md-audit

Run a read-only code audit that greps the working directory for hard-coded secrets, tokens, and passwords, plus unhandled errors and type-safety gaps. Findings are returned as a report sorted by severity from Critical to Low with file and line references.

Dead code detection works by identifying exported symbols that have no corresponding import anywhere in the repository. The audit flags these dead exports alongside TODO, FIXME, and HACK comments that signal known technical debt.

No, a read-only audit only uses Read, Grep, and Bash to inspect files and never edits anything. It stops after producing the findings report and does not apply any fixes.

The audit identifies the primary language by looking for manifest files such as package.json, Cargo.toml, go.mod, or pyproject.toml. It then scopes its scan to the detected project's entry points and source files.

A grep-based audit relies on pattern matching, so it can miss context-dependent bugs and may produce false positives on secrets or dead code. It is best used as a fast first-pass scan rather than a replacement for deep static analysis or manual review.