supercov weekly downloads statistics

Coverage, security and code quality for coding agents

Supercov tells your coding agent what to fix and what to test. It scores your code quality and flags security risks with Jev, runs the test command you already use, and turns uncovered paths into small, actionable queries. Your agent picks a target, writes a focused test or a focused refactor, proves what improved, and keeps going.

Paste this to your coding agent to start:

Measure code quality with npx supercov.

Scoring needs a TypeSafe AI API key, and your coding agent will usually ask you for it. It costs about a cent per megabyte of source. Coverage needs no account, config file, import, custom reporter, or hosted service. Supercov is local, free, open source, and MIT licensed.

Website · Documentation · npm · GitHub · Discord

Supported languages: JavaScript · TypeScript · Rust · Python · Ruby · Go · Java · Kotlin.

In Claude Code, Codex and Gemini CLI you can also install it as a plugin.

Supported by Supercorp.

Agent workflow: ask your coding agent to add a test in your own project, with a recorded example to follow along.

Score your code

export TYPESAFE_API_KEY=...   # get one at https://typesafe.ai
npx supercov quality

No arguments and no configuration. It finds your source, asks Jev a set of yes/no questions about each file, and does the arithmetic itself, so every part of a score is a claim you can check against the file.

Quality weak (3.8/10) over 163 files.
  11 good, 52 fair, 100 weak.

Weakest:
  weak  runtime/python/supercov_runtime.py
        long_method 0.96, deep_nesting 0.92, complex_conditional 0.89, +9 more
  weak  crates/supercov-engine/src/assertion_store.rs
        long_method 0.96, deep_nesting 0.91, complex_conditional 0.86, +8 more

Narrow to what fired, read one file in full, or review a change:

npx supercov quality gaps
npx supercov quality file src/server.ts
npx supercov quality patch                    # your uncommitted work, or your branch
npx supercov quality patch --annotate github  # workflow annotations, no token

Jev charges for what it reads and nothing for what it writes, so a megabyte of source costs a little over a cent. Answers are cached by content, so a second run pays only for what changed. See Understanding quality.

Find security risks

npx supercov security
npx supercov security patch   # what a change introduced

Twelve security checks asked of every file with the same key, from injection and secrets in source to paths and redirects taken from a request. Nothing is averaged: a file is clean, or it names what fired, with the line and the code on it where Jev confirms one. See Security surface.

Start with the suite you already have

npx supercov -- npm test

Other ways in, all the same binary at the same version: brew install supercorp-ai/tap/supercov, or for a Go project go run github.com/supercorp-ai/supercov/cmd/supercov@latest.

Everything after -- is your test command. Supercov runs it without changing your source, tests, runner configuration, or normal build output.

Then read the result and ask what is still uncovered:

npx supercov runs latest

run run_7fc676ba671d42be
command: npm test

Coverage
  Lines      100.00% (5/5)
  Branches   66.67% (4/6)
  MC/DC      33.33% (1/3)

npx supercov runs latest gaps --limit 10

Coverage gaps — only files with unresolved obligations

src/pricing.js
  uncovered: lines 0  statements 1  functions 0  branch outcomes 0  MC/DC conditions 2

After your agent adds a test, rerun the complete suite and prove the gain:

npx supercov -- npm test
npx supercov diff <previous-run-id> latest

Want to hand the evidence to a person? Generate one private, interactive file:

npx supercov report

The report opens in your browser with up to ten recent runs in a visual history. Selecting a run compares it with the previous snapshot automatically. It has no server, external assets, account, or file picker. It is written to .supercov/reports/, where the store's own .gitignore keeps it out of git. You can attach that one file directly to a pull request; a reviewer downloads it and double-clicks it.

Use whichever complete test command the repository already trusts:

npx supercov -- npx playwright test
npx supercov -- pnpm test:e2e
npx supercov -- cargo test
npx supercov -- cargo nextest run
npx supercov -- pytest
npx supercov -- python -m unittest
npx supercov -- bundle exec rspec

See what the tests assert

Coverage says which code ran; assertion coverage says which of it the tests would catch breaking. Supercov asks Jev, test by test, whether changing each statement the test ran would make it fail:

npx supercov -- npm test
TYPESAFE_API_KEY=... npx supercov runs latest assertions assess
npx supercov runs latest assertions   # the share asserted and what is not

Answers are reused across runs whenever the question is the same, so after a commit only what changed is asked again. Every language Supercov measures. See assertion coverage.

Give Supercov a job…