scruple.dev

mx

ns

zelda.ns.cloudflare.com

jason.ns.cloudflare.com

caa

txt

dmarc

# As a condition of accessing this website, you agree to abide by the following
# content signals:

# (a)  If a content-signal = yes, you may collect content for the corresponding
#      use.
# (b)  If a content-signal = no, you may not collect content for the
#      corresponding use.
# (c)  If the website operator does not include a content signal for a
#      corresponding use, the website operator neither grants nor restricts
#      permission via content signal with respect to the corresponding use.

# The content signals and their meanings are:

# search:   building a search index and providing search results (e.g., returning
#           hyperlinks and short excerpts from your website's contents). Search does not
#           include providing AI-generated search summaries.
# ai-input: inputting content into one or more AI models (e.g., retrieval
#           augmented generation, grounding, or other real-time taking of content for
#           generative AI search answers).
# ai-train: training or fine-tuning AI models.

# ANY RESTRICTIONS EXPRESSED VIA CONTENT SIGNALS ARE EXPRESS RESERVATIONS OF
# RIGHTS UNDER ARTICLE 4 OF THE EUROPEAN UNION DIRECTIVE 2019/790 ON COPYRIGHT
# AND RELATED RIGHTS IN THE DIGITAL SINGLE MARKET.

# Scruple

> Scruple turns engineering judgment into named, tested code checks that run from the command line.

Use these docs to install and configure Scruple, choose rules and providers, or build plugins and provider adapters.

## Table of Contents

### Getting started

- [Introduction](https://scruple.dev/guide/introduction.md)
- [Quickstart](https://scruple.dev/guide/quickstart.md)
- [Configuration](https://scruple.dev/guide/configuration.md)
- [Agent skills](https://scruple.dev/guide/agent-skills.md)

### Core concepts

- [How Scruple works](https://scruple.dev/concepts/how-it-works.md)
- [Evidence and decisions](https://scruple.dev/concepts/evidence-and-decisions.md)

### Custom rules

- [Write a plugin](https://scruple.dev/guide/writing-a-plugin.md)

### Providers

- [Providers](https://scruple.dev/providers.md)
- [Provider evaluation](https://scruple.dev/providers/evaluation.md)
- [Cloudflare Clef provider](https://scruple.dev/providers/cloudflare.md)
- [Decider provider](https://scruple.dev/providers/decider.md)
- [Jev provider](https://scruple.dev/providers/jev.md)
- [Kev provider](https://scruple.dev/providers/kev.md)
- [OpenAI](https://scruple.dev/providers/openai.md)

### Plugins

- [Plugins](https://scruple.dev/plugins.md)
- [API Contracts](https://scruple.dev/plugins/api-contracts.md)
- [Async](https://scruple.dev/plugins/async.md)
- [Comments](https://scruple.dev/plugins/comments.md)
- [Errors](https://scruple.dev/plugins/errors.md)
- [Observability](https://scruple.dev/plugins/observability.md)
- [Relational Databases](https://scruple.dev/plugins/relational-databases.md)
- [Resources](https://scruple.dev/plugins/resources.md)
- [Security](https://scruple.dev/plugins/security.md)
- [Tests](https://scruple.dev/plugins/tests.md)

### Reference

- [CLI reference](https://scruple.dev/reference/cli.md)
- [Configuration API](https://scruple.dev/reference/configuration.md)
- [Benchmarks](https://scruple.dev/reference/benchmarks.md)

