🗺️ Roadmap 2026 — What We're Building

[raye-deng]

Open Code Review Roadmap 2026

✅ Completed (Q1 2026)

• L1/L2/L3 scanning engines
• Phantom Package Database
• GitHub Action + GitLab CI Component
• SARIF output + --diff mode
• TypeScript/JavaScript support

🔨 In Progress

• Python + Java + Go + Kotlin support
• Web Portal v2

📋 Planned (Q2 2026)

• GitHub App for one-click installation
• VS Code + JetBrains extensions
• Slack/Teams CI notifications
• License key system (Free / Team / Enterprise)

🎯 Planned (Q3-Q4 2026)

• Self-hosted cloud (Docker/K8s)
• Custom rule engine
• Marketplace for community rulesets

Want to help? Check issues labeled `good first issue` or join our Discussions.

[raye-deng]

🗺️ Roadmap Progress Update — March 2026

✅ Completed Since Roadmap Posted

V4 Architecture — DONE ✅

• L1 (Pattern Matching): Fast structural detection of hallucinated imports, phantom APIs, deprecated patterns
• L2 (Deep Analysis): Embedding-based deep hallucination detection with registry verification
• L3 (LLM-Assisted): AI-powered scanning via OpenAI-compatible APIs or local Ollama

MCP Server — LIVE ✅

• Published on Smithery, Cursor Directory, Glama, and ClawHub
• Streamable HTTP transport + Cloudflare Worker deployment
• Compatible with Cursor, Cline, Windsurf, Continue, Roo, and Chrome DevTools MCP

CI/CD Integration — DONE ✅

• GitHub Action available and working
• SARIF output for GitHub Security tab integration
• --diff mode for PR-only scanning

Distribution — Growing 📈

• NPM weekly downloads: 585+
• CLI at v2.1.4, Core at v2.1.2
• 36 commits shipped since v2.1.1

Recent Feature Additions:

• 🆕 41 deprecated API patterns (React/Vue/Angular)
• 🆕 9 AI-specific security anti-patterns
• 🆕 Unicode invisible character detection
• 🆕 Hallucination fallback + single-impl abstraction detection
• 🆕 AI IDE rules for Copilot/Cline/Windsurf/Continue/Roo
• 🆕 Multi-language registry support (Java, Go, Kotlin)

🔨 Current Focus (Q2 2026)

• Python + Java + Go + Kotlin language support (registry detection in place, full parser coming)
• GitHub App for one-click installation
• VS Code + JetBrains extensions
• Web Portal v2

🎯 Next Steps

1. Expand language support — Full Python/Java/Go parser integration
2. GitHub App — One-click install for organizations
3. IDE extensions — VS Code marketplace submission
4. Community growth — More phantom package contributions (see 📊 Help us build the Phantom Package Database — share your hallucinated imports! #4)

Feedback and contributions welcome! 🚀