See what's inside your codebase
Paste a public GitHub URL and REPO-SIGHT reads the source straight from the repo: size, structure, complexity, duplication, security hotspots, and rule violations, across C++, Python, Java, TypeScript, JavaScript, and C#.
What a report looks like.
This is a real scan of REPO-SIGHT’s own source code, not mock data. Your report has the same sections, built from your repo.
78 / 100, grade C
Health score across 159 files and 27,658 lines of C++, TypeScript, and JavaScript. Nothing is hidden: the score is built from five weighted parts, listed below.
298 findings, ranked
0 critical, 8 high, 129 medium, and 161 low. Every finding has a tier (how bad it is if real) and a confidence (how likely it is real).
Files ranked without git
No git history in this scan, so the most complex files are ranked by cyclomatic complexity and nesting depth. That is where refactoring pays off first.
Fix first
The report opens with the problems worth your time, grouped by cause and ranked, instead of a flat list of 298 lines. For this scan the top two were:
-
Empty error handler (high tier, high confidence). Six
catchblocks in three JavaScript files do nothing with the error, so failures would vanish silently. Fix: log it, handle it, or add a comment saying why ignoring it is intended. - OS command execution (high tier, medium confidence). Two places in the C++ launch a shell command. Confidence is only medium because the analyzer cannot see where the arguments come from; fixed commands are lower risk.
Where the score came from
Complexity density scored 84 out of 100, average function length 100, comment coverage 59, and TODO density 100. Nesting depth scored 20: the deepest block in the project reaches seven levels, close to the point where the score bottoms out at eight. That one number is the cheapest improvement available.
Five stages. One pass. No black box.
Every file goes through the same deterministic pipeline — the same one the
cma binary runs on the command line.
Scan
Finds every recognized source file across all six supported languages, in a repo, a folder, or a single file.
Lex
Character-level tokenizer per language. Keywords, identifiers, literals, operators — no regex, no compiler.
Parse
Walks the token stream to find functions, classes, nesting depth, and cyclomatic complexity.
Aggregate
Per-file metrics, duplication, and rule violations roll up into one project-level report and health score.
Report
A dashboard you can read — never a black box.
Every metric the engine computes — one dashboard.
Six languages, one report. Everything below is part of the same free scan. Scan history, finding explanations and private repositories need a GitHub sign-in.
Size & structure
Lines, functions, classes, and imports — split by real code vs. comments vs. blank, rolled up project-wide.
Complexity
Cyclomatic complexity, max nesting depth, loops and conditions, and your longest function. Files are ranked by complexity even when there is no git history.
Technical debt
Every TODO and FIXME marker, counted — so nothing quietly rots in a comment.
Duplication
Token-based clone detection finds copy-pasted blocks across your whole codebase, not just per file.
Security hotspots
45 of the 98 rules look for security problems such as hardcoded credentials and shell command execution, each with a severity tier and a confidence level.
Fix First
Findings grouped by cause and ranked by tier, confidence, and number of places, so the report opens with what to fix first.
Language mix
See how a mixed repo splits across C++, Python, Java, TypeScript, JavaScript, and C#, with per-language numbers.
PDF audit
Download a PDF audit from any report. It is built in your browser, so the report never leaves it.
Scan-over-scan tracking
Sign in and REPO-SIGHT remembers your last scan of a repo, so you can see if it's actually improving.
AI explain-this-finding
Signed-in users can ask for a plain-English explanation of any specific finding, not just the raw rule text.
How the score works, and what it can’t tell you.
A grade is only useful if you know what it measures. Here is the method, including the limits.
The health score
The 0–100 score is a weighted blend of five measurements: complexity density (35%), average function length (25%), comment coverage (20%), TODO and FIXME density (10%), and maximum nesting depth (10%). Each one is scored between a “good” and a “bad” reference value. For example, average function length earns full marks at 15 lines or fewer and nothing at 60 or more; nesting depth earns full marks at 3 levels and nothing at 8. The score breakdown is shown on every report, so you can see which part moved the grade.
Findings, tiers, and confidence
98 rules run across the six languages, and 45 of them look for security problems such as hardcoded credentials and operating-system command execution. Each finding carries a tier (critical, high, medium, or low), based on the damage if it is real, and a confidence level, based on how likely a pattern match is to be a genuine problem.
What static analysis cannot do
- The analyzer reads source with a token-based parser. It does not track data flow, so it cannot tell trusted input from untrusted input. That is why some security findings are marked medium or low confidence.
- Nothing is compiled, run, or tested. Runtime bugs, performance problems, and failing tests are outside what a static scan can see.
- Placeholders, test values, and generated code can be flagged. Treat the report as a prioritized starting list for review, not a verdict.
- A grade compares your repo against fixed reference values, not against other projects. It is most useful for watching one repo improve over time.
- This is not a replacement for a security audit or a human code review.
Frequently asked questions
Is REPO-SIGHT really free?
Yes. There are no tiers and no paywalled metrics. A small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.
Does it run my code?
No. It only reads source files. Nothing is built, executed, or tested, and repository scripts are never run, so a flagged command or eval() is reported, not triggered.
Which languages does it analyze?
C++, Python, Java, TypeScript, JavaScript, and C#. Other languages found in a repo are listed in the report as not analyzed, so the numbers never claim to cover files they skipped.
What can I scan?
Paste a public GitHub repository URL, or paste or upload a single source file of up to 2 MB. Repository scans have a time limit of about 55 seconds, so very large repos may return a “too large” message. Private repositories need a GitHub sign-in, and the sign-in token is not stored.
Do I need an account?
Only for private repositories. For public ones, sign-in is optional; signing in with GitHub also saves your last five scans and shows what changed since your previous scan of the same repo.
How accurate are the findings?
They are heuristics from a token-based parser, so some will be false positives. Each finding shows a confidence level so you can start with the ones most likely to be real. See the limits above.
What should I fix first?
Start with the Fix First list at the top of the report’s Overview. It groups findings by cause and ranks them by tier, confidence, and how many places they appear. Then check the nesting and function-length numbers in the score breakdown.
Can I see a report before scanning my own code?
Yes. Open the sample report, a real scan of REPO-SIGHT’s own source. Nothing to paste.
Read up on what the numbers mean.
Short, practical explainers on the metrics REPO-SIGHT reports and why they matter.
What is static code analysis?
How reading source without running it catches structural problems early — and where it falls short.
Cyclomatic complexity, explained
What the number counts, why 10+ is a common warning line, and how to bring a function back down.
How to read a code health score
What REPO-SIGHT's A–F grade weighs, and what to fix first when a repo grades low.
Scan a repository in seconds.
No tiers and no paywalled metrics; a small amount of advertising pays for hosting. Sign-in is optional for public repositories and required for private ones.