charter ── readiness for AI-agent codebases

AI-agent readiness, scored.

AI agents are only as good as the repo they work in — missing context, exposed secrets, and unpinned tools quietly wreck their output. Charter grades yours in under two seconds: a 0–100 readiness score across nine categories, every gap paired with a concrete fix. No cloud, no account, no telemetry — it runs fully offline, and the same check holds the line in CI.

brew install use-charter/tap/charter
free & open source · apache-2.0 · slsa l3
charter@acme-api: doctor offline · 0 net
charter doctor --strict
✓ 8 paths · 18 rules · 9 categories · 1.84s · 3 findings
82 PASS ✓ 82/100 readiness exit 0 · strict
Context 3/4
Secrets 2/2
MCP Safety 2/3
Agent Config 2/2
Environment 1/1
CI 1/1
Testing 1/1
Autonomy 0/1
Governance 3/3
82/100 · PASS min 80 3 findings 0 network calls
--agents # one score, every coding agent you run
Claude Code
Cursor
Copilot
Windsurf
Codex
Gemini
Replit
Zed
18 rules checked
9 categories
3 findings · 2 fixable
1.84s cold scan
0 network calls
01charter explain --catalog18 rules · 9 categories

Nine categories. One honest score.

Agents trip on the same handful of things — missing context, secrets in plain sight, an unpinned MCP server, no way to verify their own work. This is the real v1 catalog: every rule carries an ID, a severity that sets its score weight, and the exact thing it checks.

charter explain --category mcp 1 finding · 3 rules
HIGH
AE-MCP-001MCPServerPinned
Every MCP server is pinned to an exact, non-deprecated version. · .mcp.json:7
auto-fix
HIGH
AE-MCP-002MCPRemoteTrusted
Remote MCP origins resolve from the catalog or a trusted allowlist.
HIGH
AE-MCP-003MCPRemoteAuthDeclared
Remote MCP servers declare authorization metadata.
02charter --help7 commands · v1.0.0

A small, sharp command surface

No dashboard. No account. No telemetry. Seven commands that behave identically in your shell and in CI. Click any one to watch it run.

charter doctor — ~/acme-api
acme-api main charter doctorChecked 18 rules · 9 categories · 3 findingsHIGH AE-MCP-001 MCP SafetyMEDIUM AE-AUTO-001 AutonomyScore 82/100 ████████████████░░░░ PASS ✓

Scan the repo and print a 0–100 readiness score with a per-category breakdown. Exit 0 pass, 1 below threshold, 2 error.

03charter history --scoreinit → doctor → fix → gate

The score only ratchets up

Readiness isn't a one-time cleanup. Charter walks a repo from an honest baseline to ship-ready, then turns the score into a wall every pull request has to clear.

Scaffold
❯ charter init
Generate AGENTS.md, charter.yaml and .gitignore — the context every agent expects to find.
20%
baseline ready
Score
❯ charter doctor
A static scan across nine categories returns your first honest number — usually 40–60.
52%
52 / 100 · first scan
Repair
❯ charter fix
Approve diff-first fixes for the safe rules. Secrets and destructive commands are never auto-touched.
84%
84 / 100 · +32 points
Gate
❯ charter-action@v1
CI re-scores every pull request and blocks merges below threshold. From here the score only ratchets up.
84%
ship-ready · gate ≥ 80
04cat .github/workflows/charter.ymlSARIF 2.1.0 → code scanning

Make the score a merge requirement

Add one workflow and Charter re-scores every pull request, failing the check when the score drops below your threshold. Findings post as SARIF 2.1.0, so they land inline in GitHub Code Scanning — no new dashboard to learn.

1charter.ymlcommit once
2scan + scoreon every PR
3SARIF 2.1.0code scanning
.github/workflows/charter.yml
# .github/workflows/charter.yml
name: Charter
on:
pull_request:
permissions:
contents: read
security-events: write
jobs:
charter:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: use-charter/charter-action@v1
with:
threshold: "80" # fail PRs below this
verify: true # cosign + sha256
PR #412
Wire the agent task runner#412
build2m 04s
test1m 31s
lint0m 42s
charter / readiness 82 / 100 · min 80 PASS ✓
✓ All checks have passed
05charter version --verifythe contract

No cloud. No account. No catch.

Charter runs entirely on your machine and shows its work. The whole contract is a handful of flags you can verify yourself — right down to the signature on the binary.

Nothing ever leaves your machine.

No network, no LLM calls, no telemetry. Charter reads your files locally and prints a number. That's the entire deal.

--offline · 0 network calls · always
--license apache-2.0

Free, forever

Open source and permissively licensed. Vendor it, fork it, ship it inside your own tooling — no seat count, no expiry.

--slsa 3

Supply-chain signed

Every release ships SLSA Level 3 provenance, cosign-signed. Verify the exact binary you install.

--format sarif

Standards in, standards out

SARIF 2.1.0 drops straight into GitHub Code Scanning and the tools you already run.

❯ charter version --verify
binary charter v1.0.0
cosign verified ✓
sha256 a1b2c3d…e9f
slsa level 3
sbom attached ✓
network 0 calls