bun

Incredibly fast JavaScript runtime, bundler, test runner, and package manager

$ anc audit bun --json

workhorse Zig oven-sh/bun
MUST 19 / 28SHOULD 13 / 215 failing14 warningsaudited 2026-06-01 · anc 0.5.0
65pass rate
2/8principles met

Audience signal: mixed

This tool sends mixed signals: some agent-readable affordances are present, others are not. Treat the warnings below as friction points, not defects.

This is an informational signal, not an authoritative verdict — see methodology. The per-audit evidence below is the ground truth.

Eight principles, scored

Behavioral and source checks. Every non-pass row carries a copy-paste remediation prompt.

  1. P1
    Non-Interactive by Default

    no rich-TUI affordance detected (no `--tui`/`--interactive`/`--ui` flag, no spinner/progress/tui mention in --help). MAY-tier — rich TUI in TTY contexts is a nice-to-have, not required.

    Remediation · P1
    Make bun satisfy P1 (Non-Interactive by Default) from the agent-native CLI standard. Address:
    - Rich-TUI affordance for TTY contexts (no rich-TUI affordance detected (no `--tui`/`--interactive`/`--ui` flag, no spinner/progress/tui mention in --help). MAY-tier — rich TUI in TTY contexts is a nice-to-have, not required.)
    Requirements: https://anc.dev/p1
    warn
  2. P2
    Structured, Parseable Output

    --output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs) · CLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.

    Remediation · P2
    Make bun satisfy P2 (Structured, Parseable Output) from the agent-native CLI standard. Address:
    - Structured output support (--output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs))
    - Structured-output CLI exposes its schema at runtime (CLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.)
    - --json / --jsonl short aliases for --output (no --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.)
    - `--raw` flag for pipe-safe unformatted output (no `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.)
    - Bad invocation exits with structured usage-error code (2) (binary silently accepted invalid flag (exit 0). Bad invocation must signal usage error via a non-zero exit code.)
    Requirements: https://anc.dev/p2
    fail
  3. P3
    Progressive Help Discovery

    no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text. · subcommands missing example invocations in their `--help`: lint. Examples teach agents the call shape faster than option tables; use clap's `after_help` or a dedicated `Examples:` block.

    Remediation · P3
    Make bun satisfy P3 (Progressive Help Discovery) from the agent-native CLI standard. Address:
    - `examples` subcommand or `--examples` flag for curated usage patterns (no `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.)
    - Each subcommand's `--help` ships at least one invocation example (subcommands missing example invocations in their `--help`: lint. Examples teach agents the call shape faster than option tables; use clap's `after_help` or a dedicated `Examples:` block.)
    - Help text pairs human and `--output json` example invocations (no paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.)
    Requirements: https://anc.dev/p3
    fail
  4. P4
    Fail-Fast, Actionable Errors

    binary silently accepted invalid flag (exit 0) · stderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.

    Remediation · P4
    Make bun satisfy P4 (Fail-Fast, Actionable Errors) from the agent-native CLI standard. Address:
    - Rejects invalid arguments (binary silently accepted invalid flag (exit 0))
    - Error messages include a hint or remediation phrase (stderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.)
    Requirements: https://anc.dev/p4
    fail
  5. P5pass
  6. P6
    Composable, Predictable Command Structure

    pager referenced in --help but no --no-pager escape hatch advertised · 3/6 subcommand(s) follow standard verb names. Non-standard: lint, x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.

