SmokingGun CLI
A CLI finds complexity hotspots and keeps static findings apart from measurements, so agents can judge optimisations.
- 67 ★ on the repository
- Last commit
- MIT
Minimal access
Why this level
- Static scanning only reads files, runs no code and changes no sources.
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/smokinggunDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewMinimal accessThe tool runs nothing and makes no network calls.
- Static scanning only reads files, runs no code and changes no sources.
This is third-party code. Review the repository files before installing.
What it does
SmokingGun scans a repository and returns a hotspot report with supporting evidence, coverage, assumptions and the next validation step. Static findings, estimates, imported measurements and behaviour evidence are kept apart so the agent sees what to trust. Scans run with commands such as `smokinggun scan .` in markdown and SARIF formats. The default `runtime` profile hides findings from tests, documentation and examples, while `--source-profile all` takes every source file. Measurements come from existing benchmarks and profiles, and the tool neither launches workloads nor rewrites code. A separate `smokinggun` skill teaches the agent to use the CLI.
Who it is for. Developers who hand optimisation to an agent and want conclusions based on measurable evidence.
Good fit when
- Functions with the highest complexity are found in a repository before optimising.
- A SARIF report is uploaded into the code review pipeline.
- Benchmark measurements are imported to compare with static findings.
- An agent is asked to check whether a change justifies the expected gain.
Not a fit when
- You need a profiler that launches workloads and collects metrics itself.
- You need automatic code rewriting.
- The repository is in a language the scanners do not support.
Example request
Scan the repository with smokinggun and show the top three complexity hotspots with the risk of changing them.Limitations
Static scan findings are candidates rather than proof, and a gain must be confirmed by measurement. Node version 22.18 or newer is required. Input must be valid UTF-8 or the tool rejects it, and pprof numbers outside the safe JavaScript integer range are rejected. Running through `npx` may contact the npm registry. The skill is installed with a separate command, and the CLI does not change agent settings.
How to disable. Remove the package with `npm uninstall -g smokinggun` and the skill folder from the agent directory. Delete reports saved to disk by hand.
FAQ
How do I scan without installing?
With `npx --yes --package=smokinggun -- smokinggun scan .`. It may contact the npm registry.
Which report formats exist?
Markdown and SARIF: `smokinggun scan . --format sarif --output smokinggun.sarif`.
Does the tool change code?
No. Static scanning only reads files, works offline and does not execute repository code.
What does the runtime profile hide?
Findings from tests, documentation, examples and fixtures. For a full pass use `--source-profile all`, and for one area use `--only <path>`.
Where do measurements come from?
From existing benchmarks and profiles imported as separate evidence. The tool launches no workload itself.
Discussion
No questions or reviews yet.
Related
CLI toolsA performance CLI that lets an agent compare branches, find slow spots and confirm a speedup with numbers.
Behavioral eval lab Quorum for the superpowers project: drives real agent CLIs and grades them against private criteria
A CLI for performance measurement and regression detection; the repository also holds a plugin with two skills and MCP for Claude Code and Cursor
A CLI that tests AI agents end to end: derives scenarios from code, runs them live and separates unverified from failed.
Caliper runs agent tasks with and without your skill, then shows whether the skill helps and how many tokens it costs
CLI checks a web page in Chromium: finds every control, uses it and reports what broke. No tests to write and no LLM.
README in short
The tool builds reports from an immutable snapshot of the sources and states coverage honestly. The skill and the CLI are installed separately.