Hallucinated APIs. Phantom imports. Security vulnerabilities. Dead code. Tech debt. One command scans your codebase and tells you exactly what's broken — and what to do about it.
One command scans your entire project for vulnerabilities, phantom imports, hallucinated APIs, stale dependencies, and AI-generated code patterns that look right but aren't. Your AI agent wrote 2,000 lines in 40 minutes. How much of it is actually safe? Traditional linters check syntax. Scanner checks reality.
Import modules that don't exist in your project
Call API methods that were deprecated years ago
Paste utility functions then never call them
Duplicate logic across files that slowly drifts apart
Generate code that looks perfect but crashes in production
Scans every file for phantom imports and fake APIs
Flags deprecated patterns before they break on upgrade
Finds dead functions that inflate your bundle
Detects copy-paste drift before it causes bugs
Fixes what it can, reports what it can't — in seconds
Modules that don't exist in your package.json or node_modules — the ones an AI agent invented mid-generation.
Function calls to APIs that don't exist or have the wrong signature — code that compiles but fails at runtime.
Dependencies with published vulnerabilities, cross-referenced against your actual installed versions.
Deprecated versions still in production, quietly accumulating risk until an upgrade forces a breaking change.
eval, exec, os.system in loops — code patterns that are one bad input away from arbitrary execution.
Code that compiles, passes review, and fails silently in production — the specific failure signature of AI-generated code.
thuban scan . — one command, full report, seconds not hours.
Thuban Scan is the safety layer between AI-generated code and your production environment. Thuban Shield is the safety layer between AI agents and your filesystem while they work.
Deploy in under 60 seconds. Run one command. Get a health score. Fix what's broken. Move on.
Everything runs locally. Your code never leaves your machine.
Four reasons engineering teams run Thuban Scan before every merge.
Mother Code is Thuban's unique self-awareness layer. It turns your codebase from a bag of files into a connected, self-documenting system.
// utils/calculateScore.js
function calculateScore(issues, files) {
let score = 100;
issues.forEach(i => {
score -= i.severity * 2;
});
return Math.max(0, score);
}
module.exports = { calculateScore };No context. No purpose. No connections. Just code floating in a folder.
/**
* @thuban-purpose Calculates health score from issues
* @thuban-owner scanner
* @thuban-depends-on hallucination-detector, tech-debt
* @thuban-depended-by cli.js, html-report.js, dashboard
* @thuban-sacred false
* @thuban-last-verified 2026-06-27
*/
function calculateScore(issues, files) {
let score = 100;
issues.forEach(i => {
score -= i.severity * 2;
});
return Math.max(0, score);
}
module.exports = { calculateScore };Now the file knows its purpose, its owner, and what breaks if you change it.
When every file has DNA, Thuban can detect drift — when a file's code no longer matches its declared purpose. It can detect breaking changes — when you edit a file that other files depend on. And it gives new team members instant context — read the header, understand the file.
npx thuban inject .
Add Mother Code DNA to every file in your project
Real output from a real scan. No mockups. No staged demos.
Thuban Scan in 60 seconds — install → scan → fix → clean
$ npx thuban scan .SCANNING: /my-project Found 1547 files to scan... ╔══════════════════════════════════════════════════════╗ ║ THUBAN SCAN ║ ╠══════════════════════════════════════════════════════╣ ║ Files scanned: 1547 ║ ║ Health score: D+ (52/100) ║ ║ Scan time: 1017ms ║ ╚══════════════════════════════════════════════════════╝ HIGH: 1 Deprecated API (will break on Node upgrade) server.js:24 url.parse() — deprecated since Node 11 → Use new URL() — url.parse() is legacy CODE QUALITY: 86 issues ! cdp-connector.js:21 Hardcoded localhost URL ! takeover.js:45 Hardcoded localhost URL ... 84 more
$ npx thuban fix .DRY RUN — showing what would change (no files modified) SAFE FIX: server.js:24 - const parsed = url.parse(reqUrl); + const parsed = new URL(reqUrl, base); SAFE FIX: cdp-connector.js:21 - const ws = 'ws://localhost:9222'; + const ws = process.env.CDP_URL || 'ws://localhost:9222'; 61 fixes available | 61 safe | 0 unsafe Run with --fix to apply
$ npx thuban fix . --fix --commitFIXED: server.js:24 — replaced url.parse with new URL committed: thuban-fix: update deprecated url.parse FIXED: cdp-connector.js:21 — environment variable for CDP URL committed: thuban-fix: use env var for CDP URL ... 61 fixes applied. 61 git commits created. Don't like a fix? Run: git revert <commit>
$ npx thuban dashboard .Dashboard saved: thuban-report-2026-06-27.html Open it in your browser — share it with your CTO. Score rings, category breakdown, every issue listed, fixable items highlighted.
