Interlace — Static Analysis for Humans + AI Agents

Install today, npm soon. Recipes below use npx @interlace/* and GitHub Actions that run as soon as the publish-packages.yml workflow completes a non-dry-run. Until then, every command works from a git clone https://github.com/ofri-peretz/eslint && npm install — invoke via node packages/interlace-cli/src/index.mjs <subcommand>.

The thesis. Static-analysis tools for JavaScript / TypeScript have spent 20 years optimizing for the human reviewer (IDE squiggles, PR comments, severity buckets). The agent-as-consumer angle is barely staked. Interlace owns it — every rule emits CWE-tagged findings consumable by AI agents (Claude Code, Cursor, Copilot) via MCP, plus humans via VS Code / GHAS / SARIF / your CI.

The 30-second pitch

# In your project:
npx @interlace/cli init       # writes a starter eslint.config.mjs
npx @interlace/cli audit      # lint everything with the security suite

# In CI (GitHub Actions):
- uses: ofri-peretz/eslint/.github/actions/audit@main
  with:
    plugins: all
    fail-on: error            # SARIF auto-uploaded to Code Scanning Alerts

# For your AI agent (Claude Code, Cursor):
{
  "mcpServers": {
    "eslint": { "command": "npx", "args": ["--yes", "@eslint/mcp"] }
  }
}

That's the whole product surface.

Headline numbers

Live numbers regenerate from benchmark-results/. If a number here disagrees with the JSON, the JSON wins.

What makes this different

Three legs the static-analysis field has not integrated:

1. The agent-axis benches

2. The toolchain-matrix coverage

We bench across 5 dimensions independently:

• Node versions — 18 / 20 / 22 / 24
• TypeScript compilers — tsc-classic (5.x) and tsc-go (6.x — Project Corsa)
• ESLint majors — 8 / 9 / 10
• Parser modes — js / js+jsx / ts / ts+jsx
• Cache state — cold / warm

Zero finding drift across the entire matrix. Every cell verified by npm run ilb:*-matrix.

3. The credibility seals + open governance

• MITRE CWE Compatibility — 8/8 criteria met (submission packet ready)
• NIST SP 800-218 SSDF mapped per-rule (npm run ilb:mappings:report)
• OWASP ASVS L1/L2/L3 mapped per-rule
• MITRE ATT&CK / CAPEC mapped per-rule
• ISO/IEC 25010:2023 mapped for quality plugins
• Pre-registered — every result envelope carries the methodology commit SHA
• Externally-governed corpus (3-steward voting model, non-Interlace majority — plan ready, repo creation pending)
• Public submission protocol — any tool can submit a SARIF run; leaderboard auto-rebuilds

How to consume Interlace

Installation matrix

Try it now (no install)

git clone https://github.com/ofri-peretz/eslint
cd eslint && npm install
npx @interlace/cli audit examples/vulnerable-app/src

The examples/vulnerable-app/ directory has one file per flagship rule. You'll see ~10-15 findings, each tagged with its CWE.

Bench reference

For the full bench catalog (26 benches + 8 reporters + 4 quality gates), see benchmarks/README.md.

For the agent-onboarding prelude (single-read context for any AI working on the bench), see .agent/rules/bench-context.md.

Status

Acknowledgements

Built on the shoulders of every prior open-source SAST effort — OWASP Benchmark Project (Java), NIST SARD/Juliet, MITRE CWE/CAPEC. Where a methodology existed, we mirrored it; where none did for JavaScript, we say so explicitly.