bun CLI

CuratedAudited 2026-10-05 by anc 0.6.0Markdown · JSON
71pass rate

3/8 principles met

Incredibly fast JavaScript runtime, bundler, test runner, and package manager

$ anc audit bun --json

workhorse Zig oven-sh/bun
MUST 19 / 28SHOULD 14 / 223 failing11 warningsaudited 2026-10-05 · anc 0.6.0

Eight principles, scored

Behavioral and source checks. Every non-pass row carries a copy-paste remediation prompt.

  1. P1
    Non-Interactive by Default

    All 6 checks pass.

    pass
  2. P2
    Structured, Parseable Output

    no --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum. · no `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.

    Remediation · P2
    Make bun satisfy P2 (Structured, Parseable Output) from the agent-native CLI standard. Address:
    - --json / --jsonl short aliases for --output (no --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.)
    - `--raw` flag for pipe-safe unformatted output (no `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.)
    - Bad invocation exits with structured usage-error code (2) (binary silently accepted invalid flag (exit 0). Bad invocation must signal usage error via a non-zero exit code.)
    Requirements: https://anc.dev/p2
    fail
  3. P3
    Progressive Help Discovery

    no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text. · no paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.

    Remediation · P3
    Make bun satisfy P3 (Progressive Help Discovery) from the agent-native CLI standard. Address:
    - `examples` subcommand or `--examples` flag for curated usage patterns (no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.)
    - Help text pairs human and `--output json` example invocations (no paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.)
    Requirements: https://anc.dev/p3
    warn
  4. P4
    Fail-Fast, Actionable Errors

    binary silently accepted invalid flag (exit 0) · stderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.

    Remediation · P4
    Make bun satisfy P4 (Fail-Fast, Actionable Errors) from the agent-native CLI standard. Address:
    - Rejects invalid arguments (binary silently accepted invalid flag (exit 0))
    - Error messages include a hint or remediation phrase (stderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.)
    Requirements: https://anc.dev/p4
    fail
  5. P5pass
  6. P6
    Composable, Predictable Command Structure

    pager referenced in --help but no --no-pager escape hatch advertised · 3/5 subcommand(s) follow standard verb names. Non-standard: x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.

    Remediation · P6
    Make bun satisfy P6 (Composable, Predictable Command Structure) from the agent-native CLI standard. Address:
    - Pager-using CLI ships --no-pager escape hatch (pager referenced in --help but no --no-pager escape hatch advertised)
    - Subcommand verbs follow community-standard names (3/5 subcommand(s) follow standard verb names. Non-standard: x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.)
    - `--color` flag for explicit color control (no `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.)
    - Operations are subcommands, not verb-shaped flags (top-level verb-shaped flag(s) found: --install, --drop. Operations belong under the `Commands:` block (`tool search "q"`), not on the flag namespace where they fight the `--help` filtering agents rely on.)
    Requirements: https://anc.dev/p6
    warn
  7. P7
    Bounded, High-Signal Responses

    no --quiet/-q flag detected in --help output · long-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.

    Remediation · P7
    Make bun satisfy P7 (Bounded, High-Signal Responses) from the agent-native CLI standard. Address:
    - Quiet mode available (no --quiet/-q flag detected in --help output)
    - `--timeout` flag for long-running operations (long-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.)
    - Help text advertises TTY-aware verbosity behavior (no TTY-aware language found in `--help`. MAY-tier — automatic verbosity reduction when stdout is piped or redirected lets agents skip the explicit `--quiet` flag. Behavioral probes cannot simulate a real TTY without a pty crate, so this audit relies on documented intent.)
    Requirements: https://anc.dev/p7
    warn
  8. P8pass

All Audits

P1: Non-Interactive by Default

PASSNon-interactive by default
SKIPNon-interactive gate flag advertised in --helptarget satisfies P1 via alternative gate (help-on-bare or stdin-primary)
PASSFlags advertise env-var bindings in --help
PASSSecret-bearing flags expose stdin or *-file companion
PASS`--help` advertises default values for flags
PASSRich-TUI affordance for TTY contexts

