Cross-file root causes
Connect caller sites, render cascades, circular dependencies, and architecture boundaries instead of reviewing isolated warnings.
Polyglot static analysis & remediation
Know how healthy your codebase is.
dotore finds cross-file root causes, explains their blast radius, and applies deterministic fixes across JavaScript, TypeScript, React, Angular, Python, and Rust.
cargo install --git https://github.com/joaodavidsilva/dotore.git
Installs the dotore CLI directly from GitHub. Requires the Rust toolchain.
$ dotore check .
Critical · 8 files · 16 findings · 4 errors, 12 warnings
api 64/100 · cli 52/100 · web 53/100
py-security-no-unsafe-deserialization-or-shell
autofix · api/main.py:5:12
yaml.load(...) without SafeLoader allows arbitrary Python object instantiation; use yaml.safe_load(...) instead.
rs-no-unwrap-in-production
surgical · cli/src/main.rs:2:66
Avoid
.unwrap() in production Rust code; propagate errors with ?, match with let ... else, or use .unwrap_or_default().
no-derived-state
autofix · web/src/components/CheckoutCard.tsx:7:21
Avoid storing derived state. Instead, compute "fullName" directly during render.
Render #1 (stale derived value) -> useEffect runs -> sets "fullName" -> Render #2 (re-renders with derived value)
Render #1 (stale derived value) -> useEffect runs -> sets "fullName" -> Render #2 (re-renders with derived value)
+ 13 more findings across api, cli, and web
api/main.py- return yaml.load(open(path).read())+ return yaml.safe_load(open(path).read())- return requests.get(url)+ return requests.get(url, timeout=10.0) web/src/components/CheckoutCard.tsx- const [fullName, setFullName] = useState("");- useEffect(() => { setFullName(`${first} ${last}`); }, [first, last]);+ const fullName = `${first} ${last}`; Applied 3 autofixes across 2 files.Real output from a small demo workspace (a React app, a Python API, a Rust CLI) seeded with common mistakes.
1,076Rules
0–100Health score
3Remediation tiers
1Rust binary
Features
Cross-file analysis, only the rules you need.
Parse each file once, build a cross-file project graph, and activate only the rules that match your project.
Deterministic autofixes
Apply syntax-verified AST byte-range patches with dotore fix, or preview every change with --dry-run.
Automatic capability gates
Manifests determine active rules. React checks stay out of Angular projects, and libraries skip application-only checks.
Prioritized remediation
Group findings by root cause and blast radius, then generate Fix Capsules ranked from P0 to P3.
Diff-aware adoption
Scan changed files, contextual owners, or changed lines. Baselines let legacy repositories block only new regressions.
Coding-agent handoff
Send structured findings, source excerpts, invariants, and suggested patches to your coding agent.
Real output
What dotore reports on a real run.
Output from dotore 0.1.0 on the same demo workspace. The plan ranks 13 findings, why explains one in full, and the project graph finds import cycles and unused exports.
$ dotore plan .
# Pri Blast Rule Where001 P1 86 no-derived-state Cart.tsx:3002 P1 60 rs-no-unwrap-in-production main.rs:1003 P1 55 no-pass-live-state-to-parent Cart.tsx:3004 P2 42 jsx-no-new-array-as-prop App.tsx:4...011 P3 15 circular-dependency a.ts:1012 P3 15 rs-cargo-missing-lockfile Cargo.toml:1013 P3 15 unused-export b.ts:3Ranked by blast radius. Each row is a Markdown plan in plans/ with the code excerpt, a transformation recipe, and the invariants to preserve.
$ dotore why web/src/components/Cart.tsx:6
no-pass-live-state-to-parent
warning · refactor · P1 (score 55)
Avoid passing live state to parent components in an effect. Instead, lift "total" state up to the parent of "Cart", and pass it down to "Cart" as a prop.
Render #1 updates local state (total) -> useEffect runs -> calls prop `onTotal` -> Parent re-renders and cascades back down
Render #1 updates local state (total) -> useEffect runs -> calls prop `onTotal` -> Parent re-renders and cascades back down
4 | const [total, setTotal] = useState(0); 5 | useEffect(() => { setTotal(items.reduce((a, b) => a + b, 0)); }, [items]);> 6 | useEffect(() => { onTotal(total); }, [total]); 7 | return <div onClick={() => setTotal(0)}>{total}</div>;Recipe: call the parent callback alongside setState in the event handler, or lift the State Slot up to the parent Subject.
circular-dependency
refactor · web/src/a.ts:1:1
Runtime import cycle: ./web/src/a.ts → ./web/src/b.ts → ./web/src/a.ts. Modules in the cycle can observe partially initialized exports.
unused-export
surgical · web/src/b.ts:3:1
Unused value export:
neverUsed has no importer in the analyzed project graph.From findings to fixes
Check, plan, fix.
Start with zero configuration, then adopt diff-aware checks and agent handoffs where they help.
Check the workspace
Run static analysis across your project and calculate its deterministic Health Score.
dotore check --score
Plan the remediation
Group related findings into root causes with caller-site and blast-radius context.
dotore plan
Apply verified fixes
Preview safe rewrites, apply them, or hand the complete remediation bundle to an agent.
dotore fix --dry-run
JavaScriptTypeScriptReact & Next.jsAngularPythonRustReact NativeThree.js & WebGL
Questions
Using dotore with your existing tools.
Why use dotore alongside ESLint, Ruff, and Clippy?
dotore analyzes multiple ecosystems in one Rust binary and adds cross-file caller sites, render cascades, root-cause grouping, Fix Capsules, and a shared Health Score. Rules activate automatically from your manifests.
Can I adopt it incrementally in a legacy monorepo?
Yes. Use dotore check --scope contextual --base origin/main or dotore check --baseline baseline.json so CI focuses on changed code or newly introduced regressions.
How does coding-agent handoff work?
Run dotore check --handoff. dotore creates a structured remediation bundle with subject and caller-site excerpts, invariants, and exemplars, then launches a supported coding agent or prints the bundle.
Does dotore require configuration?
No. It works out of the box and infers capabilities from package.json, angular.json, pyproject.toml, and Cargo.toml. Optional configuration can override rules, ignored files, and tags.
Check your workspace.
Install from source, run one command, and turn flat diagnostics into a prioritized remediation plan.