Ratchet scans code from your terminal, explains the risky parts, and applies deterministic or test-gated fixes where supported. Local by default, with BYOK support for AI review.
Flags unsafe rendering, broad permissions, exposed secrets, and injection-prone patterns before review fatigue misses them.
Finds any-casts, unchecked JSON, nullable path mistakes, and contract drift that usually surfaces as production weirdness.
Looks for swallowed errors, missing boundaries, unbounded retries, and brittle async flows.
Points to risky changed files without coverage and helps prioritize tests around real blast radius.
Surfaces N+1 calls, unnecessary rerenders, blocking loops, and avoidable startup work.
Tracks module weight, coupling, and maintainability drift so generated code does not silently calcify.
npm install -g ratchet-run. No account, browser, or hosted workspace.
ratchet scan --output-json returns parser-clean findings for terminals, bots, and CI.
ratchet improve applies safe fixes, leaves judgment calls for humans, and writes a local report.
The CLI smoke suite now checks that ratchet scan --output-json starts with valid JSON, after a real stdout pollution bug was found and fixed during handoff verification.
CI can parse scan results without scraping terminal art. That makes the product useful to agents, GitHub Actions, and release scripts immediately.
The scoring docs publish the dimensions and weights instead of asking teams to trust a mystery number.
The public CLI core is MIT licensed. Inspect it, fork it, and verify what runs.
Built in public as a focused developer tool, not a borrowed wrapper pitch.
Local scans stay in your terminal. Networked features and their data paths are documented rather than hidden behind a blanket claim.
Normal scans run locally. AI-powered deep scans are opt-in and send scoped snippets only to the model provider you configure.
JSON and SARIF output fit existing automation without forcing a hosted dashboard into the loop.
Bring your own API key for deep analysis and fixes. No Ratchet server sees your repository.
Pay for the developer workflow, not repository count. Every plan stays BYOK/local-model friendly.
ratchet improveratchet torqueFor organizations that need procurement support, a security review, or deployment requirements beyond self-serve. We’ll scope the plan around what Ratchet can support today.
Secure hosted checkout. Ratchet never handles or stores your card details.
One authorized Node/TypeScript repository. Ratchet finds the evidence; an expert validates paid-launch blockers, anchors them to source, and gives you a remediation sequence for the reviewed revision.
Ratchet: 72/100 HIGH src/Preview.tsx:42 escape rendered HTML 2 safe fixes available
- dangerouslySetInnerHTML={{__html: md}}
+ <SafeMarkdown source={md} />pass when score stays above threshold and no critical findings ship.
Paste code in the sandbox or install the CLI. The first useful moment should happen before a sales page would even finish loading.