shadscan is a deterministic static analysis tool designed specifically for React applications using shadcn components. Developed by OrcDev, this CLI tool audits your project's codebase to evaluate UI fundamentals, including accessibility, state management, navigation, form structure, metadata, and production-level polish. Unlike general-purpose linters, shadscan is built to provide consistent, reproducible scores on every run, making it ideal for integration into development workflows and CI/CD pipelines.

Functionality centers on performing static analysis of your source code to identify regressions or missing UI patterns. It reads your project structure and configuration files to build a render graph, allowing it to understand how components are composed and how data flows through them. It does not execute your code or require an AI connection to function; it operates locally by analyzing source patterns to return a report that includes an overall score, category breakdowns, cited evidence, and actionable fixes.

Some of the key features are:

• Deterministic Audits: Ensures the same results for the same source code on every execution, crucial for CI consistency.
• Agent-Ready Remediation: Generates a paste-ready Markdown handoff that groups findings into actionable tasks, decisions, and verification steps.
• CI Integration: Includes support for exit-code score gates with --fail-under, allowing teams to block merges if the project score drops below a set threshold.
• Framework Support: Native adapters for Next.js, Vite, TanStack Start, Laravel (Inertia), and Astro ensure accurate auditing of framework-specific conventions.
• Interactive Workflow: Offers a post-scan menu allowing developers to copy remediation plans, launch coding agents, or configure score gates easily.
• Private and Secure: The CLI runs locally on your machine, ensuring no source code or scan telemetry is ever uploaded or processed by external services.
• GitHub Action: Provides a composite action to automate audits, update job summaries, and manage tracked issues in your repository.

To use the tool, you run a one-shot command from the root of your project using pnpm dlx @shadscan/cli, npx, or similar package runners. This eliminates the need for project-level installations. After scanning, you can choose to output the results as a human-readable report, a machine-readable JSON file for automation, or a Markdown prompt specifically formatted for AI coding agents like Claude Code or Codex. The CLI also includes configuration utilities to add score gates as Git pre-commit hooks, ensuring that any code committed meets established quality standards.

Some common use cases include:

• Automated Quality Gates: Enforcing minimum UI scores in CI/CD pipelines to prevent accessibility or production polish regressions from reaching production.
• AI-Assisted Refactoring: Generating structured task lists from scan findings to feed directly into coding agents for rapid, evidence-based remediation.
• Onboarding and Standards: Using the tool to baseline the state of a new or legacy project and track improvements over time against consistent metrics.
• Component Compliance: Ensuring that custom-built or extended shadcn components maintain their intended composition and accessibility contracts.