AsItIs

Changelog

What changed, and what I'm working on.

Releases of the linter (the Claude Code plugin, MCP server and CLI, now at 0.4.0), changes to this site, and progress on the desktop app. Work that hasn't shipped is marked. The roadmap is the short version. Subscribe by RSS or the waitlist.

Linter 0.4.0: see exactly what your agent loads, monorepo and skill checks, leak audit

  • This release folds in 0.3.1, which never shipped on its own. Release notes on GitHub; install with npx -y -p @asitis/mcp@0.4.0 asitis lint, the Action Katta041/asitis-agent-tools@v0.4.0, or update the plugin.
  • asitis loads [dir], /asitis:md-loads and the load_plan tool: what Claude Code, Codex, Gemini CLI, Cursor and Copilot load when a session starts in a folder. The files at launch with their imports, what loads later (a subfolder CLAUDE.md on first read, path rules on a matching file, nested skills), what gets cut (Codex's 32 KiB chain, MEMORY.md after 200 lines) and what is never read and why. Each step says whether it rests on vendor docs, a canary run in the real tool, or an assumption. /asitis:md-budget is now a view of the same model, so the two can't disagree.
  • Monorepo rules: a paths, globs or applyTo pattern that matches no file, a subfolder file that repeats or contradicts the one above it, and a subfolder file that tells the agent to ignore the files above it.
  • Skill checks: descriptions that are vague, written in the wrong person, or nearly the same as another skill's; descriptions in one folder or plugin over Claude Code's 8,000-character listing budget; and a .claude/commands file with the same name as a skill, which never runs.
  • secret-in-steering: an API key or private key in a steering file is an error. The message gives the key type, line and column and never a character of the key.
  • Agent leak audit, opt-in with --include config: a password or token saved into a permission rule by "Yes, and don't ask again" (Claude Code, Cursor CLI, Gemini CLI), settings.local.json, CLAUDE.local.md and other local agent files that no .gitignore covers, and session transcripts committed to the repo. With that flag the linter now also reads .gitignore, .cursor/cli.json and the first 4 KB of <uuid>.jsonl files. Without it, nothing new is read.
  • hidden-instruction in nine more languages (Spanish, Portuguese, French, German, Russian, Chinese, Japanese, Korean, Hindi), with the same error and warning split as English. No new findings on 4,363 real hidden comments.
  • MCP prompts lint, budget, fix and loads (/mcp__asitis__lint in Claude Code), resources asitis://findings and asitis://budget, and asitis lint --badge for a "checked with AsItIs" README badge after a clean run.
  • Behaviour change for CI: on a repo too big to search in full, asitis lint used to stop with exit code 2 and lint nothing. It now lints what it found and exits 4, so a partial run never looks clean. Add --allow-partial (Action input allow-partial: true) to get 0 or 1 instead. The walk covers 200,000 folder entries now, was 50,000, so next.js, bun, node, rust and PostHog lint in full.
  • broken-import reads @ imports the way Claude Code does. I checked its parser and ran canary files through it: See @guide.md: for details, Follow @AGENTS.md. and (see @guide.md) load nothing even when the file is there, so those are warnings now. @guide.md#setup is no longer called missing. Imports inside imported files are followed, 4 hops for Claude Code and 5 for Gemini CLI, and a problem further down is reported on the import that starts the chain.
  • Fewer false positives. I ran 0.3.0 and 0.4.0 over the same 71 public repos and labelled every finding by hand: errors and warnings went from 900 to 655 and precision from 70% to 91%, with no real finding lost.
  • Fixed: an empty <!--> comment hid the rest of the file (issue #28); fix diffs no longer print a line that holds a key (#32); a 10 MB single-line file took over a minute, now about a second.
  • 86 rules, each with its own page. Not tested yet: the MCP prompts and resources in VS Code and Cursor, and the new language phrases haven't had a native-speaker review.

Site: a changelog that covers the linter, a roadmap, and the converter linked from the guides

  • This page now lists the linter releases alongside the site and app changes, newest first, with what is in progress marked as such.
  • The plugin page has a now, next and later roadmap.
  • The six guides for ChatGPT, Claude and Copilot users now link the free ChatGPT to Word and PDF converter in the body, with a quick answer at the top of each. The converter page says that it also takes a dropped .md or .txt file and what the Copy formatted text button is for; both were true before and unsaid.
  • The desktop app is unchanged: Mac and Windows, in development, waitlist open.

