README.md

May 30, 2026 ยท View on GitHub

ngcompass

Angular-aware static analysis for architecture, performance, SSR, security, and code quality.

npm beta Angular v15+ Node.js 20+ PolyForm Shield 1.0.0

Overview

ngcompass is a command-line static analysis tool built for Angular projects. It reads TypeScript, Angular templates, styles, and project configuration without running the application, then reports issues that generic TypeScript linters often miss.

It is designed for teams that want a clearer view of Angular-specific risks: component architecture, rendering performance, SSR compatibility, Signals and RxJS patterns, template safety, and modern Angular API adoption.

Highlights

AreaWhat ngcompass helps find
ArchitectureCircular dependencies, boundary violations, and fragile component relationships
PerformanceMissing OnPush, expensive template expressions, missing trackBy, and inefficient bindings
SSRBrowser-only APIs in universal code, hydration risks, and render lifecycle pitfalls
SecurityUnsafe template bindings and sanitizer bypasses
ReactivityRxJS subscription issues, Signals misuse, and migration opportunities
Code qualityDeprecated patterns, focused tests, and modern Angular API improvements

Installation

Install the beta CLI globally:

npm install -g ngcompass@beta

Or add it to a project:

npm install --save-dev ngcompass@beta

Using pnpm:

pnpm add -D ngcompass@beta

ngcompass is currently in beta. Install with @beta to opt in to the prerelease channel.

Quick Start

cd my-angular-app
ngcompass init
ngcompass analyze

Generate a self-contained visual report:

ngcompass analyze --format ui

Run through a project-local install:

npx ngcompass analyze
pnpm exec ngcompass analyze

Output Formats

CommandOutput
ngcompass analyzeDefault terminal report
ngcompass analyze --format console --compactCompact one-line issue output
ngcompass analyze --format html --output report.htmlSelf-contained HTML report
ngcompass analyze --format uiInteractive HTML report alias
ngcompass analyze --format json > results.jsonMachine-readable JSON
ngcompass analyze --format sarif > results.sarifSARIF for GitHub Code Scanning

Configuration

Create a configuration file:

ngcompass init

This generates ngcompass.config.ts:

import { defineConfig } from '@ngcompass/config';

export default defineConfig({
  extends: 'ngcompass:recommended',

  include: ['src/**/*.ts', 'src/**/*.html'],

  exclude: [
    'node_modules/**',
    'dist/**',
    'build/**',
    'coverage/**',
    '**/*.d.ts',
    '**/*.spec.ts',
    '**/*.test.ts',
  ],

  profiles: {
    ci: {
      outputFormat: 'json',
      maxWarnings: 0,
    },
  },
});

Presets

PresetPurpose
ngcompass:recommendedBalanced default for most Angular projects
ngcompass:strictStronger enforcement for mature codebases
ngcompass:performanceRendering and change-detection checks
ngcompass:reactivitySignals and RxJS correctness
ngcompass:securitySecurity-focused Angular checks
ngcompass:ssrServer rendering and hydration safety
ngcompass:allEvery built-in rule at its default severity

Override individual rules in the same config:

export default defineConfig({
  extends: ['ngcompass:recommended', 'ngcompass:performance'],
  rules: {
    'prefer-on-push-component-change-detection': 'error',
    'no-document-access': 'warn',
  },
});

Commands

CommandDescription
ngcompass initCreate ngcompass.config.ts
ngcompass analyzeRun analysis
ngcompass rulesList available rules
ngcompass rules <name>Inspect one rule
ngcompass config healthValidate configuration
ngcompass cache infoShow cache status
ngcompass cache clearClear cached analysis data
ngcompass cache pathPrint the cache directory

Analyze Options

OptionDescription
--format <fmt>console, json, sarif, html, or ui
--output <path>Output path for HTML/UI reports
--compactUse compact issue output
-q, --quietShow summary counts only
--no-recommendationHide fix recommendations
--rule <id>Run one rule in isolation
--forceIgnore cached results
-p, --profile <name>Run a named config profile
--max-workers <n>Limit worker threads
--skip-type-checkSkip rules that require TypeScript type checking

CI

ngcompass exits with code 0 when analysis passes and a non-zero code when configured violations are found.

- name: Run ngcompass
  run: ngcompass analyze --format sarif > results.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Caching

ngcompass caches file discovery, execution plans, AST work, rule results, and full analysis output. Warm runs can reuse unchanged work instead of parsing and analyzing the entire project again.

ngcompass cache info
ngcompass cache clear
ngcompass analyze --force

Monorepo

PackageResponsibility
ngcompassCLI entry point
@ngcompass/configConfig loading, validation, profiles, and health checks
@ngcompass/scannerFile discovery and filtering
@ngcompass/rulesBuilt-in rules, presets, and rule registry
@ngcompass/plannerIncremental execution planning
@ngcompass/engineRule execution and analysis orchestration
@ngcompass/astTypeScript, template, and style parsing helpers
@ngcompass/cacheMemory and disk cache services
@ngcompass/reportersConsole, JSON, SARIF, and HTML reporters
@ngcompass/commonShared types and utilities
@ngcompass/siteDocumentation site

Development

pnpm install
pnpm build
pnpm test
pnpm typecheck

Additional workspace checks:

pnpm smoke
pnpm validate:packages
pnpm prerelease:check

Requirements

  • Node.js ^20.19.0 or >=22.12.0
  • Angular v15 or later
  • pnpm for repository development

Beta Notes

  • Rule names, messages, and report layout may change before 1.0.
  • Template analysis is best-effort for highly dynamic templates.
  • Validate ngcompass against your project before making it a required CI gate.