Deterministic code transformation for React, Next.js, and TypeScript projects
The only tool that actually FIXES your code — deterministic, rule-based transformations (NOT AI) that automatically resolve 50+ code issues across 8 progressive layers.
A critical Remote Code Execution vulnerability (CVSS 10.0) has been discovered in React Server Components affecting all React 19 apps.
# Preview changes (recommended first)
npx @neurolint/cli security:cve-2025-55182 . --dry-run
# Apply the fix
npx @neurolint/cli security:cve-2025-55182 . --fix
# Install patched dependencies
npm installAffected: React 19.0.0-19.2.0, Next.js 15.x-16.x with App Router, React Router RSC, Vite RSC, Waku, and more.
NOT Affected: React 18 and earlier, SPAs without React Server Components, Next.js Pages Router.
Patched versions: React 19.0.1, 19.1.2, 19.2.1 | Next.js 15.0.5+, 15.1.9+, 15.2.6+, 15.3.6+, 15.4.8+, 15.5.7+, 16.0.7+, 16.1.0+, 16.2.1+
Read the full security advisory →
Modern React and Next.js development suffers from repetitive, time-consuming code quality issues:
- Hydration errors —
window is not defined, localStorage accessed during SSR - Missing accessibility — Images without alt text, buttons without aria-labels
- Framework migrations — React 19 and Next.js 16 breaking changes require manual fixes
- Outdated configurations — TypeScript and Next.js configs causing build failures
- Inconsistent patterns — Teams waste hours in code review on style issues
- Dependency conflicts — Package version incompatibilities block upgrades
The cost: Hours of manual fixes, delayed releases, production bugs, and developer frustration.
NeuroLint uses deterministic, rule-based transformations — NOT artificial intelligence.
- AST Parsing — Understands code structure through Abstract Syntax Trees
- Pattern Recognition — Identifies anti-patterns using predefined rules
- Repeatable Results — Same input always produces same output
- No Hallucinations — No LLM guessing or unpredictable rewrites
- Auditable — Every transformation is documented and traceable
No AI black box. Just intelligent, rule-based code fixes.
NeuroLint's critical differentiator is its 5-step fail-safe orchestration system that prevents corrupted code from ever reaching production:
Attempts precise code transformation using Abstract Syntax Tree parsing for deep structural understanding of your code.
Immediately validates the AST transformation to ensure the code remains syntactically correct and maintains semantic integrity.
If AST parsing fails or Step 2 validation fails, falls back to regex-based transformation as a safety net.
Re-validates the regex transformation with the same strict checks. No shortcuts — every transformation path must pass validation.
Changes are only applied if they pass validation. If validation fails at any step, the transformation is automatically reverted to the last known good state.
┌──────────────────────────────────────────────────────────────┐
│ Original Code (Last Known Good State) │
│ ↓ │
│ Step 1: Try AST Transformation │
│ ↓ │
│ Step 2: Validate AST Result ✓/✗ │
│ ├─ Valid ✓ → Step 5: Accept changes │
│ └─ Invalid ✗ → Step 3: Try Regex Fallback │
│ ↓ │
│ Step 4: Validate Regex Result ✓/✗ │
│ ├─ Valid ✓ → Step 5: Accept changes │
│ └─ Invalid ✗ → REVERT (no changes applied) │
└──────────────────────────────────────────────────────────────┘
Why This Matters:
- AI tools: Generate code → Hope it works → Debug when it breaks → Waste developer time
- NeuroLint: Transform → Validate → Fallback if needed → Re-validate → Accept only if valid
This is why NeuroLint never breaks your code — unlike AI tools that can hallucinate invalid syntax, NeuroLint's orchestration pattern guarantees every change is validated twice before acceptance.
npm install -g @neurolint/cli# Analyze your project
neurolint analyze . --verbose
# Preview fixes (safe, no changes)
neurolint fix . --all-layers --dry-run --verbose
# Apply fixes
neurolint fix . --all-layers --verboseBefore:
function Button({ children, onClick }) {
return <button onClick={onClick}>{children}</button>;
}After:
'use client';
interface ButtonProps {
children: React.ReactNode;
onClick?: () => void;
}
function Button({ children, onClick }: ButtonProps) {
return (
<button
onClick={onClick}
aria-label={typeof children === 'string' ? children : undefined}
type="button"
>
{children}
</button>
);
}
export default Button;Fixed automatically: TypeScript types, 'use client' directive, aria-label, button type, exports
Each layer builds on the previous, ensuring safe and comprehensive transformations:
- Configuration Modernization — Updates tsconfig.json, next.config.js, package.json to modern standards
- Pattern Standardization — Removes HTML entity corruption, console.log, unused imports
- Accessibility & Components — Adds React keys, WCAG 2.1 AA compliance, proper attributes
- SSR/Hydration Safety — Protects against hydration errors with client-side API guards
- Next.js App Router — Optimizes 'use client', Server Components, import structure
- Testing & Error Handling — Generates error boundaries, scaffolds test files
- Adaptive Learning — Production-grade pattern learning with 70%+ confidence scoring and 41 unit tests
- Security Forensics — Post-exploitation detection, compromise scanning, incident response
See detailed layer documentation in CLI_USAGE.md
NeuroLint automates framework migrations with zero breaking changes:
neurolint migrate-react19 . --dry-run --verbose
neurolint migrate-react19 . --verboseHandles forwardRef removal, string refs, ReactDOM.render → createRoot, and more.
