claude-code CLI

CuratedAudited 2026-10-05 by anc 0.6.0Markdown · JSON
68pass rate

2/8 principles met

Anthropic's agentic coding tool for the terminal

$ anc audit claude --json

agent TypeScript anthropics/claude-code
MUST 19 / 28SHOULD 14 / 225 failing14 warningsaudited 2026-10-05 · anc 0.6.0

Audience signal: mixed

This tool sends mixed signals: some agent-readable affordances are present, others are not. Treat the warnings below as friction points, not defects.

This is an informational signal, not an authoritative verdict — see methodology. The per-audit evidence below is the ground truth.

Eight principles, scored

Behavioral and source checks. Every non-pass row carries a copy-paste remediation prompt.

  1. P1
    Non-Interactive by Default

    All 6 checks pass.

    pass
  2. P2
    Structured, Parseable Output

    --output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs) · CLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.

    Remediation · P2
    Make claude-code satisfy P2 (Structured, Parseable Output) from the agent-native CLI standard. Address:
    - Structured output support (--output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs))
    - Structured-output CLI exposes its schema at runtime (CLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.)
    - --json / --jsonl short aliases for --output (no --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.)
    - `--raw` flag for pipe-safe unformatted output (no `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.)
    - Bad invocation exits with structured usage-error code (2) (bad invocation exited with code 1. The 0/1/2/77/78 convention reserves code 2 for usage errors; using a different non-zero code (often 1) blurs the distinction between usage errors and general failure.)
    - Errors emit JSON envelope with discriminant + type id + message roles under `--output json` (bad invocation under `--output json` produced no parseable JSON on stderr or stdout. JSON mode must emit a JSON error envelope, not plain text.)
    Requirements: https://anc.dev/p2
    fail
  3. P3
    Progressive Help Discovery

    no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text. · `-h` and `--help` produce byte-identical output. SHOULD-tier — clap renders the short summary on `-h` and the full description on `--help` when `long_about` is set; collapsing them gives agents no concise list-level grep target.

    Remediation · P3
    Make claude-code satisfy P3 (Progressive Help Discovery) from the agent-native CLI standard. Address:
    - `examples` subcommand or `--examples` flag for curated usage patterns (no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.)
    - Short `-h` summary differs from `--help` long form (`-h` and `--help` produce byte-identical output. SHOULD-tier — clap renders the short summary on `-h` and the full description on `--help` when `long_about` is set; collapsing them gives agents no concise list-level grep target.)
    - Each subcommand's `--help` ships at least one invocation example (subcommands missing example invocations in their `--help`: agents, attach, auth, auto-mode, doctor, gateway, import, install, logs, purge, respawn, rm, setup-token, ultrareview. Examples teach agents the call shape faster than option tables; use clap's `after_help` or a dedicated `Examples:` block.)
    - Help text pairs human and `--output json` example invocations (no paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.)
    Requirements: https://anc.dev/p3
    fail
  4. P4
    Fail-Fast, Actionable Errors

    stderr lacks a hint phrase. Looked for one of: try , use , expected , did you mean, see , run , for more, tip:, help:, hint:, suggestion:, available . Error messages must name what to do next, not just the symptom. · errors under `--output json` are not JSON-formatted. Consumers parsing stdout-as-JSON cannot recover the failure without a separate text-parsing path; switch the error writer to honor the active output mode.

    Remediation · P4
    Make claude-code satisfy P4 (Fail-Fast, Actionable Errors) from the agent-native CLI standard. Address:
    - Error messages include a hint or remediation phrase (stderr lacks a hint phrase. Looked for one of: try , use , expected , did you mean, see , run , for more, tip:, help:, hint:, suggestion:, available . Error messages must name what to do next, not just the symptom.)
    - `--output json` produces JSON-formatted errors (errors under `--output json` are not JSON-formatted. Consumers parsing stdout-as-JSON cannot recover the failure without a separate text-parsing path; switch the error writer to honor the active output mode.)
    Requirements: https://anc.dev/p4
    fail
  5. P5
    Safe Retries & Mutation Boundaries

    destructive subcommand(s) without `--force` or `--yes`: rm. Irreversible operations must require explicit confirmation so they can't be invoked accidentally. · write-pattern subcommand(s) present (purge, rm) but no read-pattern surface detected. If the CLI is write-only by design the MUST is satisfied vacuously; otherwise expose the read surface with agent-recognizable verbs (list/get/show/query/find/search).

