SamuelNDCE/Meerkat

One command that checks your whole project before you ship it.
Security, correctness, accessibility, performance and code health, for any kind of app, with every result saved and explained.
360 checks · 1406 sub-checks · 47 suites. A check is one scan or tool run; a sub-check is one rule inside it, so a failure names the exact rule. These are the checks Meerkat ships: any you add yourself are extra.
Sample data: a made-up project, drawn by Meerkat's real screens.
Why · Features · Quick start · What it looks like · Make it yours · Commands · Reference · Licence
## Why Meerkat
"Is this safe to push?" usually means running ten commands in the right order, remembering which tool needs which flag, and reading ten different kinds of output. Most projects never get further than a linter and a few tests, so whole classes of problem (a leaked key, an unescaped query, a button a screen reader cannot reach, a build that only works on your machine) ship unseen.
Meerkat is one command that runs all of it, works out what applies to your project, and gives you one honest answer.
What it solves
| The problem | What Meerkat does |
| Checks are scattered across tools, scripts and CI | One command runs them all, in the right order, and shows one result |
| A tool is missing and the check silently skips | It says NOT RUN and why, and the run exits with an error. It never passes quietly |
| Scanners cry wolf, so people stop reading them | Every rule is proven on a bad and a good sample, and a planted-bug test measures misses and false alarms |
| You cannot tell why something failed | Every check's command, exit code, time and full output is saved, with a findings file worst-first |
| Different project types need different tools | It detects what you have (Node, Rust, Python, Go, Electron, web, Docker and more) and runs what fits |
| Big projects time out, small ones wait | Time limits grow with the size of the project and your PC, and stuck checks are skipped, not waited on |
Why it is good
Honest. NOT RUN is never a pass. A check that stopped working is caught by meerkat self-test.
Accurate. Over a thousand rules, each with its own bad and good sample, plus a corpus of planted defects. Recall and false-alarm rates are committed to the repository, see docs/accuracy.md.
Fast. The quick preset runs every short check in seconds. Light checks run together, heavy ones run alone.
Private. Zero dependencies, no telemetry, nothing uploaded. The one network call is a once-a-day version look-up you can turn off.
Yours. Add a command as a check in one line, write a check in JavaScript, make your own presets, silence a known finding with a reason.
Readable by people and machines. A live board and a results screen for you; JSON, SARIF, Markdown and an MCP server for scripts, CI and AI agents.
## What you get
| Feature | In one line |
| Presets | quick before every push, full before a release, plus security, ui, performance, refactor, ci and more |
| Suites and sub-checks | Checks grouped by topic; each reports every rule it tested, so a failure names the exact rule |
| Live board | Progress, what is running now, a status line, a bug counter by severity, a timeline; skip a stuck check with a key |