# Code checker

The `ardumaker check` binary: ArduMaker standard rules on your repository, Git hooks and JSON output for CI and AI agents.

Source: https://ardumaker.com/en/docs/code-checker/

- Category: AI and agents
- Status: Available
- Requirements: An ArduMaker account (the program has no anonymous mode); 64-bit Linux x86-64 or Windows (there is no macOS binary); A Git repository for the hooks
- MCP tools: No MCP tools: it is used from the dashboard.

## What can you do with it?

- Check a repository against the ArduMaker standard rules (198 in the current version), grouped into families with an identifier (`FMT`, `SEC`, `REPO`, `LANG`, `CMT`, `PY`…).
- Fix only what fixes itself (`ardumaker fix`).
- Install Git hooks that reject a commit or push with errors: `pre-commit`, `commit-msg` and `pre-push`.
- Get the result as JSON for CI and agents, and the full rules as a single Markdown document for an agent (`ardumaker rules --agents`).
- Add and maintain the authorship header on each file.

## When should you use it?

- Before every commit (the hooks do it automatically).
- In CI, with `--strict` and `--json`, as delivery mode.
- When an AI agent writes code: it gives the agent the rules and an objective way to check them.

## How does it work in ArduMaker?

### Install and sign in

1. Download the binary from the downloads page: one native file per system (`ardumaker-<version>-linux-x86_64` or `ardumaker-<version>-windows-amd64.exe`), with its published SHA-256.
2. `ardumaker login` opens the browser; without a browser (SSH, containers, agents), `ardumaker login --device` prints a link and a short code approved on the website. The session renews itself while in use.
3. In CI there is no terminal: with `ARDUMAKER_EMAIL` and `ARDUMAKER_PASSWORD` every command signs in by itself; the password is not stored, only the tokens.
4. `ardumaker init` prepares the folder: Git, `.gitignore`, headers and hooks, and leaves the binary in `.ardumaker/` so anyone who clones can run the checks.

### Check

```bash
ardumaker check                       # todo el proyecto
ardumaker check --staged              # solo lo que va al commit
ardumaker check --strict --json       # avisos cuentan como error; JSON a stdout
ardumaker check --only SEC,REPO       # solo esas familias
ardumaker check --range origin/main..HEAD
ardumaker rules FMT-003               # qué mide una regla y cómo exceptuarla
```

- `check` writes nothing, with one exception: with `--staged` it adds the ArduMaker header to the files going into the commit and stages them again (`--no-headers` only reports it).
- Each finding carries the rule identifier and the measured value.
- Exit codes: `0` clean, `1` errors (or warnings with `--strict`), `2` bad usage.
- It reuses the last run for unchanged files; `--no-cache` checks everything again.

### Tuning the standard

- Per project, in `.ardumaker/.ardumaker.conf`: for example `{"rules": {"off": ["CMT-002"]}}`, with the reason written next to it.
- On a line, with a mandatory reason: `#` + `estandar: ignore` + the rule (`PY-002`) + ` - <reason>`.
- Per run: `--only` and `--skip`.
- A hook is skipped once with `git commit --no-verify`.

## What actually changes?

- `check` does not change files (except headers with `--staged`); `fix` does write the automatic fixes.
- `hooks --install` adds the hooks in `.git/hooks`; it never overwrites another tool's hook without `--force`.
- `init` creates `.ardumaker/` with the binary and configuration, and keeps it in the repository.
- In the account: one binary-type session per machine, visible and revocable from `/me`.

## What can be claimed from the result

The `check` result is a measurement against specific rules, not a judgement about the code. An agent reporting it to a person must say exactly that:

| Can be claimed | Cannot be claimed |
| --- | --- |
| “`ardumaker check --strict` exited with code 0 on this version and configuration” | “The code is correct” or “it works”: the checker does not run the program |
| “There are N findings: SEC-xxx in this file and line, with this measured value” | “The tests pass”: it can require a test to exist, not that it passes |
| “These were the families checked” (if `--only` or `--skip` was used) | “There are no vulnerabilities”: security rules look for patterns (secrets, sensitive logs, dangerous settings), they do not audit |
| “With `--staged`, what goes into this commit complies” | “The whole repository complies”, if only staged files or a range were checked |
| “These rules are off or excepted, with these reasons” | “The architecture is right”: it does not replace design or human review |

> **INFO:** Without `--strict`, a clean result can still have warnings. A result reused from the cache reflects the previous run for unchanged files.

## Diagram

**A commit with the hooks installed**

```text
git commit (triggers pre-commit)
  ↓
ardumaker check --staged (rules on staged files; adds headers)
  ↓
commit-msg (checks the commit message)
  ↓
pre-push (checks before pushing)
  ↓
Result (code 0 continues; code 1 rejects)
```

## Expected result

- With `--json`, the result goes out as a single JSON object on stdout and everything else on stderr: `ardumaker check --json | jq` works without filtering anything.
- `ardumaker version` says which build runs; `ardumaker update` looks for and installs a new version, comparing size and SHA-256 before replacing.
- If the program fails internally, it sends a crash report to ArduMaker and shows the report number to quote.

## Errors and troubleshooting

| Situation | Cause | What to do |
| --- | --- | --- |
| Exit code 1 | There are errors (or warnings with `--strict`) | Fix them or run `ardumaker fix` for what fixes itself |
| Exit code 2 | Wrong command usage | Check `ardumaker check --help` |
| It asks to sign in | Every command works on behalf of an account | `ardumaker login` or `login --device` |
| The hook is not installed | Another tool's hook already exists | Check `ardumaker hooks --status`; use `--force` only knowingly |
| An inline exception is not accepted | The reason is missing | Write `- <reason>` after the identifier |

## MCP access

There are no MCP tools for the checker: it runs as a binary on the machine where the code is. An agent uses it from its terminal with `ardumaker check --json` and `ardumaker rules --agents`. More at [/checker](https://ardumaker.com/en/checker).

## Related features

- [MCP server](https://ardumaker.com/en/docs/servidor-mcp/)
- [GitHub deploy](https://ardumaker.com/en/docs/github-deploy/)
- [Sessions and devices](https://ardumaker.com/en/docs/sesiones-y-dispositivos/)