    Remediation · P5
    Make claude-code satisfy P5 (Safe Retries & Mutation Boundaries) from the agent-native CLI standard. Address:
    - Destructive subcommands require `--force` or `--yes` (destructive subcommand(s) without `--force` or `--yes`: rm. Irreversible operations must require explicit confirmation so they can't be invoked accidentally.)
    - Read and write surfaces are both visible in subcommand list (write-pattern subcommand(s) present (purge, rm) but no read-pattern surface detected. If the CLI is write-only by design the MUST is satisfied vacuously; otherwise expose the read surface with agent-recognizable verbs (list/get/show/query/find/search).)
    Requirements: https://anc.dev/p5
    fail
  6. P6
    Composable, Predictable Command Structure

    pager referenced in --help but no --no-pager escape hatch advertised · 5/15 subcommand(s) follow standard verb names. Non-standard: agents, attach, auto-mode, gateway, import, mcp, purge, respawn, setup-token, ultrareview. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.

    Remediation · P6
    Make claude-code satisfy P6 (Composable, Predictable Command Structure) from the agent-native CLI standard. Address:
    - Pager-using CLI ships --no-pager escape hatch (pager referenced in --help but no --no-pager escape hatch advertised)
    - Subcommand verbs follow community-standard names (5/15 subcommand(s) follow standard verb names. Non-standard: agents, attach, auto-mode, gateway, import, mcp, purge, respawn, setup-token, ultrareview. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.)
    - `--color` flag for explicit color control (no `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.)
    - Subcommand naming follows a consistent verb/noun convention (subcommand naming is inconsistent: 1 non-verb subcommand(s) (auth) mix verb and non-verb children at the second level, so an agent cannot predict where the action lives. SHOULD-tier: pick a consistent shape (all verb-first, all noun-verb hierarchy, or any combination where each non-verb group's children are uniformly verbs). The verb list is a heuristic; inspect `--help` to confirm.)
    Requirements: https://anc.dev/p6
    warn
  7. P7
    Bounded, High-Signal Responses

    no --quiet/-q flag detected in --help output

    Remediation · P7
    Make claude-code satisfy P7 (Bounded, High-Signal Responses) from the agent-native CLI standard. Address:
    - Quiet mode available (no --quiet/-q flag detected in --help output)
    Requirements: https://anc.dev/p7
    warn
  8. P8pass

All Audits

P1: Non-Interactive by Default

PASSNon-interactive by default
SKIPNon-interactive gate flag advertised in --helptarget satisfies P1 via alternative gate (help-on-bare or stdin-primary)
PASSFlags advertise env-var bindings in --help
PASSSecret-bearing flags expose stdin or *-file companion
PASS`--help` advertises default values for flags
PASSRich-TUI affordance for TTY contexts

P2: Structured, Parseable Output

WARNStructured output support--output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs)
FAILStructured-output CLI exposes its schema at runtimeCLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.
WARN--json / --jsonl short aliases for --outputno --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.
WARN`--raw` flag for pipe-safe unformatted outputno `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.
SKIP`--output` advertises additional formats beyond text/jsonno `--output` or `--format` flag advertised; vacuous skip for MAY-tier extra formats.
WARNBad invocation exits with structured usage-error code (2)bad invocation exited with code 1. The 0/1/2/77/78 convention reserves code 2 for usage errors; using a different non-zero code (often 1) blurs the distinction between usage errors and general failure.
FAILErrors emit JSON envelope with discriminant + type id + message roles under `--output json`bad invocation under `--output json` produced no parseable JSON on stderr or stdout. JSON mode must emit a JSON error envelope, not plain text.
SKIPJSON success and error envelopes share their non-payload key setsuccess-mode probe (`--help --output json`) produced no parseable JSON; cannot compare envelope shapes.

