Open source · MIT
Your tests tell you the code works. They do not tell you it is the code you asked for.
The AI Code Quality Auditor scores what an agent actually shipped — its security exposure, its structure, and above all whether it stayed inside the specification it was given. It is free, it runs on your machine, and it publishes its findings about itself.
$ pip install ai-code-quality-auditor
$ auditor scan .
What it measures
Five metrics, one of which nobody else reports
Specification fidelity
Did it build what you asked for, and nothing else? Measured in two directions: things added that nobody requested, and the architecture being replaced outright.
Security density
CWE-tagged findings per thousand lines. Reported per language, because a scanner reads what it can read and pretending otherwise manufactures a false all-clear.
Cyclomatic complexity
Structural density per function. Read alongside duplication rather than alone — low complexity bought by scattering logic across copied scaffolding is not a win.
Code duplication
The proportion of source participating in repeated blocks. This is where generated enterprise scaffolding shows up as maintenance you inherited on day one.
Rework
Correction frequency during authoring. Structurally zero for agents, which is the point: it marks the boundary of what a keystroke lens can see.
Validation
Measured against human judgement, not asserted
Most tools in this space ask you to take their scoring on faith.
Two people independently labelled the same sample of generated codebases without seeing the instrument's answers. Agreement between the two humans was κ = 0.870. Between each human and the instrument, κ = 0.853 and κ = 0.727 — all three clearing the threshold conventionally read as substantial agreement.
The figures reproduce from the public repository with one command on a clean install. Where the raters disagreed with the instrument, they were right, and the defect they exposed is published as an erratum with the repair and a regression test.
Who uses it
Where it earns its place
Engineering leaders
Measure a tool before it is standard issue across your team, on your own briefs rather than a vendor benchmark.
Procurement and risk
Establish the quality-and-governance profile of a coding tool before it sits inside a governance boundary, not after.
CI pipelines
Gate a merge on specification fidelity the way you already gate on tests, with a single command and an exit code.
The measurement layer is free and always will be. What is worth paying for is the assurance built on top of it — an audit of your agents against the full standard, and the governance that follows.