CLICLIA command you run, rather than a dependency you import.See every one →What this type is →independently maintainedindependently maintainedPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →
@satiroglu/kaev
A command line that runs rule-based checks over a SAPUI5 or OpenUI5 project, reporting each finding with a rule id, a category, a severity, a confidence and the file it sits in.
KAEV is a command line run inside a UI5 project directory: it identifies the project context first, modelling application, component, library, theme-library and module projects, and runs only the checks that apply, over a catalogue covering project and configuration, UI5 API use, OData with architecture and performance, and security. It also runs the official @ui5/linter@ui5/linterSAP's static analysis tool for UI5 projects: it scans JavaScript, TypeScript, XML, JSON and other files for deprecated APIs, global variables and possible CSP violations, and fixes part of them with --fix.sap official, ui5 in a restricted child process, which its rule reference limits to applicable application roots with a manifest; a manifest-less legacy project stays analysable by KAEV's own rules, and --no-ui5-lint skips the adapter where partial coverage is intentional. Every finding states what it rests on: Official for directly documented UI5 guidance, Derived for a static interpretation of documented behaviour, Heuristic for a KAEV risk pattern that needs project context, and the README states that fully dynamic URL construction and arbitrary cross-function data flow are not resolved. A run writes terminal, Markdown, JSON, SARIF, JUnit or GitHub Actions output; check and doctor are read-only, report, init and baseline create only the files asked for, and the documentation states the analysis is local and offline, with no telemetry and no source-code upload. Its own documentation places it beside UI5 CLI, UI5 Linter, TypeScript, ESLint, SAP Fiori tools, runtime testing and professional security review, and says it does not replace them.
Facts
Latestv0.3.0ReleasedLast pushLicenceSEE LICENSE IN LICENSE
Where it sits
Lives in
Provides
LintingUI5LintingCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.Frontend performanceUI5Frontend performanceFinding why a browser UI is slow to start or to respond, and what to change: how many requests it sends and whether they block each other, how large its bundles are, and which OData round trips it waits on. Distinct from [query profiling](capability:query-profiling), which starts at the service and the database rather than at the browser's network log.
Requires
@ui5/linter@ui5/linterBundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as UI5LINT/<original-rule-id> rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and --no-ui5-lint skips it for partial coverage.
Who is behind it
aesatirogluaesatirogluMaintains this
In the atlas: maintains 1, contributes to 1@satiroglumaintainer
In the atlas: maintains 1, contributes to 1@satiroglumaintainer
Before choosing this
Conditions
PracticalFunctional boundary
Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.
What it declares
Every artifact
- Type
- CLI
- Origin
- Independently maintained
- Runtime
- Node.js
As a CLI
- Distributed through
- npm
Connections
Group by
NodeRelationBasis
Functional
Frontend performanceFrontend performanceFinding why a browser UI is slow to start or respondSAP and community, unassessed
provides
stated
provides Frontend performance
Reports, by static rule rather than by measurement, the patterns in a project's own code that make a UI5 application slow to start or to respond: a synchronous jQuery, XHR or legacy OData read call, an OData model refreshed inside a loop, a literal setSizeLimit above 10,000, a local .filter() or .sort() over a traced OData collection, and an EventBus subscription or interval left without cleanup in onExit. Every row carries its basis and its boundary, so the refresh-in-a-loop and size-limit rules are marked heuristic, and the size-limit one states that it does not itself prove that all data is fetched.
“Check synchronous requests, lifecycle cleanup, refresh placement, V2/V4 collection operations, and model size limits.”“A proven OData model is refreshed inside a syntactic loop.”“A proven OData model receives a literal setSizeLimit above 10,000. This does not itself prove that all data is fetched.”
Finding why a browser UI is slow to start or respond
LintingLintingCatching problems in code, models and configuration by rulesSAP and community, narrow by design
provides
stated
provides Linting
Brings a rule catalogue of its own to a UI5 project, covering project and configuration, UI5 API use, OData with architecture and performance, and security, and runs the official UI5 linter alongside it, each finding carrying a category, a severity, a confidence and a file location.
“Reports stable rule IDs, severity, confidence, file locations, evidence, and recommendations.”“Rule basis is Official for directly documented UI5 guidance, Derived for a static interpretation of documented behavior, and Heuristic for a KAEV risk pattern requiring project context.”“One command checks the areas most likely to turn into UI5 maintenance, security, or production problems.”
Catching problems in code, models and configuration by rules
Technical
@ui5/linter@ui5/linterStatic analysis tool for UI5 projectssap official, ui5
needs
stated
needs @ui5/linter
Bundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as `UI5LINT/<original-rule-id>` rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and `--no-ui5-lint` skips it for partial coverage.