$ npx thuban scan https://github.com/company/their-apiCloning repository... Cloned successfully SCANNING: their-api Found 892 files to scan... ╔══════════════════════════════════════════════════════╗ ║ Health score: C (68/100) ║ ╚══════════════════════════════════════════════════════╝ 14 AI hallucination risks 23 deprecated APIs 42 code quality issues (temporary clone removed — nothing stored)
$ npx thuban compare ./our-app https://github.com/competitor/app┌──────────────────────┬──────────────────────┬──────────────────────┐ │ METRIC │ our-app │ competitor-app │ ├──────────────────────┼──────────────────────┼──────────────────────┤ │ Health Score │ B (85/100) │ D+ (52/100) │ │ Grade │ B │ D+ │ │ Files Scanned │ 301 │ 1547 │ │ Total Issues │ 3 │ 87 │ │ Hallucinations │ 0 │ 14 │ │ Circular Deps │ 0 │ 4 │ │ Mother Code DNA │ 92% │ 0% │ └──────────────────────┴──────────────────────┴──────────────────────┘ VERDICT: our-app is healthier 33 point difference — significant gap
Existing tools check syntax. Thuban checks whether your code is real, safe, and maintainable — regardless of who or what wrote it.
| Feature | Thuban | ESLint | SonarQube | Socket.dev | Semgrep |
|---|---|---|---|---|---|
| AI hallucination detection (multi-language) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Advisor Mode (roast/rate/boost/risk/…) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Self-verifying Kill Switch (blocks on broken scanner) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Public community leaderboard | ✓ | ✗ | ✗ | ✗ | ✗ |
| Ghost code detection | ✓ | ✗ | Partial | ✗ | ✗ |
| AI risk scoring per function | ✓ | ✗ | ✗ | ✗ | ✗ |
| Tech debt cost in $ / hours | ✓ | ✗ | Partial | ✗ | ✗ |
| Pre-commit hallucination gate | ✓ | ✗ | ✗ | ✗ | ✗ |
| Copy-paste drift detection | ✓ | ✗ | ✓ | ✗ | Custom rule needed |
| Codebase passport / identity | ✓ | ✗ | ✗ | ✗ | ✗ |
| Zero config / npx command | ✓ | Needs .eslintrc | Server required | Needs account/API key | ✓ |
| CTO executive PDF report | ✓ | ✗ | Partial | Dashboard, no PDF | ✗ |
| Auto-fix | ✓ | ✓ | Limited | ✗ | Some rules |
| Safe/unsafe fix separation | ✓ | ✗ | ✗ | ✗ | ✗ |
| Baseline / delta scanning | ✓ | Limited | Partial | Partial | ✓ |
| Scan any GitHub repo (no clone) | ✓ | ✗ | ✗ | ✓ | ✗ |
| Side-by-side codebase comparison | ✓ | ✗ | ✗ | ✗ | ✗ |
| Rule IDs + inline suppression | ✓ | ✓ | ✓ | ✓ | ✓ |
| Adversarial testing (The Crucible) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Chaos & mutation testing | ✓ | ✗ | ✗ | ✗ | ✗ |
| Golden master regression guard | ✓ | ✗ | Partial | ✗ | ✗ |
| Malicious / supply-chain package detection | ✗ | ✗ | ✗ | ✓ (their core strength) | ✗ |
| Broad multi-language SAST ruleset | 9 languages, AI-failure focused | JS/TS only | ✓ | ✗ | ✓ (their core strength) |
| Local-first (no account / cloud upload required) | ✓ | ✓ | Server required | Cloud-based | ✓ |
| AI agent filesystem containment (Thuban Shield) | ✓ | ✗ | ✗ | ✗ | ✗ |
| Price | Free / $9/mo | Free | $150+/mo | Freemium / paid tiers | Free / paid tiers |
Where we overlap, honestly: Socket.dev is a strong, funded supply-chain security tool — if you need malicious-package detection across your dependency tree, it's excellent at that, but it doesn't test your own code for AI hallucinations, adversarially verify itself, contain what an AI agent can do to your filesystem, or carry Mother Code DNA across refactors. Semgrep is a powerful, free, local SAST engine with huge language coverage and community rules — but it has no AI-specific scanning, no hallucinated-package detection, no filesystem containment, and no adversarial self-verification loop. Thuban was built for a class of problem these tools weren't designed to catch: code that looks syntactically correct, passes a linter, and still calls an API that was never real — plus the newer problem of an AI agent with write access to your repo. Thuban Scan finds the code problems, Thuban Shield contains the agent while it works, and Crucible proves both actually hold up. Many teams run Thuban alongside Socket.dev and/or Semgrep — they solve different problems.
