fallow

Fallow is a Rust-native static-analysis CLI for TypeScript and JavaScript codebases. It builds one dependency graph per repository — spanning imports, exports, and even CSS classes — and reports unused code, circular dependencies, duplicated logic, complexity hotspots, architecture-boundary violations, and design-system styling drift from that single graph. The default analysis runs entirely in Rust against the oxc parser, with no TypeScript compiler or Node.js runtime in the loop, so it stays fast even on large monorepos; an opt-in --type-aware mode adds compiler-backed evidence only where syntactic analysis can’t disambiguate aliases, re-exports, or cross-package symbol identity.

Beyond the CLI, fallow ships an MCP server and an LSP server built on the same engine, so editors and coding agents see the same typed findings a human would get from the terminal, plus Node bindings for programmatic use. fallow audit scopes analysis to just the files a change touched and produces a pass/warn/fail verdict, so adopting fallow on an existing codebase doesn’t require clearing a legacy backlog first. An optional paid layer, Fallow Runtime, merges real production V8/Istanbul coverage into the static findings to distinguish code that’s genuinely dead from code that’s merely hard to reach statically.

What You Get

• A single CLI (fallow) plus an LSP server (fallow-lsp) and MCP server (fallow-mcp) built from the same Rust analysis engine
• Dead-code, circular-dependency, duplication, complexity/health, architecture-boundary, and CSS-drift analyses in one tool
• A changed-file PR gate (fallow audit) with typed JSON, SARIF, Markdown, GitHub/GitLab CI, and health-badge output formats
• An optional --type-aware mode for TypeScript-compiler-backed evidence, and an optional paid runtime-coverage layer for production execution evidence
• Auto-fix previews, a config recommender that detects your stack, and over 100 built-in framework plugins with zero required configuration

Common Use Cases

• Gating pull requests in CI so only newly introduced dead code, duplication, or drift fails the build
• Proving a symbol is safe to delete before a refactor, with exact caller and consumer evidence
• Wiring an MCP server into a coding agent so it can query dead code, duplication, and architecture violations directly
• Migrating off knip, jscpd, or stylelint configuration with fallow migrate
• Auditing CSS-in-JS and stylesheet duplication for design-system drift across a large frontend codebase

Under The Hood

Architecture Fallow is a Rust workspace of roughly fifteen crates, each owning one concern: core orchestrates discovery, plugin dispatch, and caching; extract parses source (via the oxc AST and lightningcss) into structured module, CSS, and framework data; graph builds the dependency/import graph; engine runs the actual analyses (dead-code, duplication, complexity, boundaries, security, similar-code) against that graph; output renders the typed JSON/SARIF/Markdown/badge contracts; and cli, lsp, mcp, and napi are four separate front-ends over the same engine. Execution flows one direction — front-end to engine to extract/graph to core primitives — so a change to the core graph representation would ripple through every analysis and output format, while the four front-ends can evolve independently since none depends on the others.

Tech Stack The workspace targets a recent Rust edition and toolchain and is built on oxc (parser, AST, semantic, resolver) for JS/TS parsing and lightningcss/cssparser for CSS, with clap for the CLI, serde/serde_yaml_ng/toml for config and output serialization, rayon and dashmap for parallel analysis, tower-lsp-server and tokio for the LSP, a dedicated napi crate for the Node addon, miette for diagnostics, and bitcode/postcard for a persisted graph cache. Distribution runs through prebuilt per-platform npm packages selected at install time, a separate cargo install channel, and a Docker image.

Code Quality The repository carries an extensive Rust test suite plus a large bank of snapshot fixtures, workspace-wide Clippy lints enabled at the strictest available levels (with narrow, documented exceptions), and unsafe code required to carry justification comments. Its CI matrix spans standard checks, coverage tracking, fuzzing, cross-architecture builds, supply-chain scorecarding, and performance-regression benchmarks, and the repository runs its own analysis and verification scripts against itself before every commit.

What Makes It Unique Fallow’s differentiator is doing dead-code, duplication, architecture, circular-dependency, and CSS-drift analysis as one Rust-native, oxc-based syntactic pass with no TypeScript compiler or Node runtime required for the default path; an optional type-aware mode adds compiler-backed evidence only where syntactic analysis can’t disambiguate. It also ships an unusual runtime-intelligence tier that merges real production coverage into static findings to distinguish genuinely dead code from code that’s merely hard to reach statically, alongside a suffix-array duplication detector and an opt-in local-model semantic similar-code pass — combining classic static analysis with production evidence and semantic matching in one CLI is not something comparable single-purpose tools do.