fallow-rs/fallow

<p align="center" <picture <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo-dark.svg" <source media="(prefers-color-scheme: light)" srcset="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo.svg" <img src="https://raw.githubusercontent.com/fallow-rs/fallow/main/assets/logo.svg" alt="fallow" width="290" </picture </p

<p align="center" <strongCodebase intelligence for TypeScript and JavaScript.</strong<br One binary finds unused code, circular dependencies, duplication, complexity hotspots, boundary violations, and design-system styling drift. An optional paid layer, Fallow Runtime, adds production execution evidence.<br <subDeterministic findings and typed output contracts. No AI inside the analyzer, and no TypeScript compiler or Node.js runtime needed for static analysis.</sub </p

<p align="center" <a href="https://www.npmjs.com/package/fallow"<img src="https://img.shields.io/npm/v/fallow.svg" alt="npm"</a <a href="https://www.npmjs.com/package/fallow"<img src="https://img.shields.io/npm/dm/fallow.svg" alt="npm downloads"</a <a href="https://github.com/fallow-rs/fallow/actions/workflows/ci.yml"<img src="https://github.com/fallow-rs/fallow/actions/workflows/ci.yml/badge.svg" alt="CI"</a <a href="https://github.com/fallow-rs/fallow/actions/workflows/coverage.yml"<img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/fallow-rs/fallow/badges/coverage.json" alt="Coverage"</a <a href="https://app.codspeed.io/fallow-rs/fallow?utmsource=badge"<img src="https://img.shields.io/endpoint?url=https://codspeed.io/badge.json" alt="CodSpeed"</a <a href="https://github.com/fallow-rs/fallow/blob/main/LICENSE"<img src="https://img.shields.io/badge/license-MIT-blue.svg" alt="MIT License"</a </p

<p align="center" <a href="https://docs.fallow.tools"Docs</a · <a href="https://docs.fallow.tools/quickstart"Quickstart</a · <a href="https://docs.fallow.tools/integrations/mcp"MCP</a · <a href="BENCHMARKS.md"Benchmarks</a </p

---

Most repositories carry code nobody dares to delete, because deleting means proving a negative: fallow reads the repository as one dependency graph, from import edges to styling tokens, and reports what that graph shows.

Audit scope: 19 changed files vs HEAD~15 (8fbfcb054..HEAD)

● Unused files (2)
  packages/vitest/src/public/reporters.ts
  test/coverage-test/test/configuration-options.test-d.ts

● Circular dependencies (6)
  packages/vitest/src/integrations/vi.ts
    → wait.ts → vi.ts

✗ dead code: 156 issues · complexity: 6 findings · duplication: 8 clone groups · 19 changed files (1.05s)
  audit gate excluded 163 inherited findings (run with --gate all to enforce)

Excerpt from fallow audit on the vitest monorepo, auditing its last 15 commits. fallow 3.5.0, warm base-snapshot cache. The gate passed: the 163 inherited findings are pre-existing and excluded by design, so they do not block the change. The same run with --format json returns one typed JSON document.

Quick start

# Zero-install, full pipeline (dead code + duplication + health)
npx fallow

# Gate only what a PR changed
npx fallow audit

# Install as a devDependency
npm install --save-dev fallow

# For agents and scripts: exit 0 and 1 both mean the run succeeded (1 = findings);
# exit 2 is a real error, reported as a JSON envelope on stdout
npx fallow audit --format json --quiet 2>/dev/null

The npm package ships the fallow, fallow-lsp, and fallow-mcp launchers plus a version-matched agent skill, so the editor and agent integrations resolve the project-local binary instead of whatever happens to be on PATH. Runs are deterministic: the same input produces the same output with stable fingerprints. Re-running to verify an edit is safe. Other channels (pnpm, yarn, cargo install fallow-cli, and a local Docker build with a Compose example at examples/docker/compose.yaml) are covered in the installation guide.

What fallow reports

• Unused files, exports, types, enum and class members, and dependencies
• Circular dependencies and re-export cycles, part of fallow dead-code
• Code duplication with a suffix-array detector covering JS/TS and CSS-family stylesheets, plus Vue/Svelte/Astro component regions
• Complexity hotspots and a 0 to 100 health score with a letter grade
• Architecture boundary violations with bulletproof, layered, hexagonal, and feature-sliced presets
• Design-system styling drift for CSS and CSS-in-JS

• A changed-file PR gate with a pass, warn, or fail verdict (fallow audit)
• Auto-fix with a dry-run preview
• Opt-in security candidates ranked by reachability from entry points (fallow security)
• Optional checker-backed TypeScript evidence for exact symbol usage, cross-file private type leaks, targeted tests, and public-signature coupling (--type-aware)

Over 100 built-in framework plugins detect entry points and framework-consumed exports automatically, so the first run needs no configuration. Fallow Runtime, the optional paid layer, merges production execution evidence into these same reports; see Runtime intelligence (optional) and static vs runtime.

Your first run

Findings on a first run usually mean fallow is missing an entry point or a framework convention, or is analyzing generated files you never meant to include. The built-in plugins take care of framework detection; it's generated code that usually needs a hint:

{
  "$schema": "./node_modules/fallow/schema.json",
  "ignorePatterns": ["**/*.generated.ts"]
}