Site: 0.3.0 pages, 18 guides and a free converter

  • The plugin page was redone for 0.3.0, with a CI setup page and a page for every rule, 73 in all.
  • A guides hub with 18 guides. Six are new and written for people who use ChatGPT, Claude or Copilot and need the text in Word, Google Docs, Excel or a PDF.
  • A free ChatGPT to Word and PDF converter: paste an answer, preview it, download Word or save a PDF. It runs in the browser and is built on the desktop app's own Word exporter.
  • An about page, and the waitlist now sends a confirmation email with a day-5 reminder. Unconfirmed sign-ups are deleted on day 7.

Linter 0.3.0: CLI, GitHub Action, config, drift checks, fix diffs

  • The asitis CLI: npx -y -p @asitis/mcp@0.3.0 asitis lint. Text, JSON, SARIF and GitHub annotation output, with exit codes for CI.
  • A GitHub Action and a pre-commit hook.
  • .asitisrc.json for per-rule settings, inline suppression with a required rule id and reason, and baselines for repos that aren't clean yet.
  • Drift checks: an AGENTS.md that Claude Code skips because a CLAUDE.md is there, mirrored files that have drifted apart, and a Codex chain over its 32 KiB budget.
  • Opt-in scans of skill folders and of agent config files (settings.json, .mcp.json).
  • Fix suggestions as unified diffs (/asitis:md-fix in Claude Code, --fix-preview in the CLI). Nothing is written for you.
  • 73 rules, each with its own page.
  • Before release I ran it over 71 public repos and labelled every finding by hand. The precision figure that first stood here was replaced by the 0.4.0 run above, which measured this release at 70% on the same repos. Release notes on GitHub.

Linter 0.2.5

  • Results are text only by default. Claude Code 2.1 shows the model structuredContent instead of the text when both are present, which dropped the untrusted-content notice and made results two to five times larger. --structured adds the JSON back for scripts.
  • The asitis.app footer line is off by default.
  • context_budget follows Claude Code's current rule for AGENTS.md: counted only when CLAUDE.md imports it, or when there's no CLAUDE.md at all.
  • Smaller, paged results for big repos, and a long list of precision fixes to duplicate-rule, contradiction, broken-link and hidden-instruction. Full list on GitHub.

Linter 0.2.4: clearer output, working update steps

  • Tool output is easier to read: findings as - line 12 [warning] rule: message, errors first, correct plurals, and messages that say what to do.
  • context_budget names the tools (Claude Code, Codex, Gemini CLI) and opens with a one-line total per tool.
  • A test fails the release if a README pins a different version from the package. Release notes on GitHub.

Linter 0.2.3: Windows project folders work again

  • On Windows, a root given as an 8.3 short path or in a different case made files inside it look outside it, so reads failed. Fixed, with tests that run every confinement check in both forms. Release notes on GitHub.

Linter 0.2.2: MCP Registry metadata

  • Metadata for the official MCP Registry (io.github.Katta041/asitis-mcp). No change to the server itself.
  • The guard hook's time-budget test no longer depends on machine speed. Release notes on GitHub.

Linter 0.2.1: fewer false positives

  • hidden-instruction no longer fires on a product name alone, such as a comment saying a file was made with Claude Code. A comment has to speak to the assistant.
  • duplicate-rule compares whole list items and sentences, not single lines. On 200 public CLAUDE.md and AGENTS.md files that removes all 5 noisy findings and keeps the 4 real ones. Release notes on GitHub.

Linter 0.2.0: works in nested folders, safer output

  • Every tool quotes and escapes text from files and marks it as untrusted, so a repository can't forge report lines.
  • The server starts when Node's permission model denies realpath on the root, and explains a root it can't read in one line.
  • New rules name-reserved-word, xml-tag and body-tokens; description-too-long is now an error. Release notes on GitHub.

Waitlist and site hardening

  • A repeat waitlist signup for an address already on the list no longer changes the plan or the consent record of the first signup. To change your plan, write to privacy@asitis.app.
  • The spam check now also confirms that it was solved on asitis.app for the waitlist form.
  • The site no longer allows inline scripts, so its content security policy is stricter.
  • Updated the privacy policy: operational logs of waitlist errors are kept for up to 7 days and contain no personal data.

