Subhajit Pradhan
ResumeGitHub
Projects

Featured case study / Developer tools and codebase auditing engineer

Codebase Doctor

Codebase Doctor is a unified repository auditor covering structure, validation, database and RLS, security, source integrity, dependency analysis, SARIF, MCP, and agent workflows.

Metrics

Proof in numbers

Distribution
npm CLI + Agent Skill
Primary command
codebase-doctor audit .
Reports
Text, JSON, SARIF
Interfaces
CLI + read-only MCP

Workflow proof

Codebase verification loop

Codebase Doctor turns repository evidence into bounded findings, then reruns after an independently authorized repair.

  1. Inventory repo
  2. Run applicable audits
  3. Inspect findings
  4. Repair externally
  5. Rerun to verify

Architecture

System shape

A Node.js/TypeScript CLI inventories the repository, detects applicable project signals, runs bounded audit modules, normalizes findings into a stable schema, and emits text, JSON, SARIF, or MCP-backed inspection surfaces.

  1. Repository inventory

    Detects project structure, frameworks, manifests, workspaces, lockfiles, tests, and source signals.

  2. Audit modules

    Applies bounded checks across repository structure, validation, database, security, source integrity, and related domains.

  3. Finding model

    Normalizes severity, confidence, evidence, applicability, status, and limitations into stable report data.

  4. Report surfaces

    Renders human-readable output, machine-readable JSON, SARIF, and agent-facing MCP/skill workflows.

  5. Independent verification

    A separate developer or authorized coding agent makes repairs and Doctor reruns to verify the resulting state.

Proof

  • Published on npm with the unified command: codebase-doctor audit .
  • Read-only by design: no target-file write API and no remediation executor.
  • Produces stable text/JSON reports plus SARIF for code-scanning workflows.
  • Includes Git-aware changed audits, source-impact analysis, secrets/dependency analysis, and PostgreSQL RLS coverage.

Problem

Coding agents can produce plausible changes while missing repository-wide integrity, security, database, or validation problems. Teams need evidence from the codebase itself before trusting a result.

Users and context

Built for developers and coding agents that need a repeatable inspection layer before and after changes, without giving the auditor permission to modify the target repository.

Product workflow

Run codebase-doctor audit . for a full audit or use --changed for a focused scope. Review findings, coverage, evidence, and limitations, make repairs through a separate authorized actor, then rerun the audit.

Key engineering decisions

  • Made the public product one unified doctor instead of separate React, API, or database doctor commands.
  • Kept remediation outside the product so verification remains independently repeatable after a repair.
  • Used bounded, read-only analysis and explicit coverage states instead of claiming every possible analyzer exists.
  • Added provider-neutral Agent Skill and read-only MCP surfaces for coding-agent workflows.

Tradeoffs and limitations

  • Static auditing cannot prove every runtime behavior or business rule, so reports expose evidence and limitations instead of overclaiming.
  • Language-specific semantic coverage is intentionally partial in the current stable line.
  • Deep repository analysis is more useful than a collection of narrow tools, but it increases the need for clear applicability and coverage reporting.

Next improvements

  • Expand semantic frontend, backend, infrastructure, performance, and AI analyzers.
  • Add broader cross-language dependency and behavioral topology.
  • Improve CI integrations and team-level baseline workflows.