P2: Structured, Parseable Output

OPT-OUTStructured output supportno --output/--format flag detected in any subcommand — tool does not ship structured output.
N/AStructured-output CLI exposes its schema at runtimeantecedent `p2-json-output` is opt_out: no --output/--format flag detected in any subcommand — tool does not ship structured output.
WARN--json / --jsonl short aliases for --outputno --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.
WARN`--raw` flag for pipe-safe unformatted outputno `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.
SKIP`--output` advertises additional formats beyond text/jsonno `--output` or `--format` flag advertised; vacuous skip for MAY-tier extra formats.
FAILBad invocation exits with structured usage-error code (2)binary silently accepted invalid flag (exit 0). Bad invocation must signal usage error via a non-zero exit code.
SKIPErrors emit JSON envelope with discriminant + type id + message roles under `--output json`binary does not advertise `--output json` in --help; MUST applies only to CLIs that opt into the JSON contract.
SKIPJSON success and error envelopes share their non-payload key setbinary does not advertise `--output json` in --help; envelope-consistency only applies to CLIs that opt into the JSON contract.

P3: Progressive Help Discovery

PASSHelp flag produces useful output
PASSVersion flag works (`--version` plus short alias)
PASSVersion flag works (`--version` plus short alias)
WARN`examples` subcommand or `--examples` flag for curated usage patternsno `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.
PASSShort `-h` summary differs from `--help` long form
PASSEach subcommand's `--help` ships at least one invocation example
WARNHelp text pairs human and `--output json` example invocationsno paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.
PASSCommand-list entries name the command without repeating the binary name

P4: Fail-Fast, Actionable Errors

FAILRejects invalid argumentsbinary silently accepted invalid flag (exit 0)
FAILError messages include a hint or remediation phrasestderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.
SKIP`--output json` produces JSON-formatted errorsbinary does not advertise `--output json` in --help; SHOULD applies only to CLIs that opt into the JSON contract.

P5: Safe Retries & Mutation Boundaries

SKIPDestructive subcommands require `--force` or `--yes`no destructive subcommands detected; MUST applies conditionally to CLIs with destructive operations.
SKIPRead and write surfaces are both visible in subcommand listno recognizable read or write subcommand verbs; the read/write distinction is unobservable from the help surface alone.

P6: Composable, Predictable Command Structure

PASSHandles SIGPIPE gracefully
WARNPager-using CLI ships --no-pager escape hatchpager referenced in --help but no --no-pager escape hatch advertised
PASSRespects NO_COLOR
WARNSubcommand verbs follow community-standard names3/5 subcommand(s) follow standard verb names. Non-standard: x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.
WARN`--color` flag for explicit color controlno `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.
SKIPInput-accepting commands read from stdin when no file is givenno input-accepting subcommand detected (process/parse/convert/transform/analyze/validate/format/lint/audit); vacuous skip for the conditional SHOULD.
PASSSubcommand naming follows a consistent verb/noun convention
WARNOperations are subcommands, not verb-shaped flagstop-level verb-shaped flag(s) found: --install, --drop. Operations belong under the `Commands:` block (`tool search "q"`), not on the flag namespace where they fight the `--help` filtering agents rely on.

P7: Bounded, High-Signal Responses

WARNQuiet mode availableno --quiet/-q flag detected in --help output
PASS`--verbose` flag for diagnostic escalation
SKIP`--limit` / `--max-results` flag for list operationsno list-style subcommand detected (list/ls/search/query/find/show/get); vacuous skip for the list-only SHOULD.
SKIPCursor-based pagination flags for list traversalno list-style subcommand detected; vacuous skip for the list-only MAY.
WARN`--timeout` flag for long-running operationslong-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.
WARNHelp text advertises TTY-aware verbosity behaviorno TTY-aware language found in `--help`. MAY-tier — automatic verbosity reduction when stdout is piped or redirected lets agents skip the explicit `--quiet` flag. Behavioral probes cannot simulate a real TTY without a pty crate, so this audit relies on documented intent.

P8: Discoverable Through Agent Skill Bundles

PASSSkill bundle has install path (`tool skill install [<host>]`)
PASS`skill install --all` for multi-runtime install
PASS`skill update` / `skill upgrade` for bundle refresh

Details

Version scored
1.4.2
Audit date
2026-10-05 18:43:44 UTC
Duration
135ms
Platform
linux/x86_64
Mode
command
Anc build
0.6.0
Install
brew install bun

Embed the badge

This score (71%) clears the badge floor (70%). Copy this into your README:

[![agent-native](https://anc.dev/badge/bun.svg)](https://anc.dev/score/bun)

Preview: agent-native badge for bun

Reproduce this scorecard for bun locally and inspect the failing audits:

anc audit --command bun --output json

Install anc first if you don't have it. Add --output json to get the same JSON shape committed under scorecards/.