GitHub App · Free for public repos
Reviewing one pull request at a time can't show how the codebase as a whole is decaying. Open-source static analysis finds candidate problems across your repository, and an AI agent reads the actual code to check the important ones. The places it recommends fixing first arrive as a GitHub Issue, ten at most.
Every feature is free on public repositories. No card required. Pro brings the same to private repositories.
polyscan analyze . → 142 findings
read_file api/handlers.py:190-262
▲ confirmedCC 31, three jobs in one function
read_file services/user.py:45-62 + admin.py:23-40
▲ confirmed87% clone, same validation twice
read_file core/plugins.py:1-44
● dismissed"dead code" is a documented plugin hook
The audit agent
Static analysis is exhaustive, but it flags false positives and deliberate design choices just as mechanically as real problems. Polyscan treats that output as a starting point and checks it against the code, the way a human reviewer would.
MEASURE
Open-source analyzers — pyscn for Python, polyscan for JavaScript, TypeScript, Go, Rust, and C++ — measure complexity, duplication, dead code, dependencies, and class design across the entire repository, with the same yardstick on every run.
INVESTIGATE
The agent picks the findings that matter most and opens the functions and classes behind them, across files. It is designed to read every copy before recommending a merge, and to set aside findings the code itself explains or that follow the project's own design.
REPORT
What holds up against the code becomes at most ten recommendations, each naming the file, function, and line, written to a GitHub Issue in one of eight languages.
Checked against the code
Static analyzers print hundreds of warnings and leave it to you to decide which ones are real. Polyscan takes on the first pass of that judgment.
Features
AUDIT
Measures complexity, duplication, dead code, and dependencies across the entire repository every week. The agent reads the code behind the findings, then reports what to fix and what changed in a GitHub Issue.
PR
Analyzes changed code and flags new complexity or duplication before merge, complementing weekly measurement with real-time feedback.
YAML
Customize Polyscan behavior with a simple YAML file. No complex setup required.
.github/polyscan.yml
# Report language (default: en)
language: ja
# Target directories (default: all)
target_directories:
- src/
# Audit interval (default: weekly)
audit_interval: weekly
# PR review (default: false; private repos need Pro)
pr_review: trueReadings
Every investigation starts from these five structural readings, taken across the whole repository.
DEAD
Unreachable code you can safely delete, found by walking the control flow graph rather than guessing.
DUP
Copy-pasted and structurally similar code worth merging — Type 1-4 clone detection via tree edit distance.
CC
Functions that are hard to read and hard to test, ranked by cyclomatic complexity so you know where to start.
DEP
Circular imports and unstable module dependencies, plus the module communities your codebase actually forms.
CBO
Classes that do too much or depend on too much, measured with CBO coupling and LCOM cohesion.
Open source
The analyzers Polyscan uses are MIT licensed. Run them as a CLI on your own machine to see the same readings the agent starts from.
Python
uvx pyscn@latest analyze .JavaScript / TypeScript / Go / Rust / C++
npx polyscan analyze .Pricing
Every feature on every public repository, at no cost. Pay only for private repositories.
Cancel anytime
FAQ
An AI agent that audits GitHub repositories on a schedule. It measures the whole repository with open-source static analyzers — pyscn for Python, polyscan for JavaScript, TypeScript, Go, Rust, and C++ — then reads the actual code behind the important findings and recommends what to fix first in a GitHub Issue.
An analyzer outputs every finding, including false positives and deliberate design choices, and leaves the triage to you. Polyscan's agent does a first pass of that triage: it reads the code behind the important findings across the repository, sets aside what the code already explains, and narrows the rest down to at most ten recommendations with file, function, and line. The recommendations are an AI's judgment, so treat them as a prioritized starting point rather than a verdict.
Most AI reviewers look only at a pull request's diff. Polyscan measures the entire repository every week and investigates from those measurements, so its findings rest on numbers taken with the same yardstick each run rather than on impressions. PR review is available too, as an opt-in.
Your code is analyzed by a local LLM running in our on-premises environment and is never sent to external generative AI APIs. We do not store it: once the report is posted to GitHub, the code is discarded.
Python, JavaScript, TypeScript, Go, Rust, and C++. Complexity and duplicate code are measured for every language. Dead code, dependencies, and class design need the import graph and class model that only the Python and JavaScript/TypeScript backends build today, so those dimensions are left out of a Go, Rust, or C++ score rather than counted as clean.
The analysis engine — pyscn, polyscan, and the shared core — is MIT licensed and free to run as a CLI. The GitHub App, which adds the agent and runs it for you, is free with every feature on public repositories; Pro covers private repositories.
Install
Just install it on GitHub. Every feature is free for public repositories, and the agent reports to a GitHub Issue every week.
Start auditing free