Skip to main content
aislop is published to npm, Homebrew, and PyPI. Every channel installs the identical aislop and aislop-mcp commands. Pick the channel that fits your stack, or run without installing: npx aislop@latest scan.

​
Requirements

aislop requires Node.js 20 or later. You can check your version with node --version. The Homebrew install pulls Node as a dependency automatically; the pipx install requires Node to already be on your PATH.

​
npm, Yarn, pnpm, and Bun

Install aislop as a project dev dependency or as a global binary, depending on how you plan to use it.
After a local dev-dependency install, run aislop via your package manager:
Use npx aislop@latest scan to always run the latest published version without managing a local install. This is the recommended approach for one-off scans and CI pipelines where you want automatic updates.

​
Homebrew

Install aislop on macOS or Linux via the official tap:
Equivalent two-step form if you prefer to tap separately:
Homebrew installs Node.js as a runtime dependency if it is not already present. Upgrade aislop with:
More details: scanaislop/homebrew-tap

​
pipx (Python environments)

For Python-centric projects or environments where pipx is your standard tool installer:
pipx keeps aislop in an isolated virtual environment so it never conflicts with your Python dependencies. Plain pip install --user aislop also works. Both options still require Node.js on your PATH because aislop’s analysis engines run on Node. Upgrade with:
More details: aislop on PyPI

​
GitHub Packages

aislop is also published as @scanaislop/aislop on GitHub Packages. Use this channel when your organisation’s security policy requires packages to be sourced from GitHub’s registry:

​
Bundled tooling

oxlint, Biome, knip, and expo-doctor ship as package dependencies. Package installation does not run dependency lifecycle scripts, so the core scanner works with npm’s secure install defaults. For bundled ruff and golangci-lint coverage, run the explicit tool installer once after installing aislop:
One-off from npx:
The command exits non-zero if a supported binary cannot be installed. Skip it in air-gapped environments and install those tools yourself, then confirm coverage with aislop doctor.

​
External tools

Some engines depend on tools that must already be installed on your machine. These are not bundled because they require language toolchains to be present anyway. C# and C/C++ receive built-in text and complexity checks without these tools. On macOS, install the optional toolchains with:
C# project evaluation is opt-in. Enable it only for repositories you trust:
If an external tool is missing, aislop skips the corresponding engine and notes it in the scan output. Scores for projects in those languages will be lower than they would be with full engine coverage. Run aislop doctor to see exactly which engines are available on your system.

​
Verify your installation

After installing, confirm everything is working:
aislop doctor reports on each engine’s availability, flags any missing external tools, and shows the language coverage for the current directory.

​
Show your score badge

Once you have a score, display it in your README:

​
Next steps

Quickstart

Run your first scan, read your score, and add a CI gate in four steps.

Configuration

Tune score thresholds, override rule severity, and manage project-wide ignores.