fallow

Run it in the root of any JS or TS project:

npx fallow

A pull request gate on a fictional storefront monorepo might look like this:

$ npx fallow audit --base HEAD~15
Audit scope: 73 changed files vs HEAD~15

● Circular dependencies (24)
  packages/storefront/src/orders/process.ts (6 cycles)
    → payment.ts → context.ts → process.ts

── Duplication ────────────────────────────────────
⚠ 185 lines (0.2%) duplicated across 6 files

● High complexity functions (28)
  packages/storefront/src/orders/payment.ts
    :566 processPayment CRITICAL
          32 ! cyclomatic   47 ! cognitive  203 lines

── Styling ────────────────────────────────────────
  font sizes mix 3 units (3 px, 2 rem, 1 em; candidate, standardize unless intentional)

✗ dead code: 68 issues · complexity: 28 findings · duplication: 7 clone groups · 73 changed files
  audit gate excluded 98 inherited findings (run with --gate all to enforce)

Illustrative output for a fictional project. The gate fails (exit code 1) on findings in changed files. Findings that existed before the change are excluded.

fallow builds a repository graph of modules, exports, dependencies, functions, and styling tokens. Its analyses use that graph to find complexity, architecture drift, duplication, unused code, and risks in a pull request.

fallow runs in four places. All four read the same config file and use the same analysis engine.

What fallow finds

npx fallow viz opens an interactive HTML map of the project with lenses for health, duplication, architecture, and unused code.

Add --type-aware for exact TypeScript symbol identity across aliases, re-exports, and packages. This optional pass removes false positives from interfaces and base classes (how type-aware analysis works). Runtime coverage from production is an optional add-on that fallow merges into health and audit reports.

The CLI reference lists every command. fallow schema prints all commands, flags, output formats, and exit codes as JSON.

Why teams can depend on fallow

fallow keeps these properties from release to release:

• The same input gives the same output, with a stable fingerprint for each finding. There is no AI inside the analyzer. Only the opt-in similar-code command uses a pinned local model.
• fallow audit fails only on findings that a change introduces. Existing findings do not fail the check.
• It is fast on large codebases. fallow finds the unused code in the next.js monorepo (20,558 files) in 2.95s. Measured on fallow 2.100.0. BENCHMARKS.md has the method and all results, and CodSpeed tracks performance on each change.
• fallow reads npm, yarn, and pnpm workspaces, and --workspace <name> scopes a run to one package.
• Over 100 built-in framework plugins find entry points and framework conventions, so the first run needs no config.
• Each command has a typed JSON output, documented exit codes, and a published output schema.
• Analysis runs on your machine or CI runner. Telemetry is opt-in (what fallow collects).
• The project has a public issue tracker, a public roadmap, and a security policy.

The analyzer is written in Rust and uses Oxc for syntactic analysis. Static analysis needs no TypeScript compiler and no Node.js runtime.

In your terminal

npx fallow                  # health, duplication, and unused code in one run
npx fallow audit            # only the findings that your change introduces
npx fallow fix --dry-run    # preview the auto-fixes, then run `npx fallow fix`
npx fallow health --score   # health score with the largest deductions
npx fallow dead-code --trace src/api.ts:client   # prove an export is unused before you delete it

To keep fallow in the project, install it as a dev dependency:

npm install --save-dev fallow

The npm package includes the fallow, fallow-lsp, and fallow-mcp launchers. For pnpm, yarn, cargo install fallow-cli, and Docker, see the installation guide.

To check each commit before it leaves your machine, install the managed pre-commit hook:

npx fallow hooks install --target git

Adopt fallow on an existing codebase

You do not have to fix every finding before you add fallow to CI.

1. Run npx fallow recommend. It detects the stack and proposes a config. It changes no files.
2. Use fallow audit in pull requests. It compares each pull request with its base branch and blocks only the findings that the pull request adds. It needs no baseline file.
3. For full runs of fallow, dead-code, dupes, or health, save a baseline once with npx fallow --save-baseline fallow-baseline.json. Pass --baseline fallow-baseline.json on each later run, so that only new findings fail.
4. Reduce the backlog when your team has time. fallow fix --dry-run shows the fixes and changes no files. fallow fix applies them.

If findings are caused by missing entry points or generated files, add the missing entry points and exclude the generated files in the config:

{
  "$schema": "./node_modules/fallow/schema.json",
  "entry": ["src/cli.ts"],
  "ignorePatterns": ["**/*.generated.ts"]
}

To keep an intentional export, add a suppression comment:

// fallow-ignore-next-line unused-export -- kept for plugin consumers
export const keepThis = 1;

// fallow-ignore-file <issue-type> suppresses a whole file. JSDoc tags (@public, @internal) keep intentional library API quiet. npx fallow suppressions lists every suppression in the project.