Side-by-side health comparison with a verdict. Built for AI-code failure modes traditional linters miss.
Every day, CTOs sign contracts with vendors they've never audited. Teams refactor code with no way to prove it improved. Agencies deliver projects with no objective quality proof. Developers inherit repos and have no idea how bad the situation is.
Thuban Compare solves this in one command. Point it at any two codebases — local folders, GitHub repos, or a mix of both — and get a full side-by-side health report with a clear verdict. No setup. No configuration. No meetings. Just data.
Built for a class of problem traditional linters were never designed to catch.
npx thuban compare [codebase A] [codebase B]
Scans complete in under 2 seconds after clone. Both scans run locally on your machine. Your code never leaves your laptop — the only optional network calls are supply-chain lookups that check dependency names (never source) against public registries. Use --offline to disable.
| Metric | your-app | vendor-api |
|---|---|---|
| Health Score | B (85/100) | D+ (52/100) |
| Files Scanned | 301 | 1,547 |
| Total Issues | 3 | 87 |
| AI Hallucinations | 0 | 14 |
| Critical Issues | 0 | 6 |
| Circular Dependencies | 0 | 4 |
| Orphan Files | 2 | 31 |
| Mother Code DNA | 92% | 0% |
| Drift Issues | 1 | 18 |
| Scan Time | 99ms | 977ms |
CTO about to sign a $200k contract? Scan their repo first. See if their code is production-grade or held together with duct tape.
Prove refactoring ROI. Run compare on last month’s snapshot vs today. Show the board a 40-point health improvement.
Compare your code against any open-source repo. Know exactly where you stand. Use the report in investor decks and pitches.
Agency delivering code? Run compare against industry standard. Hand the client a side-by-side proof of quality. Close the deal.
npx thuban compare ./my-app https://github.com/company/their-appWorks with any mix of local folders and GitHub URLs. Scans complete in under 2 seconds after clone.
Thuban reads your files, applies text replacements, and writes them back. Here is every fix it makes, with exact before/after.
npx thuban fix . --fix--commit, it creates a git commit so you can git revert any fixNothing is deleted. Nothing is uploaded. No network calls. It's a local find-and-replace engine with safety guards.
+ /** + * @thuban-purpose Express server configuration + * @thuban-owner api + * @thuban-depends-on express, auth-middleware + */ const express = require('express'); // unchanged
console.log() calls. Keeps console.error() and console.warn().- console.log('debug: user data', userData); console.error('Failed to connect'); // kept
--unsafe flag — changes runtime behaviour)- const parsed = url.parse(reqUrl); + const parsed = new URL(reqUrl); - const buf = new Buffer('hello'); + const buf = Buffer.from('hello'); - const sys = require('sys'); + const sys = require('util');
- const api = 'http://localhost:8080/api'; + const api = (process.env.SERVICE_URL_8080 || 'http://localhost:8080/api');
25 commands. Zero dependencies. Works on any codebase — JavaScript, TypeScript, Python, PHP, Ruby, Go, Rust, Java, Kotlin, C# and more.