P3: Progressive Help Discovery

PASSHelp flag produces useful output
PASSVersion flag works (`--version` plus short alias)
PASSVersion flag works (`--version` plus short alias)
WARN`examples` subcommand or `--examples` flag for curated usage patternsno `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.
WARNShort `-h` summary differs from `--help` long form`-h` and `--help` produce byte-identical output. SHOULD-tier — clap renders the short summary on `-h` and the full description on `--help` when `long_about` is set; collapsing them gives agents no concise list-level grep target.
FAILEach subcommand's `--help` ships at least one invocation examplesubcommands missing example invocations in their `--help`: agents, attach, auth, auto-mode, doctor, gateway, import, install, logs, purge, respawn, rm, setup-token, ultrareview. Examples teach agents the call shape faster than option tables; use clap's `after_help` or a dedicated `Examples:` block.
WARNHelp text pairs human and `--output json` example invocationsno paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.
PASSCommand-list entries name the command without repeating the binary name

P4: Fail-Fast, Actionable Errors

PASSRejects invalid arguments
FAILError messages include a hint or remediation phrasestderr lacks a hint phrase. Looked for one of: try , use , expected , did you mean, see , run , for more, tip:, help:, hint:, suggestion:, available . Error messages must name what to do next, not just the symptom.
WARN`--output json` produces JSON-formatted errorserrors under `--output json` are not JSON-formatted. Consumers parsing stdout-as-JSON cannot recover the failure without a separate text-parsing path; switch the error writer to honor the active output mode.

P5: Safe Retries & Mutation Boundaries

FAILDestructive subcommands require `--force` or `--yes`destructive subcommand(s) without `--force` or `--yes`: rm. Irreversible operations must require explicit confirmation so they can't be invoked accidentally.
WARNRead and write surfaces are both visible in subcommand listwrite-pattern subcommand(s) present (purge, rm) but no read-pattern surface detected. If the CLI is write-only by design the MUST is satisfied vacuously; otherwise expose the read surface with agent-recognizable verbs (list/get/show/query/find/search).

P6: Composable, Predictable Command Structure

PASSHandles SIGPIPE gracefully
WARNPager-using CLI ships --no-pager escape hatchpager referenced in --help but no --no-pager escape hatch advertised
PASSRespects NO_COLOR
WARNSubcommand verbs follow community-standard names5/15 subcommand(s) follow standard verb names. Non-standard: agents, attach, auto-mode, gateway, import, mcp, purge, respawn, setup-token, ultrareview. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.
WARN`--color` flag for explicit color controlno `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.
SKIPInput-accepting commands read from stdin when no file is givenno input-accepting subcommand detected (process/parse/convert/transform/analyze/validate/format/lint/audit); vacuous skip for the conditional SHOULD.
WARNSubcommand naming follows a consistent verb/noun conventionsubcommand naming is inconsistent: 1 non-verb subcommand(s) (auth) mix verb and non-verb children at the second level, so an agent cannot predict where the action lives. SHOULD-tier: pick a consistent shape (all verb-first, all noun-verb hierarchy, or any combination where each non-verb group's children are uniformly verbs). The verb list is a heuristic; inspect `--help` to confirm.
PASSOperations are subcommands, not verb-shaped flags

P7: Bounded, High-Signal Responses

WARNQuiet mode availableno --quiet/-q flag detected in --help output
PASS`--verbose` flag for diagnostic escalation
SKIP`--limit` / `--max-results` flag for list operationsno list-style subcommand detected (list/ls/search/query/find/show/get); vacuous skip for the list-only SHOULD.
SKIPCursor-based pagination flags for list traversalno list-style subcommand detected; vacuous skip for the list-only MAY.
SKIP`--timeout` flag for long-running operationsno long-running subcommand detected (serve/daemon/watch/tail/monitor/follow/run/start/stream); vacuous skip for the conditional SHOULD.
PASSHelp text advertises TTY-aware verbosity behavior

P8: Discoverable Through Agent Skill Bundles

PASSSkill bundle has install path (`tool skill install [<host>]`)
PASS`skill install --all` for multi-runtime install
PASS`skill update` / `skill upgrade` for bundle refresh

Details

Version scored
2.1.289
Audit date
2026-10-05 18:43:56 UTC
Duration
2.1s
Platform
linux/x86_64
Mode
command
Anc build
0.6.0
Install
bun add -g @anthropic-ai/claude-code

Embed the badge

The badge floor is 70%; this scorecard is at 68% (2 points below). Once the score clears the floor, the embed snippet will appear here. The top issues above are the place to start.

Reproduce this scorecard for claude-code locally and inspect the failing audits:

anc audit --command claude --output json

Install anc first if you don't have it. Add --output json to get the same JSON shape committed under scorecards/.