⚠️ Development ended 2026-07-31 (archived)NEKOWORK was a local safety gate that checked AI-written code changes before they merged. It shipped to npm as a public alpha but did not find external users, so development has stopped.
- The code stays under MIT — fork and reuse freely.
- The npm package
@ps-neko/nekowork@alphastill installs and runs.- Issues, PRs, and maintenance are no longer handled.
Check AI-written code before it enters your project.
NEKOWORK is a local safety checkpoint for code made by AI tools such as Cursor, Claude Code, and Codex. It looks at what changed, points out risky parts, and gives you a simple verdict: PASS, REVIEW, or BLOCK.
It does not write code for you. It does not commit, push, merge, or deploy by itself. A human still makes the final decision.
AI coding tools are fast, but they can also leave dangerous changes behind: secret keys in code, disabled tests, risky install scripts, or automation that pushes code without enough review.
NEKOWORK is the extra checkpoint after the AI changes files and before the change is accepted into your project.
- Your AI tool changes the files.
- NEKOWORK checks the changed lines.
- NEKOWORK writes an evidence report.
- You decide whether the change is safe.
If you are not a developer, the short version is: AI makes the draft, NEKOWORK checks the warning signs, and a person approves the final change.
| Verdict | Meaning |
|---|---|
| PASS | No blocking risk was found. |
| REVIEW | Something needs a human look before moving on. |
| BLOCK | NEKOWORK found a serious risk and tells you where it is. |
verify-pr's machine-readable output uses five specific verdicts —ALLOW,ALLOW_WITH_WARNINGS,NEEDS_HUMAN_REVIEW,INSUFFICIENT_EVIDENCE, andBLOCK— that map onto these three buckets. See the verdict table.
Requirements: Node.js 22+, npm, and a git repository with at least one commit.
# after your AI tool changes some files:
npx -y @ps-neko/nekowork@alpha check
npx -y @ps-neko/nekowork@alpha verify-prAlways use the
@alphatag — the bare package /latestdist-tag can lag behind (currently0.2.0-alpha.11).@alpha(0.2.0-alpha.12) ships the full 11 rules plus the latest fixes, so@alphais the one to install.
NEKOWORK reads the changed lines, writes a plain-English REPORT.md, and tells
you whether the change should move forward.
Example when a change is blocked:
=== verify-pr ===
verdict : BLOCK
reason : Hardcoded secret fallback detected (src/auth.ts:42)
risk_level : CRITICAL
merge_allowed : false
apply_allowed : false
NEKOWORK flags a defined set of AI-introduced risk patterns — 11 deterministic rules — and routes everything else to a human decision. It is not an exhaustive security audit:
Note: the published
@alpha(0.2.0-alpha.12) now ships all 11 rules (incl. eval, insecure TLS, CORS wildcard, SQL/command injection, and AST dataflow) and adds one tiny, well-known dependency (acorn, the JS parser — MIT, zero transitive dependencies) for the AST engine. Always install with the@alphatag: thelatestdist-tag can lag behind (currently0.2.0-alpha.11).
- Secret keys, hardcoded credentials, or fallback passwords accidentally placed in code.
- Tests, lint checks, or security checks being switched off.
- Code that tries to auto-commit, auto-push, auto-merge, or deploy.
- Risky package or install-script changes (e.g.
postinstallhooks). eval/ dynamic code execution, insecure TLS, CORS wildcards.- Basic SQL / command injection shapes.
- Variable-mediated / cross-statement injection (assembled SQL, shell commands,
eval) via AST dataflow analysis — not just single-line regex. - Changes with too little evidence to trust safely.
The deterministic verdict, the human gate, and the "never auto-pushes" promise hold for everything above. The AST dataflow rule is inter-procedural (intra-module) and conservative: it follows tainted values across functions within a single file (including local-helper returns and sink aliasing), JS/TS only — it does not do cross-file or whole-program analysis. Anything beyond that (most injection classes, business-logic bugs, auth/authorization flaws) is still out of scope. See the benchmark's "What is NOT covered" for the exact boundary.
Language coverage: NEKOWORK is primarily a JS/TS scanner. The regex rules add a few representative Python and Go patterns (e.g.
subprocessgit push,os.system/exec.Command,verify=False/InsecureSkipVerify,os.environ.getfallbacks) — useful samples, not full multi-language support. The AST dataflow rule is JS/TS-only. Treat non-JS/TS coverage as best-effort pattern samples.
Full technical scope: SCOPE-1.0.md.
- Not an IDE.
- Not another AI coding agent.
- Not an autopilot that pushes code on its own.
- Not a replacement for Cursor, Claude Code, or Codex. Use those tools first, then run their output through NEKOWORK.
- Not a test or contract-testing tool (Hurl,
go test) — those check whether behavior is correct; NEKOWORK checks whether the diff itself is risky before merge.
NEKOWORK is intentionally narrow: it only verifies AI-written changes before merge. If you want the same verification philosophy embedded in a fuller development workflow -- problem framing, spec, plan, work packets, worker prompts, and then the same gate -- see NEKOFORGE, the source-based AI development harness that wraps the NEKOWORK-style gate as its final safety step.
NEKOWORK = narrow safety checkpoint on AI-written changes
NEKOFORGE = full local development harness; ends with the same gate
NEKOWORK is in public alpha. It is already published on npm, has CI coverage, a live demo, and a test suite.
One honest note: "verified" means independently checked with recorded evidence. It does not mean mathematically proven correct.
Found a gap or a false block? Open alpha feedback
- Start here: Quickstart | How verification works | Integration
- Go deeper: Architecture | Advanced commands | Vision
- Contributing: CONTRIBUTING.md -- English PRs welcome.
- License: MIT