Every file X-rayed layer by layer — severity tags surface exactly where and what broke
AI hallucination detection — the flagship feature
Detect hardcoded API keys, passwords, secrets in source code, .env files not gitignored, database connection strings with passwords, private keys, high-entropy strings, and secrets still exposed in git history.
Only in ThubanFind phantom imports, invented APIs, and deprecated patterns that AI coding tools leave behind. Built specifically to catch the failure modes AI coding tools create.
Only in ThubanGet a clear 0-100 score across Security, Architecture, Code Quality, Dependencies, and Mother Code coverage. Grade A through F.
One command fixes hundreds of issues automatically. Inject annotations, remove debug logs, update deprecated APIs, break circular deps.
Inject contextual DNA into every file. Your codebase becomes self-aware — every file knows what it does, what depends on it, and what breaks if it changes.
Only in ThubanBeautiful HTML reports you can email to your CTO. Score rings, category breakdowns, fixable items grid. Dark theme. Print-friendly.
Drop one file into your repo. Every PR gets a grade comment. Block merges below threshold. Dashboard artifact on every run.
Block bad code before it enters your repo. 3-second scan on every commit catches hallucinated APIs instantly. Install once, forget forever.
Only in ThubanTranslate tech debt into dollars and hours. Show your CTO exactly what bad code costs per month — and what Thuban saves. ROI in one command.
CTO FavouriteFind AI-pasted functions that exist but are never called. Dead code inflates your bundle, confuses devs, and hides bugs. Thuban finds every ghost.
Only in ThubanPer-function risk assessment for AI-generated code. Scores every function 0-100% using 12 signals. Know exactly which code needs human review before it ships.
Only in ThubanFind similar code blocks scattered across files. Thuban clusters duplicates and recommends shared utilities. Kill redundancy before it kills you.
One JSON file that describes your entire project — languages, architecture, sacred files, entry points, onboarding guide. New devs productive in minutes.
Onboarding KillerFull dependency graph with circular detection, orphan files, critical path analysis. Know what breaks before you change it.
Code evolves. Annotations become stale. Thuban detects when files have drifted from their declared purpose and flags the gap.
Watch mode monitors your codebase in real-time. Save a file, get instant feedback. Hallucination check on every keystroke.
Dry-run preview before any changes. Safe/unsafe separation. Git commit mode for easy rollback. Thuban never changes runtime behaviour without your explicit opt-in.
Senate ApprovedSnapshot your current issues. Future scans only flag NEW problems. Perfect for CI — don't fail on legacy debt, only fail on new mistakes being merged.
CI EssentialEvery detection has a unique rule ID (HALL_API001, DEPR_API003). Suppress false positives with a simple // thuban-ignore HALL_API001 comment. Full transparency.
Paste any public GitHub URL and Thuban clones, scans, scores, and cleans up automatically. No need to clone repos manually. Evaluate any codebase in 30 seconds.
Only in ThubanCompare two codebases side by side — local or remote. Health score, issues, dependencies, DNA coverage, and a verdict with gap analysis. Perfect for evaluating vendors, benchmarking against competitors, or measuring before vs after a refactor.
Only in ThubanThree engines, one CLI. Thuban Shield stops AI agents from destroying your code before it happens. Crucible proves the defences actually hold up. Thuban Scan finds what everyone else misses.
Security detection, AI hallucination detection, ghost code, clone/copy-paste drift, and dependency mapping in one pass — plus 8 Advisor commands (roast, rate, boost, risk, trend, benchmark, onboard, compliance) that turn raw findings into a prioritised roadmap.
roast is for laughs — clearly labelled as entertainment. rate gives you the same data as a straight /100 score across security, architecture, dependencies, maintainability, and test coverage.
Want the full picture? See Thuban Shield and Crucible.