minikin/cargo-crap

Change Risk Anti-Patterns (CRAP) metric for Rust projects

What it solves

cargo-crap is designed to identify "complex and untested" Rust functions. It targets the risk areas in a codebase where a change is most likely to cause a regression because the function is logically complex (high cyclomatic complexity) but lacks sufficient test coverage.

How it works

The tool parses Rust source code using syn and reads LCOV coverage files (generated by tools like cargo-llvm-cov or cargo tarpaulin). It calculates a CRAP (Change Risk Anti-Patterns) score for every function using the formula:

CRAP(m) = comp(m)² × (1 − cov(m)/100)³ + comp(m)

Where comp is the cyclomatic complexity and cov is the line coverage percentage. A high score indicates a function that is both complex and poorly tested. The tool can be integrated into CI/CD pipelines to fail builds if scores exceed a specific threshold or if a regression in the score occurs.

Who it’s for

Rust developers and teams who want to maintain high code quality and test coverage, particularly when dealing with AI-generated code which may contain hidden complexity.

Highlights

  • CI/CD Integration: Supports failing builds based on thresholds or regression gates to prevent quality decay.
  • LCOV Compatibility: Works with standard Rust coverage tools.
  • Detailed Reporting: Provides tables with coverage percentages and uncovered line ranges.
  • AI-Powered Triage: Optionally integrates with TypeSafe to analyze duplicate functions and determine if they should be merged based on logic rather than just structure.
  • Multiple Output Formats: Supports human-readable tables, Markdown, PR comments, and JSON.

Related

  • Project
    kucherenko/jscpd

    A high-performance Rust-based engine that detects duplicate code, dead code, and complexity hotspots across 224+ languages, featuring AI-ready integration via an MCP server.

  • Project
    camel-ai/crab

    CRAB is a Python-centric framework for building and evaluating multimodal embodied AI agents across diverse environments like Docker, VMs, and physical machines.

  • Project
    Kritt-ai/open-kritt

    open·kritt is an open‑source, self‑hosted platform that orchestrates AI agents (via Codex, Claude Code, Grok Build, etc.) to run custom, prompt‑driven security workflows on code repositories. It builds focused tasks, runs them in parallel Docker containers, validates findings, de‑duplicates and ranks them, and exports a complete report bundle. Designed for bug‑bounty researchers and DevSecOps, it offers a web UI and a headless CLI, supports any model provider, and is released under AGPL‑3.0.

  • Project
    Cranot/roam-code

    roam-code is a local, open-source tool that builds a searchable index of a codebase and provides static analysis commands and MCP tools for AI coding agents, helping them understand code, evaluate changes, and run checks without sending data to the cloud.

  • Project
    firecrawl/pdf-inspector

    pdf‑inspector is a Rust‑based library (with Python, Node, and WASM bindings) that rapidly classifies PDFs, extracts position‑aware text, and converts it to clean Markdown. It can route only the pages that need OCR to a local model, saving time and cost. Benchmarks show it faster and more accurate than similar tools on a 200‑PDF test set.