neurolint migrate-nextjs-16 . --dry-run --verbose
neurolint migrate-nextjs-16 . --verboseAutomates middleware → proxy rename, async params, caching APIs, PPR migration.
neurolint check-deps . --fixDetects React 19 incompatibilities, auto-generates .npmrc, adds package.json overrides.
See complete migration guides in CLI_USAGE.md
neurolint check-turbopack .Analyzes Webpack configurations and recommends Turbopack migration path.
neurolint check-compiler .Detects manual memoization patterns and recommends React Compiler adoption.
neurolint assess-router . --verboseScores project complexity (0-100) and recommends optimal setup (React vs Next.js).
neurolint detect-react192 .Identifies opportunities for View Transitions, useEffectEvent, Activity components.
See analysis tool documentation in CLI_USAGE.md
neurolint analyze [path] # Scan for issues
neurolint fix [path] # Apply automatic fixes
neurolint validate [path] # Validate without changes
neurolint layers # List transformation layers
neurolint stats [path] # Project statisticsneurolint migrate-react19 [path] # React 19 migration
neurolint migrate-nextjs-16 [path] # Next.js 16 migration
neurolint migrate-biome [path] # Biome migration
neurolint simplify [path] # Reduce project complexityneurolint check-deps [path] # React 19 dependency checker
neurolint check-turbopack [path] # Turbopack readiness
neurolint check-compiler [path] # React Compiler opportunities
neurolint assess-router [path] # Router complexity
neurolint detect-react192 [path] # React 19.2 featuresneurolint backup # Manage backups
neurolint rules # Custom rule management
neurolint restore # Restore from backupFlags:
--verbose— Detailed output--dry-run— Preview changes without applying--backup— Create backup before modifications--layers=1,2,3— Apply specific layers--all-layers— Apply all 8 layers--fix— Auto-fix issues (for check commands)
See complete command reference in CLI_USAGE.md
Scenario: Meeting WCAG 2.1 AA standards for enterprise application
neurolint fix src/ --layers=3 --verboseResult: 150+ accessibility issues fixed automatically, audit-ready codebase
Scenario: Migrating production app from React 18 to React 19
neurolint check-deps . --fix
neurolint migrate-react19 . --verboseResult: All breaking changes handled automatically, smooth upgrade
Scenario: Adopting Next.js 16 caching model and middleware changes
neurolint migrate-nextjs-16 . --verboseResult: Middleware renamed, PPR migrated, async APIs updated, zero manual work
See more use cases in CLI_USAGE.md
neurolint fix src/ --layers=2,3 --dry-run || exit 1neurolint analyze src/ --format=json --output=analysis.json
neurolint fix src/ --all-layersneurolint rules --export=team-rules.json
neurolint rules --import=team-rules.jsonSee integration examples in CLI_USAGE.md
- Complete Usage Guide — Comprehensive command reference and workflows
- Layer 8 Security Forensics — Security forensics specification and IoC detection
- Changelog — Version history and release notes
- Contributing — Contribution guidelines
- Code of Conduct — Community standards
- License — Apache License 2.0
ESLint identifies problems. NeuroLint fixes them. Auto-fixes accessibility, hydration errors, and framework migrations that ESLint cannot handle.
AI tools hallucinate and produce unpredictable results. NeuroLint uses deterministic AST transformations — same input always produces same output. Auditable, repeatable, enterprise-ready.
Manual fixes are slow, error-prone, and expensive. NeuroLint processes hundreds of files in seconds with zero breaking changes.
- Issues: github.com/Alcatecablee/Neurolint/issues
- Discussions: github.com/Alcatecablee/Neurolint/discussions
- Email: [email protected]
Apache License 2.0
All code in this repository is free and open-source under Apache 2.0:
| Component | Description |
|---|---|
CLI (cli.js, src/, scripts/) |
Command-line tool and transformation engine |
VS Code Extension (vscode-extension/) |
Editor integration |
Core Engine (shared-core/) |
Shared transformation utilities |
Landing Page (landing/) |
Project website |
- Free forever — No fees, no restrictions
- Commercial use allowed — Use in your company or enterprise
- Modify and distribute — Fork, customize, and share as needed
- Patent protection — Includes explicit patent grant
The NeuroLint SaaS (hosted dashboard, team features) is a separate commercial product maintained in a private repository.
We welcome contributions from the community. Please read our Contributing Guide to get started.
NeuroLint — Deterministic code fixing. No AI. No surprises.