Your tests pass. That is not the same as working.
Margyn audits the machinery that is supposed to catch your bugs, then hands you the command that proves each finding. Point it at a repository and it answers in about a second.
npx margyn-scan /path/to/repo
Node 22 and git. No account, no config file, nothing uploaded.
Get Watch, 3 days free See a real finding
- No account
- No network call
- Zero dependencies
- MIT licensed
Three ways a green pipeline lies to you
| A file the build reads is not in the commit | Your machine has it untracked, so every local run is green. A clean clone does not have it, so CI fails on a file nobody removed. The diff looks innocent, because the defect is an absence. |
|---|---|
| A test that asserts nothing | It calls the code, throws nothing, then reports green whatever came back. It counts toward coverage and guards nothing, so the bug it was written for ships anyway. |
| A gate nobody invokes | A verify or test:online script
sits in the manifest, reads as coverage to every reviewer, then never fails because no
workflow calls it. |
All three are invisible to a code reviewer, to a coverage percentage and to an AI that reads the diff. Margyn was written from the first one, then from the other two.
Three steps, about a second
- Run it.
npx margyn-scan .in any git repository. Nothing to install, no account, no configuration file. - Read the findings. Each names a file and a line, says why it matters, then gives you the command that reproduces it. A finding that cannot carry one is dropped rather than printed.
- Gate the pipeline. Exit code 1 when anything was found, so one line in your workflow turns it into a required check.
- uses: zkasuran/margyn@v0
with:
path: .
That is the whole integration. The action lives in the same repository as the scanner and pins the release it runs, so a job cannot change under you. Our own pipeline runs it over our own repository on every push.
What it looks for
-
ignored-sourcehigh
Files the repository reads that git never committed. Green on your laptop because the file is on your disk untracked, red in CI reading something that was never pushed.
-
no-assertionhigh
Tests that assert nothing, so only an exception can fail them. Assertions reached through a helper count, as does a declared count like
t.plan(11). -
cannot-failhigh
Tests full of assertions that hold whatever the code does: a literal answered in a catch, a swallowed assertion, a status list that accepts both the success and the failure.
-
mutationhighpart of Watch
Inverts a line, runs your suite, then reports the suite that stayed green anyway. There is no arguing with a test that passed while the thing it guards was inverted.
-
unrun-checkmedium
A gate declared in the manifest that no workflow invokes and no sibling script calls. It reads as coverage in the repository and cannot fail.
-
lint-blindspotmedium
Linters whose exclusions come from the ignore file instead of their own config, so a newly tracked path silently enters the tool's scope.
What fires each check, what deliberately does not · Ask for a check that does not exist
Who runs this
| Your AI wrote most of last month's tests | Volume went up and nobody audited the tests. The tools that generate them cannot check them, since they wrote them. Margyn reads what the repository claims to verify, then proves which of those claims are empty. |
|---|---|
| You own a monorepo with vendored files | Ignore rules reach further than anyone remembers, so a file the build reads can be missing from the commit while every local run stays green. |
| You inherited the suite | Nobody left can say which tests are load bearing. Invert a line and see which ones notice. The ones that do not are your answer. |
| You own the CI gate | You are the one who gets asked why the pipeline was green on Friday. Margyn fails the build on exit code 1 rather than filing a dashboard nobody opens. |
A real run, on a repository you know
Two fastify tests that hold whatever the code does
Run it yourself: git clone --depth 1 https://github.com/fastify/fastify
then npx margyn-scan fastify. At commit 6e95cb9 it reads 13 findings, 7
tests that assert nothing, 2 whose only assertion is on a literal, 4 scripts no workflow invokes.
This is the shape worth seeing, because the test reads as rigorous.
margyn /tmp/fastify 13 findings, each with a reproduction you can run. 8. test "DNS errors does not stop the main server" has one assertion and it is on a literal, so nothing but an exception can fail it HIGH cannot-fail test/internals/server.test.js:18 t.assert.ok(true, 'server started') why: The assertion is about a literal, not about the code, so it reports green with the subject broken or deleted. reproduce: # the assertion holds with the subject removed entirely: sed -n '18p' test/internals/server.test.js
That line is the whole finding. The test starts a
server, then asserts that true is true, so it passes with the server code deleted.
Nothing in a diff, a coverage number or a review shows it.
Where it sits next to the tools you already pay for
None of this is a replacement. The right column is the argument: each of these answers a different question. None of them answers ours.
| Tool | What it answers |
|---|---|
| Margyn | Does this suite check anything, with a command that proves each answer. Billed per repository owner, never per seat. |
| Coverage, Codecov for one | Did this line run while a test was in progress. Their own blog concedes that it is too easy to write high-coverage tests that don't deliver value. Billed per user. |
| Static analysis, Sonar or Codacy | Does this code match a rule set. Billed per line of code or per committer. |
| AI reviewers, CodeRabbit or Qodo | Does this diff look wrong, plus here are more tests. They manufacture the artefact we audit. Billed per user. |
| Mutation frameworks, Stryker or PIT | What percentage of mutants your suite kills. Free and open source, better at scoring than we are, which is why we never print a score. |
Billing models read from each vendor's own pricing page on 2026-08-05. If a mutation score across a whole codebase is what you want, use Stryker.
Five checks free. The sixth is $8.99 a month.
Free scan
$0 forever
- Five static checks, no account, no licence
- A reproduction under every finding
- Exit code 1, so it gates CI today
npx margyn-scan /path/to/repo
Watch
$8.99 a month, 3 days free
- Everything in the free scan
- The mutation proof: it inverts a line, runs your suite, reports what stayed green
- A licence your CI verifies offline, so it works on a runner with no network
- Cancel whenever. The free checks keep working either way
Per repository owner, never per seat. A CI gate has no seats, so charging for engineers who never open the tool would be charging for nothing. Team is $29 a month for every repository an organisation owns, and Fix flow is $79 a month if you would rather the findings arrived already fixed, as a patch carrying a test that fails before it and passes after.
Questions people ask before they run it
Is my code uploaded?
No. There is nowhere for it to go. Margyn is a local command line tool. The deployed
site has no scan endpoint on purpose, which you can check: POST /api/scan
answers 404. The security page lists every process it starts.
How many false positives am I about to eat?
On five public repositories at named commits it reported 0, 0, 1, 3 and 10 findings. That run also produced seven wrong ones, all in one file, so the checker was fixed rather than the number. Both the before and the after are on the proof page.
Does it need an account to try?
No. npx margyn-scan /path/to/repo needs no sign in, no key and no network. An
account exists to buy the mutation proof and collect a licence.
What happens to my build if billing breaks?
Nothing. Ask for a paid check without a valid licence and Margyn prints the reason, runs the free scan in full, then exits on your findings rather than on your billing.
It edits my files?
Only under --mutate, one file at a time, only after your suite has passed
unmutated. Each file is restored in a finally block and on
SIGINT. Leave the flag off and nothing is ever written.
Who is behind it?
Asura Coding Works. The code is MIT licensed and public, sign in and payments run on Tiun. Support goes through the repository issues.
Run it on your own repository
npx margyn-scan /path/to/repo
If it finds nothing, you learned that for free in about a second. If it finds something, every line comes with a command that proves it.