A developer rank that
never sees your code.
One command, entirely offline. It reads your repositories and gives you a grade — and your source never leaves the machine, in a way you can verify before you run it.
Eight grades. Pick one to see what it looks like.
$ git clone https://github.com/jaklabs/aura-rank && cd aura-rankPython 3.9+ and git. Nothing else — there are no dependencies, deliberately.
There’s no signal for a developer without a logo behind them.
Stars measure marketing. Years measure patience. LeetCode measures LeetCode. The people who are actually good — running production systems alone, for real businesses, with no famous employer on the résumé — have nothing legible to point at.
And the obvious fix is unacceptable. Nobody is uploading their private codebase to a website for a score. Not their client’s code, not their startup’s, not their own. Any tool that asks is dead on arrival, and deserves to be.
Don’t trust us. Grep the file.
The scanner imports no HTTP client and opens no socket. That isn’t a privacy policy — it’s a property of the source, and you can confirm it in one command before you ever run the thing.
grep -rnE 'requests|urllib|http|socket|aiohttp|httpx|ssl' aurarank/ the only matches are the docstrings telling you to run this command
Numbers, not source
Output is integers and ratios. No source text, no file contents, no absolute paths. Author emails are hashed on read.
Read it first
--print shows the exact payload before you share it with anyone. Nothing is sent by default, or at all.
Network is a separate tool
Anything that touches the internet lives in a different binary. The scanner provably can’t phone home.
One caveat, because a half-true guarantee is worse than none
The scanner does use subprocess — to run git, which is how it reads your commit history. A grep can’t tell “runs git” from “runs anything,” so that one is enforced by a test: test_no_network.py parses every module and fails the build if a subprocess call ever invokes something other than git, if a network library is imported, or if shell=True, eval or exec appear. CI runs it on every push.
Four dimensions from your code. Four it refuses to guess.
A tool claiming to measure whether you can sit with a customer by reading your AST would be nonsense, and every good engineer would spot it in a second. So it doesn’t.
| Dimension | Source | Signal |
|---|---|---|
| Ship | measured | tests, CI, release tags, tenure, project shape |
| Architecture | measured | function length & nesting distributions, typing (: any doesn’t count) |
| Judgment | measured | revisit ratio, exception precision, sustained cadence |
| Transmission | measured | doc ratio, docstring coverage, contributors |
| Embed | refused | whether you can map a messy business isn’t in your AST |
| Fundamentals | refused | a timed exercise, not a repository property |
| Reach | public | dependents and installs — verifiable, not local |
| Renown | public | public record — verifiable, not local |
revisit_ratio
The share of files you touched in more than one calendar month. It separates maintained work from dump-and-run, it’s invisible to anyone optimising for stars, and it can’t be faked without actually doing it. Every vanity metric rewards volume. This one rewards coming back.
Check it against code you already know.
Bands are set against 52 public repositories across Python, JavaScript and TypeScript, then validated rather than percentile-fitted. Clone any of these and run it yourself — you should get the same number.
A typical solo project lands in the 15–45 range. That is not an insult — it is what an untested, un-CI’d, actively used codebase actually looks like, and most working software is exactly that.
Eight bands, each with a plain meaning.
No stars, no belts, no borrowed hierarchy. Every grade says what it actually describes, so a low one is a diagnosis rather than a scolding.
One repo isn’t a developer.
Point it at everything and it builds a profile — weighting each repository by your share of its commits, so a project you sent three patches to isn’t counted as yours.
$ python3 -m aurarank.portfolio ~/code/*/ +--------------------------------------------------------------+ | AURA PORTFOLIO · 22 repos · spec v0.7.0 | +--------------------------------------------------------------+ | DRAWN 39/100 | | from your core 15 repos (60% of your output) | +--------------------------------------------------------------+ | ship ###................. 1.7 | | architecture ###########......... 5.4 | | judgment #########........... 4.6 | | transmission ########............ 3.9 | +--------------------------------------------------------------+ | active 8/9 months · focus 0.069 · spread 15 | +--------------------------------------------------------------+
Not the mean
That punishes exploration — every scratch directory would drag you down, which is backwards. Your rank comes from your core body of work.
Agent commits count
A coding agent writes under your direction, so the work is yours. Dependency bots are excluded entirely — a version bump is nobody’s craft.
focus
How concentrated your effort is across projects. Low means scattered. Most people find this one uncomfortable.
Plotted against people whose code you already use.
Every point below was measured by this tool over that person’s public repositories — not scored by opinion. Clone them and re-run it; you get the same numbers. Your own scan lands you somewhere on this chart.
The cluster top-right is maintainers
Lord, Harris, Sorhus, Christie, Willison — people whose libraries thousands of projects depend on. Rigour near 10 across the board. That is what a decade of other people relying on you forces into a repository.
Bellard and Hashimoto sit left
The highest craft scores on the chart — Hashimoto is the highest at 8.85 — with middling rigour. Extraordinary code, less scaffolding. The chart measures a different thing than brilliance, and this is what that looks like.
Karpathy measures 44 — near the bottom. nanoGPT and micrograd are deliberately minimal teaching artifacts with no tests and no CI, and scoring them low on maintenance discipline is the instrument working correctly, not a verdict on their author. A low number here means “little scaffolding”, never “bad engineer” — and if you take one thing from this chart, take that.
Nine points, not a census. The tool will not print a global percentile, because there is no population of developers to compute one from and inventing one would be the exact dishonesty this project exists to avoid. It tells you where you sit among named, reproducible measurements — and nothing more than that.
What this isn’t.
A ranking system that hides its own uncertainty deserves to be ignored. So:
- Not official, and not claiming to be. No one can declare a standard; that gets earned by adoption or not at all.
- Not verified. The scan runs on your machine and the file is yours, so it’s trivially editable — every output says self-assessed, and always will.
- Not fully calibrated. 52 repositories is a small, elite sample. It anchors the top of the scale credibly and says less about the middle.
- Not a measure of you. It reads repositories. Half of what makes someone good — judgment under ambiguity, working with people, knowing what not to build — leaves no trace in a git history.
- Python, JavaScript and TypeScript only so far. Other languages get Architecture marked unmeasured rather than guessed at.
The scoring spec is a versioned file in the repo. When someone finds a way to game it, they publish it and it gets patched like a CVE. That only works in the open, which is why it’s open.
Sixty seconds, offline, no account.
Clone it, read the scanner if you want to, point it at something you’ve built.
$ git clone https://github.com/jaklabs/aura-rank $ cd aura-rank $ python3 -m aurarank.scan ~/code/your-project # and when you want the whole picture $ python3 -m aurarank.portfolio ~/code/*/