“Integrates the official `@ui5/linter` in a restricted child process.”“Individual IDs are emitted as `UI5LINT/<original-rule-id>`, classified as modernization, and scored conservatively.”“"@ui5/linter": "1.23.7"”
Static analysis tool for UI5 projects
Download
Install
npx @satiroglu/kaev@latestMinimal example
npm install --save-dev @satiroglu/kaev
npx kaev checkCopied from KAEV documentation — Installation, read . Not run by the atlas.
Architecture
Download
@satiroglu/kaevA command line that runs rule-based checks over a SAPUI5 or OpenUI5 project, reporting each finding with a rule id, a category, a severity, a confidence and the file it sits in.independent, ui5
@ui5/linterSAP's static analysis tool for UI5 projects: it scans JavaScript, TypeScript, XML, JSON and other files for deprecated APIs, global variables and possible CSP violations, and fixes part of them with --fix.sap official, ui5
Your terminal → @satiroglu/kaevStated in the document, dataBy its type: a CLI is run from a terminal
@satiroglu/kaev → @ui5/linterDocumented onlyBundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as
UI5LINT/<original-rule-id> rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and --no-ui5-lint skips it for partial coverage.SAPnot SAP's, or the project's ownstated in the documentdocumented only
README
quoted from satiroglu/kaev, readsatiroglu/kaev/README.mdthe maintainer’s wordsOn GitHub
Kaev
Production-oriented health, security, performance, and architecture analysis for SAPUI5, OpenUI5, and SAP Fiori projects.
Kaev identifies the project context first, runs only applicable checks, and turns each finding into a source location, severity, confidence level, evidence basis, and actionable recommendation.
Website · Documentation · Changelog
Local by design: Kaev analyzes source code on your machine. It has no telemetry and does not upload project files.
KAEV v0.3.0
sales-app · sapui5 application
UI5 1.120.21 · CLI spec 3.0 · freestyle · javascript · OData v2
Checks
Configuration
✓ PASS Manifest readability · KAEV-CONFIG-001
✓ PASS UI5 configuration availability · KAEV-CONFIG-002
Security
✓ PASS Frontend credential exposure · KAEV-SEC-001
✗ ISSUE Sensitive browser storage · KAEV-SEC-002 · 1 finding(s)
HIGH · HIGH confidence · webapp/util/Auth.js:41:5
Project Health 88/100 · Security Posture 88/100
1 findings · 19 evaluated · 0 not applicable · 0 skipped · 0 unavailable
Checks: 18 passed · 1 with findings
Severity: 1 high
Top priorities
KAEV-SEC-002 · Sensitive browser storage
History
Others providing
LintingLintingCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.SAP and community, narrow by design
- @cbs-consulting/cds-eslint@cbs-consulting/cds-eslintAn ESLint plugin for CDS files carrying one consultancy's own rules, published so that the consultancy's projects lint their CDS models the same way.independent, capESLint plugin with one consultancy's rules for CDS filesfrom CAP
- @cbs-consulting/tools@cbs-consulting/toolsShared ESLint configuration for SAPUI5 and CAP projects, the config rather than the rules, so a team adopts a house style by adding one dependency.independent, capShared ESLint configuration for SAPUI5 and CAP projectsfrom CAP
- ui5plugin-linterui5plugin-linterA command-line linter for UI5 projects, run as ui5linter, that checks JavaScript and TypeScript classes, XML views and fragments, and i18n properties files.independent, ui5Command-line linter for UI5 classes, XML views and i18n filesfrom UI5
- ui5pluginui5pluginThe SAPUI5 Extension for Visual Studio Code: completion, definitions, CodeLens, diagnostics, code actions, hover and an XML formatter for UI5 views, controllers and manifest.json.independent, ui5SAPUI5 extension for Visual Studio Codefrom UI5
- eslint-plugin-better-cap-configeslint-plugin-better-cap-configA set of ESLint rules that read CAP configuration and flag the cds settings that have since been deprecated, putting that check in the linter a project already runs, with no dependencies of its own.independent, capESLint rules flagging deprecated CAP configurationfrom CAP
- hana-linterhana-linterA command line that checks the names of the native SAP HANA artifact files in a CAP project, and the identifiers inside them, against regex rules the project keeps in a config file.independent, capRegex naming rules for SAP HANA artifacts in a CAP projectfrom CAP
- @sap/eslint-plugin-cds@sap/eslint-plugin-cdsSAP's ESLint plugin for CDS, carrying the model and environment rules capire calls best practice and universal for every CAP project.sap official, capSAP's ESLint plugin for CDSfrom CAP
- @sap-ux/eslint-plugin-fiori-tools@sap-ux/eslint-plugin-fiori-toolsESLint rules from the Fiori tools team, aimed at the parts of a project their generators produce.sap official, capESLint rules for projects the Fiori tools generators producefrom CAP
- vscode-ui5-language-assistantvscode-ui5-language-assistantSAP's VS Code extension for SAPUI5 and OpenUI5: completion, validation, hover tooltips, go to definition, quick fix and formatting for XML views, and completion and validation for manifest.json.sap official, ui5VS Code extension for SAPUI5 and OpenUI5 XML views and manifestfrom UI5
- @ui5/linter@ui5/linterSAP's static analysis tool for UI5 projects: it scans JavaScript, TypeScript, XML, JSON and other files for deprecated APIs, global variables and possible CSP violations, and fixes part of them with --fix.sap official, ui5Static analysis tool for UI5 projectsfrom UI5
Details
Sources
Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.
