LucidShark - Code quality pipeline for AI agents

TL;DR

TL;DR: LucidShark runs linting, type checking, security scanning, tests, coverage, and duplication detection in a single local-first CLI — built to give AI coding agents structured, actionable feedback.

Source and Accuracy Notes

• Project page: lucidshark.com
• Source repository: github.com/toniantunovi/lucidshark
• License: Apache 2.0 (verified via LICENSE file)
• HN launch thread: news.ycombinator.com/item?id=47424142
• Stars: 19 (verified via GitHub API)
• Source last checked: 2026-08-04 (commit main branch)

What Is LucidShark?

As AI agents increasingly write production code, LucidShark acts as a quality gate — automating checks that would otherwise bottleneck in manual code review. It runs 10 quality domains in a single pipeline: linting, formatting, type checking, SAST, SCA, IaC validation, container scanning, tests, coverage, and duplication detection.

The core loop:

AI writes code → LucidShark checks → AI fixes → repeat

It is local-first — no server, no SaaS account, no data leaving your machine. Configuration lives in lucidshark.yml version-controlled with your project.

Setup Workflow

Step 1: Install

curl -fsSL https://raw.githubusercontent.com/toniantunovi/lucidshark/main/install.sh | bash

This downloads the standalone binary to your current directory. Always use ./lucidshark to run the project-specific version.

Step 2: Initialize with Claude Code

./lucidshark init

This creates lucidshark.yml, the MCP config at .mcp.json, and a Claude skill at .claude/skills/lucidshark/SKILL.md. Restart Claude Code after running this.

Step 3: Run a scan

./lucidshark scan --all

Scan individual domains:

./lucidshark scan --linting --type-checking --sast

Auto-fix linting issues:

./lucidshark scan --linting --fix

Step 4: Optional — Autoconfigure

Ask Claude Code:

"Autoconfigure LucidShark for this project"

Claude analyzes your codebase, asks a few questions, and generates a tailored lucidshark.yml.

Deeper Analysis

Incremental scanning by default

LucidShark scans only uncommitted changes (staged, unstaged, and untracked files) without extra flags. For a full project scan:

./lucidshark scan --all --all-files

For CI/PR pipelines, filter to files changed since a base branch:

./lucidshark scan --all --base-branch origin/main

Strict mode

LucidShark runs in strict mode by default — all configured tools must run successfully. If a tool is missing, not applicable, or fails, the scan fails with a HIGH severity issue and fix suggestions.

Security tools (Trivy, OpenGrep, Gosec, Checkov), PMD, Checkstyle, SpotBugs, ktlint, and detekt are downloaded automatically on first use.

10 quality domains

| Domain | Tools covered | |---|---| | Linting | ESLint, Ruff, ShellCheck, hadolint | | Formatting | Prettier, Black, gofmt | | Type checking | mypy, tsc, Flow | | SAST | OpenGrep, Gosec, Semgrep | | SCA | Trivy, Dependabot | | IaC | Checkov, tfsec | | Container | Hadolint, Trivy | | Testing | pytest, jest, go test | | Coverage | Coverage.py, Istanbul | | Duplication | CPD/PMD, duplicate-checker |

AI-native feedback loop

LucidShark ships with native Model Context Protocol integration. AI agents receive structured per-issue feedback they can act on directly — write code, scan, fix, repeat.

Practical Evaluation Checklist

• [ ] curl -fsSL .../install.sh | bash completes without error
• [ ] ./lucidshark init creates lucidshark.yml, .mcp.json, and .claude/skills/
• [ ] ./lucidshark doctor reports a healthy setup
• [ ] ./lucidshark scan --linting runs against a small project
• [ ] ./lucidshark scan --all --all-files completes on a test codebase
• [ ] Output format options (--format table, --format json) work correctly

Security Notes

• All processing happens locally — no data is sent to any external service
• Security tool binaries are downloaded on-demand from their official sources (GitHub releases, PyPI)
• lucidshark.yml can be audited in source control like any other project file

FAQ

Q: Does it replace pre-commit hooks? A: No. LucidShark is designed as an AI agent quality gate and CI check, not a direct pre-commit replacement. You can run it in a pre-commit hook, but the primary use case is AI-assisted development loops and CI pipelines.

Q: Which languages are supported? A: Full support for Python, TypeScript, JavaScript, Java, Kotlin, Rust, Go, C#, C, C++, Scala, Swift, Ruby, and PHP — with per-language tooling for linting, formatting, type checking, testing, coverage, security, and duplication detection.

Q: Is it free? A: Yes. LucidShark is Apache 2.0 licensed and fully open source.

Conclusion

LucidShark solves the碎片化 problem of AI-assisted development: instead of chaining ESLint + mypy + Trivy + coverage.py separately, you get one CLI that runs 10 quality domains with a consistent output format. The local-first design keeps code private, and the MCP integration makes it a natural fit for agentic engineering workflows.

If you are using Claude Code or another AI coding agent in a production or team context, adding lucidshark scan as a quality gate is a low-friction way to catch issues before they compound.

Install: curl -fsSL https://raw.githubusercontent.com/toniantunovi/lucidshark/main/install.sh | bash