Architecture

ArchSutra AI

Get an evidence-tagged architecture and threat-model review.

Architecture audit, design, and threat-modeling skills for Claude Code, Cursor, Codex, GitHub Copilot, and Gemini CLI, plus an offline CLI.

  • Offline CLI
  • 19 rules
  • 12 role contracts
Read the guide GitHub repo npm package
GitHub version
0.1.4
Licence
Apache-2.0
Language
TypeScript
Weekly downloads
622
GitHub stars
0

Live npm weekly downloads and the latest npm version, plus GitHub stars and the package.json version, fetched 2026-11-07 20:26 UTC. Cached 10 minutes. Weekly downloads cover 2026-10-31 to 2026-11-06, not a lifetime total.

Use it when

  • 1

    You want architecture audit, design, and threat-modeling skills inside Claude Code, Cursor, Codex, GitHub Copilot, or Gemini CLI.

  • 2

    You want findings that cite file and line with severity and a fix.

  • 3

    You want Mermaid diagrams and SARIF out of an offline CLI.

What it does, and what it does not

Read this before the guide. A limit here is a limit of the tool.

Does

  • The project page lists 36 automated tests, Node 20, 22, and 24, on Ubuntu and Windows, and 0 runtime dependencies.
  • 19 audit rules and twelve role contracts led by Prime.
  • Findings cite file and line, with severity, confidence, a fix, and acceptance criteria. Claims are tagged observed, inferred, proposed, or unknown.
  • Exports Markdown, Mermaid, JSON, and SARIF 2.1.0. A CI gate uses --fail-on high.
  • The project page says 52 public repositories were audited and 98 findings were hand-labeled. It also says precision was measured at 69% then 95% on repositories not used for tuning, with wide intervals and one labeler.
  • Adapters write files for Claude Code, Cursor, Codex, GitHub Copilot, and Gemini CLI. The page labels that level "adapter": layouts match vendor docs, live smoke tests are pending.

Does not

  • It does not certify compliance or security. Absence of findings is not proof of absence of vulnerabilities.
  • The page says live IDE behavior, an independent security review, trademark clearance, and a lawyer review are not proven yet.
  • Reliability, performance, and cost stay "not assessed" unless evidence exists.
  • The CLI sends nothing and has no telemetry. Skills use the IDE model under that vendor's terms.

Claims above are from the project pages and are attributed as stated there. They are not independently verified here.

How a run moves

From the ArchSutra project page, version 0.1.4. The CLI measures. Inside an IDE, that vendor's model reasons. Neither needs an ArchSutra key.

  1. 1. Input

    Files, or an IDE

    The CLI reads the repository offline. Skills can sit in Claude Code, Cursor, Codex, GitHub Copilot, or Gemini CLI.

  2. 2. Check

    19 rules

    Each claim is tagged observed, inferred, proposed, or unknown. Twelve role contracts are led by Prime.

  3. 3. Finding

    File and line

    Severity, confidence, a fix, and acceptance criteria. Reliability, performance, and cost stay "not assessed" unless evidence exists.

  4. 4. Export

    Review aid

    Markdown, Mermaid, JSON, and SARIF 2.1.0. --fail-on high is the CI gate. Absence of findings is not proof of no vulnerabilities.

How to read the result

Result It means It does not mean
observed The page uses this tag when the claim was seen in the files. The report is still a review aid, not a compliance certificate.
No findings Nothing matched this scan. Not proof that vulnerabilities are absent.
Adapter skills Files are written to match vendor docs. The page says live IDE smoke tests are pending.

Wording is from the project page or README and is attributed as stated there. It is not independently verified here.

Commands and notes

  • The project page shows: npx github:shahvatsalofficial/archsutra-ai audit .
  • npm package name is archsutra-ai at 0.1.4.

Guide

How to use the result. GitHub is the source repository. npm is the install.

What the project page claims

ArchSutra AI 0.1.4. The page says the CLI measures and the IDE model reasons. Neither needs an ArchSutra key.

  • Every claim is tagged observed, inferred, proposed, or unknown.
  • Findings cite file and line, with severity, confidence, a fix, and acceptance criteria.
  • Twelve role contracts led by Prime: security, data, cloud, integration, AI, reliability, cost, delivery, and verification.
  • Exports Markdown, Mermaid, JSON, and SARIF 2.1.0. A CI gate uses --fail-on high.
  • The page lists 36 automated tests, Node 20, 22, and 24, on Ubuntu and Windows, and 0 runtime dependencies.

Where the skills are written

The page calls every host "adapter": files match vendor docs. Live smoke tests are pending.

  • Claude Code: .claude/skills/ and .claude/agents/.
  • Cursor: .cursor/skills/ and .cursor/agents/.
  • OpenAI Codex: .agents/skills/ plus AGENTS.md. No agents folder.
  • GitHub Copilot: .github/skills/ and .github/agents/*.agent.md.
  • Gemini CLI: .gemini/skills/. No agents folder.
  • The page says those layouts were checked against vendor docs read on 2026-11-01.

Trust numbers, and what is not proven

  • The page says 52 public repositories were audited and 98 findings were hand-labeled.
  • It says precision started at 50%, was fixed, then measured 69% and later 95% on repositories not used for tuning, with wide intervals and one labeler.
  • It says about half of valid findings need no action.
  • Not proven yet, in the page's words: live IDE behavior, an independent security review, trademark clearance, and a lawyer review.
  • Reports are review aids. Absence of findings is not proof of absence of vulnerabilities. Nothing there is legal advice or a compliance attestation.

Questions

Do I need an ArchSutra API key?

No. The project page says the CLI is offline. Inside a supported IDE the skills use that IDE's model, so you need access to the IDE, not an ArchSutra key.

Does ArchSutra certify architecture or security?

No. The project page says reports are review aids and nothing there is legal advice or a compliance attestation.

Other projects

WhatsApp