    Remediation · P6
    Make bun satisfy P6 (Composable, Predictable Command Structure) from the agent-native CLI standard. Address:
    - Pager-using CLI ships --no-pager escape hatch (pager referenced in --help but no --no-pager escape hatch advertised)
    - Subcommand verbs follow community-standard names (3/6 subcommand(s) follow standard verb names. Non-standard: lint, x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.)
    - `--color` flag for explicit color control (no `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.)
    - Input-accepting commands read from stdin when no file is given (input-accepting subcommand present but `--help` does not mention stdin or `-` as a path placeholder. SHOULD-tier — agents piping data into the tool expect stdin to work when no file arg is provided.)
    - Operations are subcommands, not verb-shaped flags (top-level verb-shaped flag(s) found: --install. Operations belong under the `Commands:` block (`tool search "q"`), not on the flag namespace where they fight the `--help` filtering agents rely on.)
    Requirements: https://anc.dev/p6
    warn
  7. P7
    Bounded, High-Signal Responses

    no --quiet/-q flag detected in --help output · long-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.

    Remediation · P7
    Make bun satisfy P7 (Bounded, High-Signal Responses) from the agent-native CLI standard. Address:
    - Quiet mode available (no --quiet/-q flag detected in --help output)
    - `--timeout` flag for long-running operations (long-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.)
    - Help text advertises TTY-aware verbosity behavior (no TTY-aware language found in `--help`. MAY-tier — automatic verbosity reduction when stdout is piped or redirected lets agents skip the explicit `--quiet` flag. Behavioral probes cannot simulate a real TTY without a pty crate, so this audit relies on documented intent.)
    Requirements: https://anc.dev/p7
    warn
  8. P8pass

All Audits

P1: Non-Interactive by Default

PASSNon-interactive by default
SKIPNon-interactive gate flag advertised in --helptarget satisfies P1 via alternative gate (help-on-bare or stdin-primary)
PASSFlags advertise env-var bindings in --help
PASSSecret-bearing flags expose stdin or *-file companion
PASS`--help` advertises default values for flags
WARNRich-TUI affordance for TTY contextsno rich-TUI affordance detected (no `--tui`/`--interactive`/`--ui` flag, no spinner/progress/tui mention in --help). MAY-tier — rich TUI in TTY contexts is a nice-to-have, not required.

P2: Structured, Parseable Output

WARNStructured output support--output/--format flag detected but could not validate JSON via safe probes (--help/--version override output flags in most CLIs)
FAILStructured-output CLI exposes its schema at runtimeCLI emits structured output but exposes no `schema` subcommand or `--schema` flag at top level or nested one level deep. Agents need a runtime-discoverable schema to pin against shape changes.
WARN--json / --jsonl short aliases for --outputno --json or --jsonl short alias found. Agents and pipelines benefit from short forms alongside the canonical `--output` enum.
WARN`--raw` flag for pipe-safe unformatted outputno `--raw` flag advertised. MAY-tier — useful for pipelines that want to strip formatting before piping to other tools.
SKIP`--output` advertises additional formats beyond text/jsonno `--output` or `--format` flag advertised; vacuous skip for MAY-tier extra formats.
FAILBad invocation exits with structured usage-error code (2)binary silently accepted invalid flag (exit 0). Bad invocation must signal usage error via a non-zero exit code.
SKIPErrors emit JSON envelope with `error`/`kind`/`message` under `--output json`binary does not advertise `--output json` in --help; MUST applies only to CLIs that opt into the JSON contract.
SKIPJSON success and error envelopes share their non-payload key setbinary does not advertise `--output json` in --help; envelope-consistency only applies to CLIs that opt into the JSON contract.

P3: Progressive Help Discovery

PASSHelp flag produces useful output
PASSVersion flag works (`--version` plus short alias)
PASSVersion flag works (`--version` plus short alias)
WARN`examples` subcommand or `--examples` flag for curated usage patternsno `examples` subcommand or `--examples` flag found. MAY-tier — a curated usage block keeps agents from hunting through long help text.
PASSShort `-h` summary differs from `--help` long form
FAILEach subcommand's `--help` ships at least one invocation examplesubcommands missing example invocations in their `--help`: lint. Examples teach agents the call shape faster than option tables; use clap's `after_help` or a dedicated `Examples:` block.
WARNHelp text pairs human and `--output json` example invocationsno paired text + `--output json` example found within 5 lines in top-level or any subcommand `--help`. Pairing keeps agents from reverse-engineering the JSON invocation from the text one.

