Imagev0.2.1-beta

Catch Angular anti-patterns before they ship.

ngcompass checks templates, RxJS, signals, SSR, security, and TypeScript patterns before they reach production. It runs locally, understands Angular semantics, and produces output you can act on.

43Angular rules
v15+Supported
SARIFNative
FreeTo use
8 domains · 43 rules

Checks that understand Angular.

Eight domains, written specifically for Angular projects. Each rule is type-aware where it matters, template-aware where it matters, and explains the failure in Angular terms.

  • Templates

    Old *ngIf / *ngFor syntax, unsafe innerHTML bindings, duplicated async pipes.

  • RxJS

    Missing teardown, subscribe() inside components, nested subscribe chains.

  • Signals

    Side effects inside computed(), legacy @Input() instead of input.required().

  • SSR

    Browser-only globals in universal code, patterns that break hydration.

  • Security

    DomSanitizer bypass calls, unsafe innerHTML and style template bindings.

  • Performance

    Missing OnPush, function calls in templates, lists without trackBy.

  • Modern APIs

    Constructor DI instead of inject(), legacy output patterns.

  • Testing

    fdescribe / fit helpers, fakeAsync/tick in zoneless specs, and stale fixture.detectChanges() calls.

· 43 rules across 8 domains

Explore every rule
Terminal output

Output you can act on.

Findings include severity, file location, rule id, a code frame, and a suggested fix. The terminal output is the same content as the SARIF and JSON reporters.

ngcompass
ngcompassanalyze
HTML report

Reports without a service.

Generate a self-contained HTML report. Open it locally. Share it when needed. No server, no account, no upload.

View sample report
CI integration

CI output.

Emit SARIF and upload to GitHub Code Scanning. Findings appear as inline review comments on the offending line of the diff.

src/app/orders/orders.component.ts
Pull request #482
12ngOnInit() {
13  this.api.fetchOrders()
14    .subscribe(orders => {
15      this.orders = orders;
16    });
17}
ngcompass · Code ScanningError
rxjs-require-takeUntilDestroyed

Subscription has no teardown and can outlive the component. Pipe through takeUntilDestroyed().

Privacy by design

Local by default.

ngcompass runs entirely on your machine. Source code is never uploaded, no telemetry is sent, no account is required.

  • Source stays local
  • Zero telemetry
  • No account
  • Self-contained reports
Frequently asked

Questions, answered.

Licensing, supported versions, CI integration, and how ngcompass differs from other linters.

  • 01Is ngcompass free?

    Yes. Free to use during beta and after 1.0.

  • 02Does it replace angular-eslint?

    No. They are complementary. angular-eslint handles syntax and style. ngcompass handles architecture, Angular semantics, and patterns that require type awareness. Run both.

  • 03Which Angular versions are supported?

    Angular v15 and later. Node.js 20.19.0+ or 22.12.0+ is required on the host machine.

  • 04Does it work in CI?

    Yes. ngcompass exits with a non-zero code when violations above the configured severity are found. Use --format sarif to upload results to GitHub Code Scanning for inline PR annotations.

  • 05Does source code leave my machine?

    No. ngcompass runs locally. Source files are read from disk and never uploaded. There is no telemetry.

  • 06Can I tune rules?

    Yes. The rules key disables or re-severities individual rules. The overrides key applies different rule severities to file globs — useful for legacy directories or generated code.

Ask another question