what it does Reading the machine's work
Described to an assistant, assembled in an afternoon, shipped on trust — more software than ever is owned by someone who has never read it. One command maps every way into your application, what each one really does, and — on every scan after the first — what changed. Nothing is uploaded. The report is a single file that works offline.
npx what-it-does · free · MIT · runs on your machine
npx what-it-does scan 01scan 02
28 ways in · nothing looked wrong 1 new thing worth checking
28 ways in 5 findings
A fictional team app, written to be scanned. Five findings of the kind this code really produces — a checkout nobody protected, a delete that lost its guard — each with a fix prompt to paste straight into your AI.
801 ways in 0 findings
The same scanner on dub's real open-source monorepo — 4,000 files of production code. It reports nothing, because there is nothing there to report. A tool you can trust is one that stays quiet on good code — and we measured what happens when it does not.
A scan tells you what your application does today. Next week somebody merges a change and it does something else, and nobody runs the command again. That is not a discipline failure — it is what happens to every tool that has to be remembered. So the pull request check does not need remembering. It reads the base branch, reads yours, and speaks only when the answer changed.
what it does
This changes what your application can do in
1 way, compared with main.
1 new thing worth checking.
DELETE /api/test-slettDeletes rows from notater — with no visible check on who is asking
app/api/test-slett/route.ts:10
9 other behaviours unchanged. Read locally with
npx what-it-does.
The whole of the setup
name: what it does
on: pull_request
jobs:
behaviour:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: rolfe099-sketch/what-it-does/action@v1fail-on-new.
One command, MIT, no account, nothing uploaded. The pull request check that runs the same comparison on every change is under the same licence, on any repository, with no key to configure. There is nothing on this page to buy.
Every way into your application and what each one does, as one HTML file you can read offline. Any project, private or not. No account, and no network at all.
npx what-it-does
Reads the base branch, reads yours, and comments only when the behaviour changed. Silent otherwise, and it fails your build over a finding only if you ask it to. Two minutes to set up.
rolfe099-sketch/what-it-does/action@v1
The field behind this section is tidepool's real dependency graph — 15 resources, 24 connections, laid out by the scanner itself from the report above. The pull request comment is a real one, lifted from a real pull request. Nothing in this section is a mockup.
Aion The same idea, elsewhere
Not the work that pays the bills — it is the most technically ambitious thing here, and the source is public. The same instinct runs through it: Aion reads files and calls language models, and deliberately cannot run shell commands.
An agent asked to review forty files reads them one at a time, filling the conversation with material nobody will read and billing every file to an expensive model. Aion takes the mechanical part: one call per file, run at once, merged into a single answer. Across nine real jobs it kept 64.7% of what was produced out of the conversation.
Then the harder question, and the one most tools never ask: will an agent actually reach for it? A benchmark harness was built to find out, and the first answer was unflattering.
Does the agent actually reach for it?
Eighteen scenarios. Zero false positives — never reached for where it should not have been.
One forty-file review. 98.6% of what it produced never entered the context window — 64.7% aggregate across nine jobs.