agnix
agent-sh/agnixPlugin
Lint agent configurations before they silently fail. 414 validation rules across Claude Code, Codex CLI, OpenCode, Cursor, GitHub Copilot, Gemini CLI, Cline, Windsurf, Roo Code, Amp, and Kiro - validates CLAUDE.md, AGENTS.md, SKILL.md, hooks.json, MCP server configs, and plugin manifests. Auto-fix included for safe issues; SARIF output for GitHub Code Scanning. Distributed as CLI (npm + Cargo), official GitHub Action (`agent-sh/agnix`), and IDE extensions for VS Code, JetBrains, Neovim, and Zed. Rules sourced from official specs, academic research on agent prompt design, and real-world failure patterns from production deployments. Mentioned in awesome-claude-code.
Why this score
Popularity score: 72/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 22, 2026 at commit c9e47613dc1d, first 300 source files (it's a large repo), with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs.editors/vscode/src/extension.ts:5, knowledge-base/VALIDATION-RULES.md:1, npm/index.js:7 and 13 more
- Reads environment variables, where API keys usually livescripts/real-world-validate.py:67
- Installs system packagesscripts/bench.sh:48
- Downloads content and runs it Whatever it downloads can change after we scanned it.scripts/check-tool-releases.sh:177
Web addresses in its code:
- avifenesh.github.ioeditors/vscode/src/extension.ts:1049
- crates.iowebsite/docusaurus.config.js:228
- fonts.googleapis.comwebsite/docusaurus.config.js:31
- marketplace.visualstudio.comwebsite/docusaurus.config.js:170
- plugins.jetbrains.comwebsite/docusaurus.config.js:174
- api.github.comscripts/download.sh:116
- api.z.aiscripts/glm-extract.js:97
- cursor.comknowledge-base/RESEARCH-TRACKING.md:30
- dev.towebsite/src/pages/index.js:234
- fonts.gstatic.comwebsite/docusaurus.config.js:43
- zed.devwebsite/docusaurus.config.js:182
These are the sites named in the code, so it's where your data could go. It isn't a complete list: code can build addresses while it runs, and a few of these may be links rather than calls. Whatever you send also goes to the AI model you use.
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Prompts that use GitHub
Alternatives
Nothing from another maker does quite the same job yet. See everything for GitHub.