> For the complete documentation index, see [llms.txt](https://kerno.gitbook.io/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kerno.gitbook.io/docs/kerno-audit/run-an-audit.md).

# Run an audit

Run one command in a repository, answer a few questions, and get a link to your results.

### Before you start

* **A full clone of the repository.** The audit compares up to 24 months before adoption with every month since.
* **The Kerno CLI.** Install it with `npm install -g @kerno/cli`.
* **Node.js 22 or later** for API routes, imports between modules and rework per endpoint. On older versions the rest of the audit runs, and those measures are skipped.

The audit installs the code parser it needs, codegraph, into `~/.kerno/audit/tools`. To check your machine first, run `kerno audit --doctor`.

### Run it

From the root of the repository:

```bash
kerno audit
```

Press Enter on any question to take the highlighted answer.

On your first run, the audit asks:

1. **What to send to Kerno.** By default it sends the results with the quoted code behind each finding, so your team can check every finding. You can strip the code, or keep the run on your machine. See [Data and privacy](/docs/kerno-audit/data-and-privacy.md).
2. **Whether the judge may read code extracts.** The judge settles what counting can't, such as whether two similar functions do the same job. Say no and judged measures read **unjudged**.

Your answers are kept. Run `kerno audit --data-sharing` to change them.

On every run, the audit asks:

3. **Sign in.** Needed to upload or to use the judge. The audit opens your browser, then asks which organization the report belongs to. Decline, and the results stay on your machine with judged measures unjudged.
4. **When AI coding agents arrived.** The audit proposes a month from the agent traces in your commits. Confirm it, enter a month as `YYYY-MM`, or say your team doesn't use coding agents to run without a before and after.
5. **How much history to compare against.** Twelve months is the default. Choose 24 if your history goes back that far. Six months is too short to trust a trend.

{% hint style="info" %}
The proposed month is when the share of AI-attributed commits rose and stayed up. If you know agents arrived earlier, enter that month. You know your team better than the commits do.
{% endhint %}

### When it finishes

The audit prints a short summary and the link to your results:

```
✓ Uploaded to https://portal.kerno.io/<organization id>/audit?repo=<owner>%2F<name>
```

See [Read the results](/docs/kerno-audit/read-the-results.md).

If the upload is skipped or fails, the audit says why. The report is on your machine either way, under `~/.kerno/audit/runs/<folder>/latest/`, where `<folder>` is the checkout's folder name. It holds `report.md`, the full report, and `brief.md`, a summary to paste into a deck or a chat. The audit keeps your last 50 runs.

### Add review and merge data

Review and time-to-merge figures come from GitHub. To add them, connect the Kerno GitHub App and give it read access to the repository's pull requests. See [Integrations and API keys](/docs/portal/integrations.md).

### Re-run and compare

Run `kerno audit` again whenever you want a fresh reading, such as once a quarter. The portal shows the newest run.

```bash
kerno audit --history          # list the runs kept for this repository
kerno audit --diff ~1..latest  # compare the previous run with the newest
```

### Run it unattended

For a script or a CI job, pass `-y` and the adoption month:

```bash
kerno audit -y --adoption 2026-03
```

An unattended run takes every default, which includes uploading the quoted code. Add `--no-evidence` to strip it, or `--local` to send nothing.

To upload, sign in first with an API key from **Settings → API Key** in the portal:

```bash
kerno login --api-key <key> --org <organization id>
```

Or set `KERNO_API_KEY` and pass `--org <organization id>` to `kerno audit`.

### Audit several repositories

Run `kerno audit` in each repository. Once two or more are audited, the portal compares them side by side. See [Repositories](/docs/kerno-audit/read-the-results/repositories.md).

An organization can audit up to 10 repositories, and re-auditing one of them is always allowed. A run you start yourself stops before measuring a new repository past the limit. An unattended run measures first, and then the upload is refused. To audit more, [contact us](https://kerno.io/contact/).

### Options

| Option                             | What it does                                                                                                                         |
| ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `--root <path>`                    | Repository to audit. Defaults to the current directory.                                                                              |
| `--branch <name>`                  | Branch changes land on. Detected by default.                                                                                         |
| `--name <label>`                   | Name for the report and its run folder.                                                                                              |
| `--run-dir <path>`                 | Where the report and caches go. No run history is kept.                                                                              |
| `--adoption <YYYY-MM\|auto\|none>` | Month agents arrived. `auto` takes the detected month, and `none` runs without a comparison.                                         |
| `--baseline <3\|6\|12\|24>`        | Months before adoption to compare against. Defaults to 12.                                                                           |
| `--plugins <a,b>`                  | Run only these metrics, from `timeline`, `duplication`, `complexity`, `followups`, `churn`, `cost`, `tests`, `modules` and `routes`. |
| `--enable <a,b>`                   | Turn on an optional measure, such as `complexity-judge`.                                                                             |
| `--snapshots <n>`                  | How many times across the window the whole tree is measured. Defaults to 24.                                                         |
| `--complexity-threshold <n>`       | Cyclomatic complexity above which a function counts as complex. Defaults to 10.                                                      |
| `--budget <usd>`                   | Cap on judge spend for the run. Defaults to $20.                                                                                     |
| `--concurrency <n>`                | Parallel git and judge calls. Defaults to 8.                                                                                         |
| `--org <name\|id>`                 | Organization the run belongs to. Use the id in unattended runs.                                                                      |
| `--no-codegraph`                   | Skip routes, module imports and rework per endpoint. On a machine that never installed codegraph, the run stops.                     |
| `--offline`                        | Never download anything.                                                                                                             |
| `--trace-judge`                    | Record every judge request and answer.                                                                                               |
| `--doctor`                         | Check that the audit can run here, then exit.                                                                                        |
| `--history`                        | List the runs kept for this repository.                                                                                              |
| `--diff <a..b>`                    | Compare two kept runs.                                                                                                               |
| `--no-upload`                      | Keep the run on your machine.                                                                                                        |
| `--no-evidence`                    | Upload the run without the quoted code.                                                                                              |
| `--local`                          | Send nothing to the judge or to Kerno.                                                                                               |
| `--no-judge`                       | Send no code to the judge.                                                                                                           |
| `--data-sharing`                   | Review and change what the audit sends.                                                                                              |
| `-y`, `--yes`                      | Accept every default and never prompt.                                                                                               |
| `-v`, `--verbose`                  | Show diagnostic logs.                                                                                                                |

`--local` wins over every other sharing option, then `--no-upload`, then `--no-evidence`.