### Other

- [api-contracts/no-ambiguous-failure-contracts](https://scruple.dev/rules/api-contracts/no-ambiguous-failure-contracts.md): Disallow overlapping public failure channels.
- [api-contracts/no-ignored-significant-results](https://scruple.dev/rules/api-contracts/no-ignored-significant-results.md): Do not discard meaningful call results.
- [api-contracts/no-misleading-function-names](https://scruple.dev/rules/api-contracts/no-misleading-function-names.md): Disallow names that contradict visible behavior.
- [api-contracts/no-misleading-http-status](https://scruple.dev/rules/api-contracts/no-misleading-http-status.md): Disallow statuses that contradict visible outcomes.
- [api-contracts/no-side-effects-in-safe-http-methods](https://scruple.dev/rules/api-contracts/no-side-effects-in-safe-http-methods.md): Disallow requested mutation through safe HTTP methods.
- [api-contracts/require-input-validation](https://scruple.dev/rules/api-contracts/require-input-validation.md): Require validation of untrusted boundary input.
- [async/no-async-initialization](https://scruple.dev/rules/async/no-async-initialization.md): Disallow async work hidden in initialization.
- [async/no-serial-independent-work](https://scruple.dev/rules/async/no-serial-independent-work.md): Do not run independent awaits in series.
- [async/no-unbounded-concurrency](https://scruple.dev/rules/async/no-unbounded-concurrency.md): Disallow potentially unbounded promise fan-out.
- [async/no-unobserved-async-work](https://scruple.dev/rules/async/no-unobserved-async-work.md): Do not leave started async work unobserved.
- [async/require-abort-listener-cleanup](https://scruple.dev/rules/async/require-abort-listener-cleanup.md): Require cleanup of abort listeners.
- [async/require-cancellation-propagation](https://scruple.dev/rules/async/require-cancellation-propagation.md): Require accepted cancellation to be forwarded.
- [async/require-race-loser-cleanup](https://scruple.dev/rules/async/require-race-loser-cleanup.md): Require cleanup of locally owned race losers.
- [comments/no-change-history-comments](https://scruple.dev/rules/comments/no-change-history-comments.md): Disallow obsolete change narration.
- [comments/no-commented-out-code](https://scruple.dev/rules/comments/no-commented-out-code.md): Disallow disabled executable implementation.
- [comments/no-misleading-comments](https://scruple.dev/rules/comments/no-misleading-comments.md): Disallow claims contradicted by visible code.
- [comments/no-useless-comments](https://scruple.dev/rules/comments/no-useless-comments.md): Disallow comments with no maintenance value.
- [comments/prefer-concise-comments](https://scruple.dev/rules/comments/prefer-concise-comments.md): Prefer useful but concise comment prose.
- [comments/require-actionable-deprecations](https://scruple.dev/rules/comments/require-actionable-deprecations.md): Require migration guidance in deprecations.
- [comments/require-actionable-todos](https://scruple.dev/rules/comments/require-actionable-todos.md): Require actionable TODO, FIXME, and HACK markers.
- [comments/require-justified-suppressions](https://scruple.dev/rules/comments/require-justified-suppressions.md): Require explanations for tool suppressions.
- [errors/no-lossy-error-wrapping](https://scruple.dev/rules/errors/no-lossy-error-wrapping.md): Disallow replacement errors that lose the original cause.
- [errors/no-message-based-error-dispatch](https://scruple.dev/rules/errors/no-message-based-error-dispatch.md): Disallow control flow coupled to exception prose.
- [errors/no-swallowed-errors](https://scruple.dev/rules/errors/no-swallowed-errors.md): Disallow silently suppressed unexpected failures.
- [errors/no-useless-catch-boundaries](https://scruple.dev/rules/errors/no-useless-catch-boundaries.md): Disallow catch handlers that add no behavior.
- [observability/no-duplicate-error-reporting](https://scruple.dev/rules/observability/no-duplicate-error-reporting.md): Do not report the same caught failure twice.
- [observability/no-sensitive-logs](https://scruple.dev/rules/observability/no-sensitive-logs.md): Disallow sensitive values emitted without redaction.
- [observability/no-unactionable-errors](https://scruple.dev/rules/observability/no-unactionable-errors.md): Require operation and failure evidence in error events.
- [observability/require-operation-context](https://scruple.dev/rules/observability/require-operation-context.md): Require a stable operation identity in events.
- [observability/require-stable-telemetry-names](https://scruple.dev/rules/observability/require-stable-telemetry-names.md): Require stable event, span, and metric names.
- [relational-databases/no-query-in-loop](https://scruple.dev/rules/relational-databases/no-query-in-loop.md): Disallow per-item relational queries.
- [relational-databases/prefer-database-join](https://scruple.dev/rules/relational-databases/prefer-database-join.md): Prefer joining related query results in the database.
- [relational-databases/require-deterministic-pagination-order](https://scruple.dev/rules/relational-databases/require-deterministic-pagination-order.md): Require visible ordering for pagination.
- [relational-databases/require-transaction-scoped-client](https://scruple.dev/rules/relational-databases/require-transaction-scoped-client.md): Require transaction-scoped database clients.
- [resources/no-leaked-resources](https://scruple.dev/rules/resources/no-leaked-resources.md): Disallow owned resources left unreleased.
- [resources/require-bounded-retries](https://scruple.dev/rules/resources/require-bounded-retries.md): Require a finite bound on retry behavior.
- [resources/require-cleanup-on-failure](https://scruple.dev/rules/resources/require-cleanup-on-failure.md): Require cleanup that is safe on failure.
- [resources/require-complete-resource-cleanup](https://scruple.dev/rules/resources/require-complete-resource-cleanup.md): Require complete cleanup of multiple resources.
- [resources/require-retry-backoff-with-jitter](https://scruple.dev/rules/resources/require-retry-backoff-with-jitter.md): Require retry backoff with jitter.
- [resources/require-retry-time-budget](https://scruple.dev/rules/resources/require-retry-time-budget.md): Require an overall deadline for retry work.
- [security/no-sensitive-data-exposure](https://scruple.dev/rules/security/no-sensitive-data-exposure.md): Disallow sensitive data sent through output sinks.
- [security/no-unsafe-redirect](https://scruple.dev/rules/security/no-unsafe-redirect.md): Disallow request-controlled redirect targets.
- [security/no-untrusted-command-execution](https://scruple.dev/rules/security/no-untrusted-command-execution.md): Disallow request data reaching command or code execution.
- [security/no-untrusted-mass-assignment](https://scruple.dev/rules/security/no-untrusted-mass-assignment.md): Disallow wholesale persistence of request objects.
- [security/no-user-controlled-authorization](https://scruple.dev/rules/security/no-user-controlled-authorization.md): Disallow authorization based on attacker-controlled claims.
- [tests/no-fixed-delay-synchronization](https://scruple.dev/rules/tests/no-fixed-delay-synchronization.md): Disallow sleeps used to synchronize tests.
- [tests/no-nondeterministic-tests](https://scruple.dev/rules/tests/no-nondeterministic-tests.md): Disallow uncontrolled inputs that make tests flaky.
- [tests/no-vacuous-tests](https://scruple.dev/rules/tests/no-vacuous-tests.md): Disallow tests with no effective behavior verification.
- [tests/require-specific-error-assertions](https://scruple.dev/rules/tests/require-specific-error-assertions.md): Require assertions that identify the expected failure.