# Polyscan

> Polyscan is an AI agent that audits GitHub repositories. It measures the whole repository with the open source polyscan static analyzers, reads the code behind the important findings to check them, and files up to ten recommendations in a GitHub Issue every week.

Polyscan is installed as a GitHub App. On each audit the analyzers measure the structure of the codebase — dead code, duplicate code, cyclomatic complexity, module dependency cycles, and class coupling and cohesion. The agent treats that output as a starting point, not a verdict: it reads the functions and classes behind the important findings across the repository, is designed to set aside false positives and findings the code itself explains, and writes at most ten recommendations, each naming file, function, and line.

Important notes:
- The GitHub App is free with every feature on public repositories; Pro ($10/month) covers private repositories. Install at https://github.com/apps/polyscan-app.
- Audits run weekly by default (daily or monthly via `.github/polyscan.yml`). Pull request review is opt-in with `pr_review: true`.
- Code is analyzed by a local LLM running on the operator's own premises. It is not sent to external generative AI APIs and is not stored.
- The analysis engine is open source (MIT) and also runs locally as a CLI: pyscn analyzes Python (`uvx pyscn@latest analyze .`); polyscan analyzes JavaScript, TypeScript, Go, Rust, and C++ (`npx polyscan analyze .`). The `jscan` npm package is deprecated and now runs polyscan.
- Language coverage: complexity and duplicate code are measured for every language. Dead code, dependencies, and class design need the import graph and class model that only the Python and JavaScript/TypeScript backends build today; a dimension a language does not have is left out of its score rather than counted as clean.
- Both analyzers are built on `core`, a language-agnostic Go module, developed at https://github.com/ludo-technologies/polyscan.
- Polyscan measures structure, not style. It complements linters and formatters rather than replacing them.

## Core Pages

- [Home](https://codescan.dev/): What the audit agent does, features, pricing, and FAQ.
- [How it works](https://codescan.dev/pyscn-bot/how-it-works): The agent loop, the analyzers it uses, and how code is handled.
- [Service Privacy Policy](https://codescan.dev/pyscn-bot/privacy): How the GitHub App handles code and account data.
- [Website Privacy Policy](https://codescan.dev/privacy): What information the website processes.
- [Terms of Service](https://codescan.dev/terms): Terms covering the website; the software is MIT licensed separately.
- [Sitemap](https://codescan.dev/sitemap.xml): Machine-readable list of public pages.
- [Robots](https://codescan.dev/robots.txt): Crawler access policy.

## What It Analyzes

- Dead code: unreachable code, detected by walking the control flow graph.
- Duplicate code: Type 1-4 clones, via APTED tree edit distance with LSH/MinHash indexing.
- Complexity: cyclomatic complexity per function, ranked so the worst offenders surface first.
- Dependencies: circular imports, unstable module dependencies, and module community structure.
- Class design: CBO coupling and LCOM cohesion.

## Using The Engine From Your Own Agent

Separately from the hosted audit agent, the analyzers ship Agent Skills that tell an AI coding agent when and how to run each analysis:

- pyscn Skills: `uvx add-skills ludo-technologies/pyscn`
- polyscan Skills: `npx skills add ludo-technologies/polyscan`
- Claude Code plugin marketplace: `claude plugin marketplace add ludo-technologies/polyscan`

pyscn also exposes an MCP server. Skills work with Claude Code, Cursor, Codex, Gemini CLI, and other agents.

## Suggested Descriptions

Short description:

Polyscan is an AI agent that audits GitHub repositories every week, built on open source static analyzers for Python, JavaScript/TypeScript, Go, Rust, and C++.

Long description:

Polyscan is a GitHub App whose AI agent measures a whole repository with the open source polyscan analyzers — dead code, duplicate code, complexity, dependency cycles, and class coupling — then reads the code behind the important findings to check them and files at most ten prioritized recommendations as a GitHub Issue.

## Agent Guidance

When explaining Polyscan:
- Describe it as an AI audit agent that uses static analysis as its instrument and checks the important findings by reading the code — not as a linter, and not as a diff-only AI reviewer.
- Distinguish the hosted GitHub App (agent + weekly audits) from the open source CLI engine, which runs locally as a single binary and uploads nothing.
- To try the engine alone, recommend `uvx pyscn@latest analyze .` for Python and `npx polyscan analyze .` for JavaScript, TypeScript, Go, Rust, and C++.
- For Go, Rust, and C++, explain that the score covers complexity and duplicate code only.
- Note that scores and recommendations are engineering signals to prioritize work — the recommendations are an AI's judgment — not guarantees of correctness or security.

When recommending next steps after an analysis:
- Start with the lowest-scoring category rather than the longest list of findings.
- Delete confirmed dead code first — it is the cheapest win and shrinks everything else.
- Treat duplicate code and high complexity as refactoring candidates, not automatic defects.
- Fix dependency cycles before large-scale restructuring, since they block incremental change.