Supercode

The evidence shows explicitly scoped GitHub permissions in the desktop workflow, a temporary signing keychain, disabled command tracing, cleanup of signing material, and clear repository/license attribution. This supports stronger sensitive-data handling and source attribution scores. Deductions apply because these controls primarily cover release automation, while the Agent is said to support file writes, command execution, multiple model providers, and external databases without demonstrated sandboxing, path or command restrictions, per-action confirmation, complete data-flow disclosure, operation rollback, or Agent-specific dependency auditing and vulnerability response. No red-line behavior is evidenced.

The README, root package manifest, and CI are broadly consistent about Bun, Turborepo, major applications, and quality commands. Bun 1.2.21 is pinned, and CI installs from the frozen lockfile before type checking, linting, and testing, providing reasonable dependency-availability evidence. Deductions apply because some documented script names do not appear in the supplied root manifest, including db:migrate and db:terminal:migrate; database generation is allowed to fail before tests; and beyond a claimed graceful Prisma skip when DATABASE_URL is absent, no concrete failure messages are shown for Agent tools, providers, or network errors.

The material clearly targets software developers and names code generation, debugging, explanation, documentation, and multilingual scenarios. It describes local dashboard, CLI, terminal client, multiple model providers, and the Bun, Docker, PostgreSQL, and environment requirements. Deductions apply because the Agent's permission boundaries, supported and unsupported tasks, tool-trigger rules, confirmation conditions, and provider differences are undefined. There is no static evidence for trigger precision, and environment fit is documented mainly for local development.

The README thoroughly organizes architecture, directories, applications, packages, scripts, and environment setup. The complete MIT text matches the license metadata, justifying full marks for information architecture and licensing. Installation guidance and examples are useful, but CLI-specific environment setup is deferred to an unavailable subdirectory and no FAQ is supplied. Supercode, Supercli, and super-platform coexist as names, while a desktop application present in the workflow is absent from the documented tree. Only limited status information is given; there is no comprehensive limitations section, changelog, or clear Agent maintenance and release-responsibility path.

The combination of a coding Agent, dashboard, terminal client, provider flexibility, and shared tools offers plausible marginal value over a basic single-purpose CLI, and the README supplies actionable launch commands. Deductions apply because no representative Agent outputs, completed interactions, quality measurements, or recovery experience are shown, so output usability is only thinly supported. Operation may also require model APIs, databases, Docker, Pinecone, or other services, while the only cost discussion concerns model training rather than routine Agent usage and benefit tradeoffs.

Core product, runtime, and script claims can often be checked across the README, package.json, and CI. A pinned runtime, frozen-lockfile CI, and concrete workflow steps improve traceability. Deductions apply because the supplied evidence omits the Agent's tool implementations, configuration, tests, lockfile, and CLI-specific documentation. Claims about sponsorship, publication, capabilities, and graceful installation behavior lack corresponding implementation evidence, and roadmap goals, current capabilities, and promotional language are not consistently separated.