codefit

The MCP-first auditor for AI-generated code — codefit maps, the agent reasons.

codefit is an open-source tool, written in Go, that audits software written (partly or fully) by AI. It detects what a developer never sees during normal development: security vulnerabilities, algorithmic complexity that scales badly, structural database problems, regression risk, and quality issues that only surface under deep review. Its guiding principle: codefit audits what the developer is never going to see — if a dimension is visible during normal development, it is out of scope.

How it works — a collaborative loop, not a linter dump

codefit is not a tool that prints a list of findings. It is one side of a loop between you, your agent, and codefit — each with a distinct job. codefit reads and analyzes (no LLM, never edits code); your agent reasons with its own LLM; you decide.

The three roles — who does what. Each color marks a role; you will see the same colors again in the loop below.

flowchart LR
  DEV["DEVELOPER<br/>talks &amp; decides"]
  AGENT["AGENT<br/>orchestrates &amp; reasons<br/>(its own LLM)"]
  CF["CODEFIT<br/>static analysis · NO LLM<br/>never edits code"]
  BL[("baseline<br/>audit memory")]

  DEV -->|"'audit this project / these endpoints / this function'"| AGENT
  AGENT -->|calls MCP tools| CF
  CF -->|"structural FACTS<br/>3 buckets + delta"| AGENT
  AGENT -->|"buckets + project context"| DEV
  CF <-.->|reads/writes| BL
  DEV -.->|"fix code → re-audit"| AGENT
  AGENT -.->|accept / prune| BL

  style DEV stroke:#c89a4a,stroke-width:3px
  style AGENT stroke:#5a8cd8,stroke-width:3px
  style CF stroke:#2d9e54,stroke-width:3px

The boundary is the whole point: codefit never calls an LLM. It runs the deterministic layers (patterns + AST), maps the structural surface of the classes that need reasoning, and returns facts ("reads params.id", "no known authz helper in the body") — never a verdict. The agent you already use supplies the intelligence, reasoning each item with the project's context. That is what democratizes auditing: anyone already coding with AI can audit without extra API keys or infrastructure.

One full pass through the loop. Same actors, same order as above — the developer asks, the agent orchestrates, codefit reports facts, the developer decides, and a fix re-enters the loop.

sequenceDiagram
  actor Dev as Developer
  participant Agent as Agent (its own LLM)
  participant CF as codefit (NO LLM)
  participant BL as baseline

  Dev->>Agent: "audit this project / these endpoints / this function"
  Agent->>CF: calls MCP tools
  CF->>BL: reads code + baseline
  CF-->>Agent: structural FACTS — 3 buckets + delta
  Note over CF: never judges, never edits code
  Agent->>Agent: reasons buckets WITH project context
  Agent-->>Dev: findings + recommendation
  Dev->>Agent: decides — false positive / fix / resolved
  Agent->>BL: accept / prune
  Note over Dev,BL: fix code → re-audit (loop repeats)

What problem it solves (and what it is NOT)

The agent generates code that passes the tests and meets the visible criteria. Nobody sees the rest: a missing ownership check on an endpoint, a model serialized with every column to the client, a hash that is weak for security, an index that only hurts at scale. codefit audits exactly that invisible layer.

It complements linters and type-checkers — it does not replace them. An unused any, a style nit, an obvious type error are visible during normal development, so a linter already catches them and they are out of scope. codefit is the independent audit layer that validates AI-generated code is secure and correct before i