Skip to main content
aislop is published to npm, Homebrew, and PyPI. Every channel installs the identical aislop and aislop-mcp commands. Pick the channel that fits your stack — or run without installing at all using npx aislop@latest scan.

​
Requirements

aislop requires Node.js 20 or later. You can check your version with node --version. The Homebrew install pulls Node as a dependency automatically; the pipx install requires Node to already be on your PATH.

​
npm, Yarn, pnpm, and Bun

Install aislop as a project dev dependency or as a global binary, depending on how you plan to use it.
After a local dev-dependency install, run aislop via your package manager:
Use npx aislop@latest scan to always run the latest published version without managing a local install. This is the recommended approach for one-off scans and CI pipelines where you want automatic updates.

​
Homebrew

Install aislop on macOS or Linux via the official tap:
Equivalent two-step form if you prefer to tap separately:
Homebrew installs Node.js as a runtime dependency if it is not already present. Upgrade aislop with:
More details: scanaislop/homebrew-tap

​
pipx (Python environments)

For Python-centric projects or environments where pipx is your standard tool installer:
pipx keeps aislop in an isolated virtual environment so it never conflicts with your Python dependencies. Plain pip install --user aislop also works. Both options still require Node.js on your PATH because aislop’s analysis engines run on Node. Upgrade with:
More details: aislop on PyPI

​
GitHub Packages

aislop is also published as @scanaislop/aislop on GitHub Packages. Use this channel when your organisation’s security policy requires packages to be sourced from GitHub’s registry:

​
Bundled tooling

aislop ships the following tools as package dependencies or bundled binaries — you do not need to install them separately: ruff and golangci-lint are downloaded as binaries during npm install (or equivalent). To skip binary downloads — for example in air-gapped environments or when you want to manage these tools yourself — set the environment variable before installing:

​
External tools

Some engines depend on tools that must already be installed on your machine. These are not bundled because they require language toolchains to be present anyway.
If an external tool is missing, aislop skips the corresponding engine and notes it in the scan output. Scores for projects in those languages will be lower than they would be with full engine coverage. Run aislop doctor to see exactly which engines are available on your system.

​
Verify your installation

After installing, confirm everything is working:
aislop doctor reports on each engine’s availability, flags any missing external tools, and shows the language coverage for the current directory.

​
Show your score badge

Once you have a score, display it in your README:

​
Next steps

Quickstart

Run your first scan, read your score, and add a CI gate in four steps.

Configuration

Tune score thresholds, override rule severity, and manage project-wide ignores.