, for example when config --path finds no config
8
Security gate hit (fallow security --gate)
4 to 7, 10 to 13
Runtime coverage, license, network, and upload errors
With --format json, an error arrives on stdout as {"error": true, "message": "...", "exit_code": 2}, not as a stack trace.
fallow-lsp gives diagnostics, hover, code actions, and code lenses in any LSP editor. editors/ has setups for Zed and Neovim.
The Node API @fallow-cli/fallow-node exports detectDeadCode, detectCircularDependencies, detectBoundaryViolations, detectArchitecture, detectDuplication, detectSimilarCode, detectFeatureFlags, computeComplexity, and computeHealth. The package API reference has the options and return types.
fallow health --format badge > badge.svg writes a health badge for your README.
With coding agents
npx fallow agent install --dry-run # show the plan
npx fallow agent install # apply it
fallow agent install sets up the agents that it detects (Claude Code, Codex, and Cursor) in one pass. It writes an AGENTS.md task map, installs the fallow and fallow-setup skills, registers the MCP server, and adds a gate on git commit and git push. Run npx fallow agent status to see these changes. Run npx fallow agent uninstall to remove them.
npx fallow migrate converts knip, jscpd, and stylelint config into fallow config. The migration guides for knip and jscpd show each step.
Contributing
To report a missing framework plugin or a false positive, open an issue. CONTRIBUTING.md covers the development setup. docs/README.md is the entry point for maintainer documentation.
Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 fr
Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.
ตรวจสอบล่าสุดเมื่อ 2026-11-14 Codebase intelligence for TypeScript and JavaScript: health, complexity, duplication, architecture, styling drift, and unused code from one graph. CLI, LSP, and MCP server. Zero config for over 100 frameworks.