Check what your coding agents ship.
Creator of Interlace: open-source tools that check what coding agents ship. Security lint (495 rules in 31 ESLint plugins), mutation testing and agent-ready CLIs. 1.25M+ npm downloads. Writing for 2.5K+ followers on Dev.to. Leading Snappy's U.S. engineering expansion. IC5/M2±
Referenced in 700+ public repositories on GitHub — see the search (code search, Jul 2026)
interlace.tools — open-source tools that check what your coding agents ship: security lint, mutation testing and agent-ready CLIs. Small, focused, TypeScript-native tools that interlock: same brand, same docs experience, same evidence contract. Independent, MIT-licensed, built in the open. No comparative claim ships without a versioned benchmark you can rerun.
| Site | What it is |
|---|---|
| interlace.tools | The umbrella — what Interlace stands for and what's being built under it |
| eslint.interlace.tools | Is the code safe? Rule reference for all 31 ESLint plugins — searchable, per-rule docs, config presets |
| oxmutate.interlace.tools | Do the tests check anything? Mutation testing that agrees with Stryker on 99.9% of mutants |
| burgee.interlace.tools | Can an agent drive the CLI? One declaration gives help, --json, --schema, MCP and completions |
| serverless.interlace.tools | TypeScript-first Serverless Framework tooling — caching, per-function IAM, config devkit |
| ds.interlace.tools | The design system registry — tokens, components, AA-verified themes, installable via the shadcn CLI |
| storybook.interlace.tools | Every design-system component, live and interactive |
| ofriperetz.dev | My blog — deep dives on ESLint security, benchmarks, and AI-native tooling |
The most-adopted plugins in the ESLint ecosystem (ranked by real npm downloads — evidence over claims):
| Package | Description | Monthly | All-Time |
|---|---|---|---|
eslint-plugin-import-next |
100x faster no-cycle detection, drop-in eslint-plugin-import replacement |  |
 |
eslint-plugin-secure-coding |
89 AI-parseable rules, OWASP Top 10 2021 + Mobile 2024 coverage |  |
 |
eslint-plugin-browser-security |
XSS, postMessage abuse, storage token exposure, CSP |  |
 |
eslint-plugin-node-security |
Node.js built-ins security: command injection, path traversal, unsafe eval |  |
 |
eslint-plugin-vercel-ai-security |
Vercel AI SDK security for generateText, streamText, tools |  |
 |
eslint-plugin-react-a11y |
LLM-optimized rules for WCAG 2.1 compliance in React |  |
 |
…plus more focused plugins — JWT, crypto, PostgreSQL, MongoDB, NestJS, Express, Lambda security, and the code-quality line (maintainability, reliability, modularity, operability, modernization, conventions) — with @interlace/eslint-devkit underneath. Full registry & rule reference: eslint.interlace.tools
One family for building CLIs that people, pipes and AI agents can all drive — every package zero-dependency outside the family, compatibility graded by the incumbents' own test suites:
| Package | Description | Monthly | All-Time |
|---|---|---|---|
burgee |
CLI framework on one declaration — help, --json, --schema, MCP and completions projected from it; drop-in for commander and yargs |
 |
 |
bellpull |
Subprocesses with executable resolution and one structured result; drop-in paths for execa, cross-spawn and which |  |
 |
caique |
Prompts that are flags first — non-TTY callers get an error naming the flag, never a hang; drop-in path for inquirer and clack |  |
 |
closeout |
Exit handlers that run exactly once on every path, with a shutdown deadline; drop-in paths for signal-exit and exit-hook |  |
 |
flagstaff |
Spinners, progress, boxes and tables on one frame loop, with a static projection for pipes and agents |  |
 |
linegauge |
Grapheme-correct width, wrap, truncate and slice for styled terminal text; drop-in paths for string-width and wrap-ansi |  |
 |
paratext |
Hyperlinks, images, window title, clipboard and notifications, each with a static fallback |  |
 |
roundel |
CLI colour: one output policy, semantic tokens and a contrast-checked theme; chalk migration path |  |
 |
seniority |
Flags, env, config files and defaults resolved in one order, with provenance; drop-in paths for cosmiconfig, dotenv and rc |  |
 |
Docs: burgee.interlace.tools · Source: ofri-peretz/burgee
| Package | Description | Monthly | All-Time |
|---|---|---|---|
@interlace/serverless-devkit |
TypeScript-first config toolkit for Serverless Framework |  |
 |
@interlace/serverless-api-gateway-caching |
API Gateway caching — cache clusters, flush commands, cleanup hooks |  |
 |
@interlace/serverless-iam-roles-per-function |
Per-function IAM roles — strict validation, role consolidation, CLI |  |
 |
100 articles on what static analysis actually catches in AI-written code — every claim backed by a rerunnable measurement, never a vibe.
Read them at ofriperetz.dev (the long-form home) or dev.to/ofri-peretz.
Start here:
- My credential rule reported 842 secrets in vercel/ai. The real count was 0. — what a 100% false-positive rate taught me about writing security rules
- The 30-Minute Security Audit: 140 Gemini-Written Functions, 102 Shipped Findings — onboarding a codebase you've never seen
- Claude vs Gemini Across 4 Security Domains: A Dead Heat — and the hardening 63% of AI code skips
- Claude Wrote a NestJS Service. TypeScript Was Happy. ESLint Found 6 Security Holes. — where type safety stops and security starts
- Math.random() Is Not Secure. I Found It Generating API Keys in a 44K-Star Repo. — the oldest bug that still ships
- Blog: ofriperetz.dev
- Interlace: interlace.tools
- GitHub: @ofri-peretz
- LinkedIn: Ofri Peretz
- Dev.to: ofri-peretz
- X: ofri-peretz