CheckYourself is a free, open-source, model-agnostic completeness evidence workflow for reviewing applications built with the help of AI coding assistants. It turns Cursor, Claude, ChatGPT, Gemini, Copilot, Windsurf, Replit, Lovable, Bolt, Codex, or local agents into pre-release reviewers: it inspects the application, records observed and untested behavior, runs validator-owned challenges, exposes production gaps, proposes fixes pending approval, verifies local receipts, and generates a learning plan based on the project's actual gaps.
Purpose: to answer "Is this application really ready to ship? If not, what exactly is wrong, and how do I fix it?" It is aimed at beginners, intermediate builders, experienced developers, indie developers, freelancers, agencies, and teams preparing for a formal launch.
Main capabilities: it uses a phased engineering system rather than a single prompt. It includes an ICM-style context workspace that routes agents to each phase via CONTEXT.md; an evidence-based 0-100 scoring method with severity caps; validator-owned challenges covering 20 canonical surfaces and 10 scoring categories; a 19-item capability production hardening engine covering authentication, data, secrets, CI/CD, observability, privacy, and AI governance; JSON output schemas, report and risk templates, and a public verification suite. Outputs include a project map, detected tech stack, production reality score, coverage scan, complete findings register, complete remediation to-do list, highest-severity approval batch, guided remediation loop, and a tailored learning plan. An optional output is a self-contained HTML/CSS dashboard.
How to use: download or clone the repository, place the checkyourself folder inside or next to your project, have your AI coding assistant use that folder as the operating context, start from CONTEXT.md, and beginners should read START_HERE.md first. Run the read-only diagnostic and review the production reality report, approve fixes individually or in safe reversible batches, and after each batch re-check and re-score until every finding is fixed or proven not applicable. Optionally install the CLI/MCP interface from npm; underneath it is a standard-library-only Python tool (Python 3 required, Node only used for launching). The CLI provides scanning and scaffolding, challenge execution, score re-runs, and report verification; MCP is a local stdio wrapper with no hosted API.
Limitations: the score is limited-scope evidence, not a production security guarantee or certification. Local integrity HMAC is only project-local tamper-evident evidence; it does not prove independent issuance, operator identity, or external custody. The local CLI does not infer security, dependencies, coupling, or blast radius. The dashboard consumes extra tokens and is generated only when the user requests it. The ASTRA adversarial review report and remediation report are not included in the repository.
