Every command, every integration, every benchmark.
Every command works the same way: npx thuban [command] [path]
Run these in order to see what Thuban does:
npx thuban scan . Scan your projectnpx thuban fix . Preview what can be fixednpx thuban fix . --fix Apply all safe fixesnpx thuban dashboard . Open visual HTML reportthuban scan .
Full health scan — score, issues, hallucinations, grade
thuban hallucinate .
Find phantom APIs, invented methods, fake imports PRO
thuban ghosts .
Find dead code — functions that exist but nobody calls PRO
thuban ai-score .
AI risk score per function — which code needs human review PRO
thuban clones .
Copy-paste drift — find duplicate code that should be shared PRO
thuban drift .
Detect files that have drifted from their declared purpose PRO
thuban deps .
Map dependencies, detect circular imports, find orphans
thuban diff .
Scan only git-changed files — fast CI check
thuban debt .
Detailed tech debt breakdown with severity scores
thuban taint .
Trace untrusted data flows through your codebase PRO
thuban compare . ../other
Side-by-side health comparison of two codebases PRO
thuban fix .
Preview what can be fixed — safe, no changes made PRO
thuban fix . --fix
Apply all safe fixes automatically PRO
thuban fix . --fix --commit
Each fix = 1 git commit — revert any with git revert PRO
thuban gate --fix
Install pre-commit hook — block hallucinated code automatically PRO
thuban inject .
Inject Mother Code DNA annotations into every file PRO
thuban baseline .
Snapshot current issues — future scans only flag NEW problems TEAM
thuban watch .
Live sentinel — monitors your codebase in real-time PRO
thuban dashboard .
Generate beautiful HTML dashboard with score rings PRO
thuban executive .
CTO-ready PDF report — forward it to your board PRO
thuban cost .
Tech debt cost in $ and hours — ROI in one command PRO
thuban passport .
Generate codebase identity file — new devs productive in minutes PRO
thuban health .
Quick health check with summary scores
thuban report .
Full combined report — scan + deps + drift in one go
thuban history .
View scan history — track health over time PRO
thuban trend .
Visualise health trends — improving or degrading? PRO
thuban monitor .
Scheduled recurring scans with alerts TEAM
--fix
Apply fixes (default is dry-run preview)
--unsafe
Allow runtime-changing fixes (circular deps, deprecated API swaps)
--commit
Auto-commit each fix as a separate git commit for easy rollback
--json
Output as JSON for CI/CD pipelines
--baseline
Only report NEW issues vs saved baseline
--verbose
Detailed output with extra context
Most scanners advertise detection rates and stop there. We show you precision against a labelled corpus you can inspect yourself.
Zero false positives against our labelled test corpus. When Thuban flags something, it's real.
Precision 1.0 — zero false positives. When Thuban flags something, it is real. This isn’t a marketing number — it’s measured against a real, versioned test corpus of known-good and known-bad code across 10 languages, and it moves with every release. High precision means you can trust every finding without triage fatigue.
Methodology: precision is computed by running the Scanner and Crucible engines against a versioned, labelled corpus of known-good and known-bad code samples spanning all 10 supported languages. Precision is the share of flagged issues that are real (true positives / all flagged). The corpus and scoring scripts are public so you can reproduce the numbers yourself.
CLI, IDE, CI/CD, and AI agents. Thuban fits into your existing workflow without friction.
Real-time scanning on save. Issues appear as diagnostics in the Problems panel. Quick-fix suggestions via Code Actions. Trust score in the status bar.
code --install-extension thuban-0.5.6.vsix
Download VSIX →
Let AI agents call Thuban directly. 7 tools including scan, fix, hallucinate, ghosts, clones, taint, and health. Works with Claude, Copilot, Cursor.
npx thuban-mcp
View source →
Automatic PR scanning. Comments with trust score delta, new issues, and inline annotations. Optional auto-fix PRs. Configurable quality gates.
uses: SilverwingsBenefitsGit/thuban-action@v1
View source →
Nobody owns this category yet. Thuban’s MCP server lets Claude, Cursor, Copilot, and any AI coding agent verify code as they generate it — not after. The agent writes code, Thuban checks it, the agent fixes it before a human ever sees it.
thuban_scan
Full codebase scan — health score, issues, grades
thuban_fix
Auto-fix issues with safe, reversible git commits
thuban_hallucinate
Detect fake APIs, phantom imports, invented packages
thuban_taint
Track user input from source to dangerous sink
thuban_ghosts
Find dead code, orphan files, unused functions
thuban_clones
Spot duplicated logic AI copy-pasted across files
thuban_health
Quick health check — score, grade, issue count
AI agents generate thousands of lines of code per day. Without verification, hallucinated APIs ship to production, phantom packages get imported, and plausible-but-wrong logic passes code review because it looks right. The MCP server makes verification automatic — the AI checks its own work before you ever see it.
SonarQube and Snyk were built for human bugs. Nobody owns “the verification layer for AI-generated code” yet. Thuban is purpose-built for the vibe-coding era — where the code is written by machines and the humans need to know it’s safe. This isn’t a feature. It’s infrastructure.
Thuban scans every single push against both engines — the Scanner and the Crucible — automatically, checking for known patterns. It's an automated first pass, not a substitute for human code review.
Every PR gets a trust score. Block merges below your threshold. SQL injection in line 42? Blocked before it reaches staging. AI hallucinated an API? Caught at push time, not production.
10 devs or 500. Junior devs, contractors, AI agents — they all push code. Thuban checks every single one equally. No bias, no fatigue, no Friday afternoon shortcuts. The watchdog never sleeps.
Every scan builds a trust history. Watch your codebase health improve sprint by sprint. Show the board a graph that goes up and to the right — not just revenue, but code quality.
You can't manually review every PR. You can't catch every hallucinated API an AI copilot generates. You can't be sure that contractor on the other side of the world isn't introducing SQL injection at 2am. But Thuban can.
Wire it into your CI pipeline in 30 seconds. From that moment, every push against every branch runs through 69 security and quality rules, then gets stress-tested against 515 attack patterns. Your team gets instant feedback. You get a dashboard showing trust scores across every project. No meetings. No overhead. Just verified code, every time.
Runs on every PR. Blocks merges on critical findings. Posts the health score straight into the PR conversation.
Runs on every pull request — no separate install step, no Docker, no API keys.
Blocks merges when findings breach your fail-on severity threshold.
Optional Slack notifications for critical findings via --slack-webhook.
No install, no config files, no signup required.
$ npx thuban scan .
Click to copy