LOCAL-FIRST DEVELOPER TOOL

Detect Contract Drift Before It Reaches Production.

A deterministic, offline-capable CLI that compares OpenAPI and TypeScript contracts, analyzes local Git change risks, and calculates repository health. No LLM required.

v0.1.11,270 Tests PassingLocal-FirstNo LLM Required

Get StartedView Repository

Verified DevGuard Book demo terminal output: 4 findings, 4 scenarios, health score 57 out of 100, and HIGH_RISK label.
Verified fictional Book demo — reports are Markdown and JSON.

WHY DEVGUARD

Common Risks in Repository Changes

Contract Drift

Backend OpenAPI schemas and frontend TypeScript types evolve independently, increasing the risk of runtime integration defects.

Sensitive Changes

Configuration, policy, and other sensitive files may change without enough review or test context.

Missing Test Evidence

Production code may change without corresponding test-file changes or configured evidence.

HOW IT WORKS

Deterministic Analysis Pipeline

  1. 1. ConfigurationReads .devguard.yml
  2. 2. Git changesComputes merge-base-aware changes
  3. 3. NormalizationNormalizes mapped OpenAPI and TypeScript contracts
  4. 4. AnalysisProduces contract and repository-risk findings
  5. 5. Scenarios and scoreGenerates deterministic test scenarios and health score
  6. 6. PublicationWrites Markdown and JSON reports

VERIFIED BOOK RESULT

Evidence, not assumptions

57/100Health score
HIGH_RISKHealth label
4Findings
4Scenarios

The fictional Book case identifies pageCount as OpenAPI integer versus TypeScript string, a required authorId absent from TypeScript, a sensitive config/access-policy.json change, and a service change without expected related-test evidence.

contract.incompatible-type contract.missing-property risk.sensitive-file-change risk.missing-related-tests

DevGuard Markdown health report showing score, summary, and Book findings.
Reviewer-readable Markdown health report
DevGuard CLI help showing usage, analyze command, help, and version options.
Discoverable local CLI commands

QUALITY POLICY

Thresholds preserve evidence

After a successful analysis, DevGuard publishes reports before evaluating --fail-below. A missed threshold returns exit code 1, allowing external automation or CI jobs to enforce a quality policy.

  • 56 passes with exit 0
  • 57 passes with exit 0
  • 58 returns exit 1 after report publication
devguard analyze local --config .devguard.yml --fail-below 56
devguard analyze local --config .devguard.yml --fail-below 57
devguard analyze local --config .devguard.yml --fail-below 58
Verified Book demo threshold output: 56 and 57 exit zero; 58 exits one after reports are published.
Verified threshold behavior

REPOSITORY WORKFLOW

Quick Start

Install the published package for project-local use, or run the verified demo directly from the repository. 

git clone https://github.com/ZarakiLancelot/devguard.git
cd devguard
corepack enable
pnpm install
pnpm build
pnpm demo

View the npm package 

npm install --save-dev @edwineinsen/devguard@0.1.1
npx --no-install devguard --help

For repository-local direct CLI execution:

node dist/cli/index.js analyze local --config .devguard.yml

Read the configuration reference on GitHub.

CURRENT SCOPE

Designed for a focused local MVP

Core properties

  • Deterministic and local-first
  • Offline-capable core; no LLM required
  • Markdown and JSON reports
  • Explicit quality-threshold outcomes

Limitations

  • Local repositories only; no GitHub pull-request integration or remote fetching
  • Intentionally limited supported OpenAPI and TypeScript subsets
  • No automatic code fixes; scenarios are suggestions, not executable tests
  • Not a vulnerability scanner, complete SAST tool, or hosted service