LucidShark - Code quality pipeline for AI agents

TL;DR

TL;DR: LucidShark runs linting, type checking, security scanning, tests, coverage, and duplication detection in a single local-first CLI — built to give AI coding agents structured, actionable feedback.

Source and Accuracy Notes

• Project page: lucidshark.com
• Source repository: github.com/toniantunovi/lucidshark
• License: Apache 2.0 (verified via LICENSE file)
• HN launch thread: news.ycombinator.com/item?id=47424142
• Stars: 19 (verified via GitHub API)

What Is LucidShark?

As AI agents increasingly write production code, LucidShark acts as a quality gate — automating checks that would otherwise bottleneck in manual code review. It runs 10 quality domains in a single pipeline: linting, formatting, type checking, SAST, SCA, IaC validation, container scanning, tests, coverage, and duplication detection.

The core loop:

AI writes code → LucidShark checks → AI fixes → repeat
```bash

It is **local-first** — no server, no SaaS account, no data leaving your machine. Configuration lives in `lucidshark.yml` version-controlled with your project.

## Setup Workflow

### Step 1: Install

```bash
curl -fsSL https://raw.githubusercontent.com/toniantunovi/lucidshark/main/install.sh | bash
```bash

This downloads the standalone binary to your current directory. Always use `./lucidshark` to run the project-specific version.

### Step 2: Initialize with Claude Code

```bash
./lucidshark init
```bash

This creates `lucidshark.yml`, the MCP config at `.mcp.json`, and a Claude skill at `.claude/skills/lucidshark/SKILL.md`. Restart Claude Code after running this.

### Step 3: Run a scan

```bash
./lucidshark scan --all
```bash

Scan individual domains:

```bash
./lucidshark scan --linting --type-checking --sast
```bash

Auto-fix linting issues:

```bash
./lucidshark scan --linting --fix
```bash

### Step 4: Optional — Autoconfigure

Ask Claude Code:

```bash
"Autoconfigure LucidShark for this project"
```bash

Claude analyzes your codebase, asks a few questions, and generates a tailored `lucidshark.yml`.

## Deeper Analysis

### Incremental scanning by default

LucidShark scans only uncommitted changes (staged, unstaged, and untracked files) without extra flags. For a full project scan:

```bash
./lucidshark scan --all --all-files
```bash

For CI/PR pipelines, filter to files changed since a base branch:

```bash
./lucidshark scan --all --base-branch origin/main

Strict mode

LucidShark runs in strict mode by default — all configured tools must run successfully. If a tool is missing, not applicable, or fails, the scan fails with a HIGH severity issue and fix suggestions.

Security tools (Trivy, OpenGrep, Gosec, Checkov), PMD, Checkstyle, SpotBugs, ktlint, and detekt are downloaded automatically on first use.

10 quality domains

Domain	Tools covered
Linting	ESLint, Ruff, ShellCheck, hadolint
Formatting	Prettier, Black, gofmt
Type checking	mypy, tsc, Flow
SAST	OpenGrep, Gosec, Semgrep
SCA	Trivy, Dependabot
IaC	Checkov, tfsec
Container	Hadolint, Trivy
Testing	pytest, jest, go test
Coverage	Coverage.py, Istanbul
Duplication	CPD/PMD, duplicate-checker

AI-native feedback loop

LucidShark ships with native Model Context Protocol integration. AI agents receive structured per-issue feedback they can act on directly — write code, scan, fix, repeat.

Practical Evaluation Checklist

• curl -fsSL .../install.sh | bash completes without error
• ./lucidshark init creates lucidshark.yml, .mcp.json, and .claude/skills/
• ./lucidshark doctor reports a healthy setup
• ./lucidshark scan --linting runs against a small project
• ./lucidshark scan --all --all-files completes on a test codebase
• Output format options (--format table, --format json) work correctly

Security Notes

• All processing happens locally — no data is sent to any external service
• Security tool binaries are downloaded on-demand from their official sources (GitHub releases, PyPI)
• lucidshark.yml can be audited in source control like any other project file

FAQ

Q: Does it replace pre-commit hooks? A: No. LucidShark is designed as an AI agent quality gate and CI check, not a direct pre-commit replacement. You can run it in a pre-commit hook, but the primary use case is AI-assisted development loops and CI pipelines.

Q: Which languages are supported? A: Full support for Python, TypeScript, JavaScript, Java, Kotlin, Rust, Go, C#, C, C++, Scala, Swift, Ruby, and PHP — with per-language tooling for linting, formatting, type checking, testing, coverage, security, and duplication detection.

Q: Is it free? A: Yes. LucidShark is Apache 2.0 licensed and fully open source.

Conclusion

LucidShark solves the碎片化 problem of AI-assisted development: instead of chaining ESLint + mypy + Trivy + coverage.py separately, you get one CLI that runs 10 quality domains with a consistent output format. The local-first design keeps code private, and the MCP integration makes it a natural fit for agentic engineering workflows.

If you are using Claude Code or another AI coding agent in a production or team context, adding lucidshark scan as a quality gate is a low-friction way to catch issues before they compound.

Install: curl -fsSL https://raw.githubusercontent.com/toniantunovi/lucidshark/main/install.sh | bash