P4: Fail-Fast, Actionable Errors

FAILRejects invalid argumentsbinary silently accepted invalid flag (exit 0)
FAILError messages include a hint or remediation phrasestderr was empty on bad invocation. Argument parsers must explain why the input was rejected — silent failure forces the agent to guess.
SKIP`--output json` produces JSON-formatted errorsbinary does not advertise `--output json` in --help; SHOULD applies only to CLIs that opt into the JSON contract.

P5: Safe Retries & Mutation Boundaries

SKIPDestructive subcommands require `--force` or `--yes`no destructive subcommands detected; MUST applies conditionally to CLIs with destructive operations.
SKIPRead and write surfaces are both visible in subcommand listno recognizable read or write subcommand verbs; the read/write distinction is unobservable from the help surface alone.

P6: Composable, Predictable Command Structure

PASSHandles SIGPIPE gracefully
WARNPager-using CLI ships --no-pager escape hatchpager referenced in --help but no --no-pager escape hatch advertised
PASSRespects NO_COLOR
WARNSubcommand verbs follow community-standard names3/6 subcommand(s) follow standard verb names. Non-standard: lint, x, repl. MAY-tier — community-standard verbs (get/list/create/update/delete) help agents predict subcommand behavior across CLIs.
WARN`--color` flag for explicit color controlno `--color` flag advertised. MAY-tier — `auto|always|never` lets agents and pipelines override the TTY-based default.
WARNInput-accepting commands read from stdin when no file is giveninput-accepting subcommand present but `--help` does not mention stdin or `-` as a path placeholder. SHOULD-tier — agents piping data into the tool expect stdin to work when no file arg is provided.
PASSSubcommand naming follows a consistent verb/noun convention
WARNOperations are subcommands, not verb-shaped flagstop-level verb-shaped flag(s) found: --install. Operations belong under the `Commands:` block (`tool search "q"`), not on the flag namespace where they fight the `--help` filtering agents rely on.

P7: Bounded, High-Signal Responses

WARNQuiet mode availableno --quiet/-q flag detected in --help output
PASS`--verbose` flag for diagnostic escalation
SKIP`--limit` / `--max-results` flag for list operationsno list-style subcommand detected (list/ls/search/query/find/show/get); vacuous skip for the list-only SHOULD.
SKIPCursor-based pagination flags for list traversalno list-style subcommand detected; vacuous skip for the list-only MAY.
WARN`--timeout` flag for long-running operationslong-running subcommand present but no timeout flag advertised (looked for --timeout, --deadline, --max-time). SHOULD-tier — without a bound, agents that hit a hung operation have to enforce timeouts externally.
WARNHelp text advertises TTY-aware verbosity behaviorno TTY-aware language found in `--help`. MAY-tier — automatic verbosity reduction when stdout is piped or redirected lets agents skip the explicit `--quiet` flag. Behavioral probes cannot simulate a real TTY without a pty crate, so this audit relies on documented intent.

P8: Discoverable Through Agent Skill Bundles

PASSSkill bundle has install path (`tool skill install [<host>]`)
PASS`skill install --all` for multi-runtime install
PASS`skill update` / `skill upgrade` for bundle refresh

Details

Version scored
1.3.14
Audit date
2026-06-01 17:35:29 UTC
Duration
339ms
Platform
linux/x86_64
Mode
command
Anc build
0.5.0
Install
brew install bun

Embed the badge

The badge floor is 70%; this scorecard is at 65% (5 points below). Once the score clears the floor, the embed snippet will appear here. The top issues above are the place to start.

Reproduce this scorecard for bun locally and inspect the failing audits:

anc audit --command bun --output json

Install anc first if you don't have it. Add --output json to get the same JSON shape committed under scorecards/.