Supercov

Coverage, security and code quality for coding agents

Measure code quality with npx supercov.

Star on GitHub

How Supercov works

Supercov measures coverage, reviews code quality and security with Jev, and gives coding agents actionable gaps in JavaScript and seven other languages.

Read more
CodexClaude CodeCursorGemini CLIGitHub Copilot
CodexClaude CodeCursorGemini CLIGitHub Copilot
Improve coverage, security and code quality•••

Working

Supercov gives the agent the next thing to fix.

Each run returns the quality score, security findings and the uncovered paths. The agent fixes, refactors or adds focused tests, reruns the suite, and continues while useful work remains.

Quality

TypeSafe AIJev
4.7/10Weak

25 files assessed

6 good10 fair9 weak

src/lib/modernHttp.ts3.4/10Long methodComplex conditional
src/gateways/stdioToStatefulStreamableHttp.ts3.7/10Long methodDuplicated logic
src/gateways/stdioToStatelessStreamableHttp.ts3.7/10Long methodComplex conditional
Read more

Code quality, scored by Jev.

Weakest files and concerns, ranked for refactoring.

Coverage agents can act on.

File-by-file coverage, uncovered paths, and assertion gaps—so your agent knows what to test next.

Reports for your
software factory.

Coverage, assertions, code quality and security from a real run. Open any file to see which tests reach each line and what they assert.

Open full report

npx supercov report

codex/sse-session-isolationf35babcNo local changes24 Sept 2026, 18:18

Coverage

100%covered by tests

Assertions

93%linked to assertions

✓ 581 tests passed13 skipped23 source files8m 51s

FileCoverageAssertions ↑

Quality

4.7/10Weak

25 files assessed · 6 good · 10 fair · 9 weak

Security

5 files flagged25 files assessed

One portable HTML file.

The report packs its evidence into a page that needs no server or install. Attach it to a pull request and anyone can open it.

Assertion coverage

75%linked to assertions3 of 4 measured statements

In the recorded TypeScript example, three of four measured statements were linked to assertions before the fix. The total calculation ran in the passing test, but order.total had no assertion. The agent adds assert.equal(order.total, 50). A wrong total then fails the test.

Read more

Find missing assertions without mutation testing.

Recorded execution reveals the checks a passing test missed.

Security

TypeSafe AIJev
5 files flagged

25 files assessed

Destination from input3 files
Sensitive data exposure3 files
Missing authorization1 file

A file can trigger more than one check.

src/lib/headers.ts:85Confirmed at a line
logger.error(`Invalid header format: ${header}, ignoring`)

Sensitive data exposure CWE-532

Read more

Security signals from Jev.

See the checks, files and source lines that need review.

Supported bySupercorp

3.4kGitHub stars↗

npm downloads

200k+weekly downloads

Supported by Supercorp.

Backed by Supercorp’s open-source track record.

  • RSpec
  • Minitest
  • Jest
  • Mocha
  • Vitest
  • Vitest Browser Mode
  • pytest
  • Playwright
  • node:test
  • AVA
  • cargo test
  • cargo-nextest
  • unittest
  • Cucumber
  • test-unit
  • rustdoc
  • go test
  • JUnit 5
  • TestNG
  • Kotest
  • Spock

Supported test suites.

Playwright, Vitest, Jest, Cargo, pytest, RSpec, go test, JUnit, and more.

Use leftover tokens on coverage.

Before a reset—or overnight—turn idle agent time into coverage that stays with the repository.

For software factories.

Every pass returns fresh, executable evidence, so agents can keep iterating around the clock while regressions are caught before they ship.

Low overhead.

Fast instrumentation keeps the test loop moving.

Any language.

JavaScript, TypeScript, Rust, Python, Ruby, Go, Java, and Kotlin—with more to come.

Any agent.

Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot—and more.

View on GitHub

Free and open source.

MIT licensed. Inspect, extend, and run it anywhere.

How Supercov compares.

JavaScript & TypeScript

Coverage features for JavaScript & TypeScript
FeatureSupercovVitestnyc / Istanbulc8
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Vitest uses its standard V8 or Istanbul coverage provider here. Supercov works with your existing test runner.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Python

Coverage features for Python
FeatureSupercovcoverage.pySlipCover
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov measures CPython 3.9 and newer. pytest-cov uses coverage.py; enable test contexts for per-test coverage.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Ruby

Coverage features for Ruby
FeatureSupercovSimpleCov
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov supports MRI Ruby: full MC/DC on 3.4+, limited measurement on 3.3. SimpleCov 1.3 requires Ruby 3.3+.
  • SimpleCov’s per-test coverage requires track_tests. Neither tool promises exact per-test coverage for overlapping threaded tests.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Rust

Coverage features for Rust
FeatureSupercovcargo-llvm-covTarpaulin
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov requires Rust 1.95 and supported Cargo runners. cargo-llvm-cov’s branch and MC/DC flags require nightly. Tarpaulin’s branch option is not implemented.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Go

Coverage features for Go
FeatureSupercovgo test -cover
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov requires Go 1.22 or newer and runs your own `go test` command against an instrumented copy of the module.
  • The Go toolchain counts statements per run. A test that calls t.Parallel() shares one counter array with the tests beside it, so Supercov counts that coverage run-wide rather than naming a test for it.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Java

Coverage features for Java
FeatureSupercovJaCoCoOpenClover
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov requires JDK 17 or newer with Maven or Gradle, and measures JUnit 5, JUnit 4 through Vintage, TestNG, Kotest and Spock per test, instrumenting an isolated copy rather than your build file. If tests still run concurrently it says so and drops condition coverage instead of guessing.
  • JaCoCo counts branches from bytecode and reports per run, not per test. OpenClover records per-test coverage from source instrumentation; neither computes MC/DC.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Kotlin

Coverage features for Kotlin
FeatureSupercovKoverJaCoCo
Code quality scoringTypeSafe AIJev
Security reviewTypeSafe AIJev
Line coverage
Branch coverage
MC/DC
Per-test coverage
Assertion coverage
Reports
Sources and notes September 25, 2026
  • Supercov measures Kotlin through the same JVM path as Java, taking test identity from the framework’s own lifecycle, so Kotest and Spock tests keep the names they report. A condition that also narrows a type carries no MC/DC obligation, and the run names every such case.
  • Kover measures with its own coverage library by default and can switch to JaCoCo. Both report line and branch coverage per run; neither computes MC/DC or per-test coverage.
  • Per-test coverage means individual tests, not test files. Supercov needs a supported runner; concurrency can limit attribution.
  • Assertion coverage links source to passing assertions through an agent-reviewed map. It is not a mutation score or proof of correctness.
  • Code quality scoring means a per-file score of the source itself, from named property checks answered by Jev. The tools compared here report coverage; linters and dedicated quality platforms are outside this table.
  • Security review means named security checks per file, also answered by Jev. Findings are patterns to review, not a security score or proof of exploitability; dedicated security scanners are outside this table.
  • Reports means a browsable HTML report from the tool itself. Supercov’s is one self-contained file that also carries assertions, quality and security; the other tools’ reports cover coverage.

Built-in coverage reports, unless noted. Read the comparisons