Waitlist confirmation email and one-click unsubscribe

  • When the confirmation email is switched on, joining the waitlist sends one short email with a link to confirm the address is yours. Until you confirm, you are not on the list, and unconfirmed signups are deleted after 7 days. Another spelling of the same inbox (for example with a +tag) never gets a second email.
  • The email also has a remove link: open it, press one button, and your entry is deleted. Mail apps that show an "Unsubscribe" button use the same link. No tracking pixels, no click tracking.
  • The privacy policy names Resend as the sender, with its 30-day delivery record, once the email is switched on.

Waitlist on our own endpoint

  • The waitlist now stores signups in our own Cloudflare D1 database instead of a newsletter service. We keep your email, the plan you picked, when you consented and which page you signed up on. No IP address, no browser details.
  • Joining needs an explicit, unticked consent box, and a Cloudflare Turnstile check keeps bots off the list.
  • Updated the privacy policy: Cloudflare (D1 database, Turnstile) is the waitlist processor, the list is deleted 12 months after 1.0 launches, and you can ask for deletion any time at privacy@asitis.app.

Website and trust pack v0

  • Launched asitis.app: home, pricing with the founding offer, trust pages, the round-trip benchmark, the Claude Code plugin page and three guides.
  • Published the Network activity list. It has two entries: the optional update check and the licence resend page. Any change to this list will appear here first.
  • Published /.well-known/security.txt pointing at GitHub security advisories.
  • Waitlist opened for the paid beta. Founding licences include 24 months of updates.

Claude Code plugin and benchmark are public

  • The AsItIs Claude Code plugin and read-only MCP server are public in the asitis-agent-tools repository on GitHub. Install with claude plugin marketplace add Katta041/asitis-agent-tools, then claude plugin install asitis@asitis. The npm package is coming soon; other MCP clients can run the bundled server from a clone. (Since published: @asitis/mcp on npm.)
  • The round-trip benchmark harness, corpus and results are public in the markdown-roundtrip-benchmark repository on GitHub. Reproduce with npm ci && npm run bench. The benchmark page now shows only the published numbers.
  • The desktop app is still in development. There is no download yet; the waitlist stays open.

Benchmark copy corrected after an independent audit

  • An independent audit reproduced every number in the round-trip benchmark byte for byte and found the site's wording ahead of the evidence in places. The copy now matches: the home page comparison row that was labelled as a generic source-editor save is now "CodeMirror 6, default settings" (editors that detect line endings, such as VS Code, change 0 lines on that file); the hero sentence that implied edits through the WYSIWYG engines rewrote all lines now states the measured no-edit result (102 to 115 of 115 lines); the Tiptap image losses are attributed to the missing Image extension; the whole-file git diff claim is scoped to repositories that store CRLF; the jsdom caveat no longer excuses Tiptap, which is as slow headless; and the unverified sub-300 ms render time is gone until it is measured.
  • The benchmark page opens with "How to read this benchmark" (synthetic dense corpus, engines not GUI editors, defaults versus plugins, what a configured source editor scores, what is still in progress) and a conflict-of-interest line.
  • The home page headline no longer promises an editor that "never rewrites your file" while the app is pre-beta, and the Trust page states the save engine's scope: UTF-8 with or without BOM, any mix of line endings, invalid UTF-8 carried through; UTF-16 and UTF-32 refused rather than rewritten.
  • The Trust page, the Network activity page and the privacy policy now say what is true: this site runs no analytics today. If cookieless page counts are added, those pages will say so first.

Save engine and benchmark

App work in progress, not yet released
  • Round-trip benchmark: six report files through five engine families. Every serialising engine changed 7 to 100% of lines; patch-on-save was byte-identical on all six. The harness and results are public. Results on the benchmark page.
  • Save engine: edits computed as byte ranges, applied as native byte splices, refused on mismatch. Invalid UTF-8 and lone CR preserved. Metadata (permissions, extended attributes, Finder tags, creation time) preserved on macOS; Windows path uses ReplaceFileW with a backup.
  • Monorepo, CI for macOS and Windows, fixture integrity guard.