The adoption guide shows the staged path. Configuration has the full reference.

In pull requests

GitHub Actions:

- uses: actions/checkout@v4
  with:
    fetch-depth: 0
- uses: fallow-rs/fallow@v3
  with:
    command: audit

GitLab CI:

include:
  - remote: 'https://raw.githubusercontent.com/fallow-rs/fallow/v3.37.0/ci/gitlab-ci.yml'

fallow:
  extends: .fallow

fetch-depth: 0 is the recommended setup. A default shallow checkout also works for command: audit: the Action fetches the commits that it needs to find the merge base.

To start in report-only mode, add fail-on-issues: false. Remove it when the team is ready for a gate. With command: audit, a pull request fails only on findings that it introduces. Without command: audit, the Action runs the full pipeline, and any finding fails the job (fail-on-issues defaults to true). In a pull request, the Action scopes the analysis to the changed files, so its output can differ from a full local run.

The Action installs the fallow version that the project's package.json names. Pin an exact version there to use the same version in CI and on your machine. It can post a PR comment and inline review comments, and it can upload SARIF to GitHub Code Scanning. Other output formats are CodeClimate, GitHub annotations, and Markdown. The GitLab template URL names a release tag, because GitLab includes a file from a fixed ref. The CI guide covers inputs, permissions, and a staged rollout.

For a PR comment or review comments, give the job these permissions. id-token: write is optional: it lets the Action post as the fallow bot. Without it, the comments come from github-actions[bot].

permissions:
  contents: read
  id-token: write
  pull-requests: write
  checks: write

Exit code 0 means no error-severity findings, or an audit result of pass or warn. Exit code 1 means error-severity findings, or an audit result of fail. In CI, exit code 1 fails the job, and that is the gate. The rule severity in the config (error, warn, off) sets which findings count. Exit code 2 means invalid input or an execution error. A script that reads the JSON output can treat 0 and 1 as a completed run, but must not hide exit code 2 with || true.

With --format json, an error arrives on stdout as {"error": true, "message": "...", "exit_code": 2}, not as a stack trace.

Editors and integrations

• The VS Code extension shows findings in the editor.
• fallow-lsp gives diagnostics, hover, code actions, and code lenses in any LSP editor. editors/ has setups for Zed and Neovim.
• The Node API @fallow-cli/fallow-node exports detectDeadCode, detectCircularDependencies, detectBoundaryViolations, detectArchitecture, detectDuplication, detectSimilarCode, detectFeatureFlags, computeComplexity, and computeHealth. The package API reference has the options and return types.
• fallow health --format badge > badge.svg writes a health badge for your README.

With coding agents

npx fallow agent install --dry-run   # show the plan
npx fallow agent install             # apply it

fallow agent install sets up the agents that it detects (Claude Code, Codex, and Cursor) in one pass. It writes an AGENTS.md task map, installs the fallow and fallow-setup skills, registers the MCP server, and adds a gate on git commit and git push. Run npx fallow agent status to see these changes. Run npx fallow agent uninstall to remove them.

To register only the MCP server:

{ "mcpServers": { "fallow": { "command": "npx", "args": ["--yes", "--package", "fallow", "fallow-mcp"] } } }

--package fallow selects the npm package that provides the fallow-mcp launcher.

Scripts and agents that call the CLI directly add --format json --quiet. Each command then writes one typed JSON document to stdout:

• A root kind field names the analysis that made the document.
• Each finding has an actions[] array and an auto_fixable flag, so a script knows what fallow fix can do.
• Root next_steps[] suggestions are commands that run as written.
• The types ship as fallow/types, and docs/output-schema.json is the full schema.

Do not run fallow watch in an agent loop, because it does not exit.

Exit codes and the JSON error format are in In pull requests. The agent skills guide has the details.

Migrate existing config

npx fallow migrate converts knip, jscpd, and stylelint config into fallow config. The migration guides for knip and jscpd show each step.

Contributing

To report a missing framework plugin or a false positive, open an issue. CONTRIBUTING.md covers the development setup. docs/README.md is the entry point for maintainer documentation.

Thank you to everyone who contributes code, bug reports and ideas.

License

MIT. See LICENSE.

If fallow helps you or your team, you can support its development through GitHub Sponsors.