
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
legacylens-cli
Advanced tools
AI-powered CLI to analyze and cleanup legacy code. Features: .gitignore support, Schema Response, Auto-fix ready.
Stop hoarding dead code. Let AI clean up your technical debt.
LegacyLens is a CLI tool that helps developers audit, refactor, and clean up legacy codebases.
Unlike traditional linters that check syntax, LegacyLens uses Google Gemini AI with a three-level analysis architecture:
This makes LegacyLens faster and deeper than traditional AI code analysis - it sees the entire repository structure and connections, not just what you copy-paste.
"It's like having a Senior Architect review your project in 30 seconds."
.gitignore automatically. No Python required. Pure Node.js.LegacyLens uses Google Gemini API. The free tier is generous (15 RPM, 1M TPM). 👉 Get your API Key here
Just run it in your project folder. It will prompt for the key or read it from env.
# Linux/macOS
export GEMINI_API_KEY="your_key_here"
npx legacylens-cli .
# Windows (PowerShell)
$env:GEMINI_API_KEY="your_key_here"
npx legacylens-cli .
npm install -g legacylens-cli
legacylens ./my-project --output audit.html
# Basic analysis
legacylens [project]
# With options
legacylens . --format html --output report.html --verbose
# Build semantic index for code search
legacylens index [project]
# Search code by meaning
legacylens find "authentication logic" [project] --top 10
# Generate API route (auto-detects framework: Express, FastAPI, Flask, etc.)
legacylens create-api --route /users [project] --out routes/users.js
# One-time: install LegacyLens skills into detected IDEs and check API key
npx legacylens-cli setup-skills
# or, if installed globally:
legacylens setup-skills
# Find and remove dead code (with AI confirmation)
legacylens auto-fix [project]
# Dry run (see what would be removed)
legacylens auto-fix [project] --dry-run
LegacyLens generates a clean, professional report (HTML or Markdown) highlighting:
Level 1 - Architectural Skeleton (Local):
Level 2 - Semantic Compression:
Level 3 - Targeted Deep Dive:
Every analysis automatically builds a Project Map that includes:
Build a semantic index for instant code search. The index is automatically detected and used during analysis if available.
You can customize the behavior by creating a .legacylens.json file in your project root:
{
"include": [".js", ".ts", ".jsx", ".py", ".go"],
"ignore": ["coverage", "dist", "legacy-backup"],
"engines": {
"flash": "gemini-3-flash-preview",
"pro": "gemini-3-pro-preview",
"embedding": "gemini-embedding-001"
},
"maxFileSize": 50000,
"maxContextSize": 1000000,
"outputFormat": "html"
}
LegacyLens is designed for pipelines. It returns a JSON report and proper exit codes.
# GitHub Actions Example
- name: Run LegacyLens Audit
run: npx legacylens-cli . --format json --output report.json
env:
GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
LegacyLens is Open Source. The cost depends on the AI model you use.
generativelanguage.googleapis.com..gitignore parsing happen locally before sending context to AI.vscode-extension/)MIT © LegacyLens Team
FAQs
AI-powered CLI to analyze and cleanup legacy code. Features: .gitignore support, Schema Response, Auto-fix ready.
We found that legacylens-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.