Compatibility and provenance
runtimesnode
latestv0.3.0
first release
releases and cadence4, ~2d median
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainui5, developer-experience
History in the atlas
- The repository the npm record declares is now reachable. It returned 404 on 2026-09-30, 2026-10-01 and 2026-10-02; today it answers, as a public repository created on 2026-09-16 and last pushed on 2026-09-30, not a fork, carrying `src`, `tests`, `scripts`, `docs`, the README and the LICENSE file, with GitHub reading the licence as NOASSERTION. `source_available` moves to true with it: `src/index.ts` and the directories under it are the TypeScript the tool is built from, so there is source to read. The licence has not changed and grants no rights to use it — the README states "Public npm publication makes package contents downloadable and inspectable; a proprietary license restricts legal rights but does not technically hide those contents." — which is why `identity.license` stays "Proprietary" and `when_not_to_use` stands as written.
- The one key the `cli` type owns (TYPE_PROPERTIES in vocab.json), stated from the README's CI/CD section, "npm install --save-dev @satiroglu/kaev", and the installation page, which gives the same command for a project-level install beside `npx @satiroglu/kaev@latest` and a global install. The installation page's "Package installation requires registry access. Project analysis itself runs offline." is the second sentence it rests on: the registry is how the command arrives and the only thing it needs the network for.
- The dependency the entry could not point at before. [@ui5/linter](artifact:ui5-linter) is pinned at 1.23.7 in the npm record's dependencies and the README states "Integrates the official `@ui5/linter` in a restricted child process", so the edge is the maker's own statement; the `for` sentence carries the conditions the rule reference puts on the adapter rather than on the dependency, which ships with every install. Written now because the artifact exists to point at: it was not in the graph when this entry was drafted, and the prose link in `what_it_solves` moves from the repository address to the entry with it.
- the adapter is limited to applicable application roots with a manifest, and a manifest-less legacy project stays analysable by KAEV's own rules
- Stated rather than left absent. The licence page says "KAEV is proprietary software. No open-source license is granted.", and the repository the npm record declares, git+https://github.com/satiroglu/kaev.git, returned 404 on 2026-09-30, on 2026-10-01 and again today, so there is no source to read and the entry now says so instead of staying silent. The same page's "Public npm publication makes packaged files downloadable and inspectable. A proprietary license restricts legal rights but does not technically hide package contents." is about the published tarball, whose `bin` is the build output `dist/cli/cli.js`, and not about source anyone may read, so it is recorded here rather than carried as a true value.
- capability:linting, capability:frontend-performance
- the UI5 linter runs in a restricted child process, for application roots
- Handed over as three URLs. Typed `cli` because what is published is a command with a `kaev` bin entry, run in a project directory rather than installed into a UI5 build; `independent` because the site states "Independent developer tool. Not affiliated with or endorsed by SAP." It answers [linting](capability:linting) on the UI5 door, where the graph already reads UI5 linter as the core's answer and KAEV's own documentation names that linter as something it runs alongside its own rules — and it would be the first provider that capability holds on that door, whose coverage was assessed core-only on 2026-09-14 with a note saying the graph holds no UI5 provider. No repo link: the repository field of the npm record points at github.com/satiroglu/kaev, which still returned 404 on 2026-09-30, so the entry is reachable through npm, the site and the documentation. `when_not_to_use` states the proprietary licence and the heuristic disclaimer, both from the maker's own pages; `identity.license` is "Proprietary" because the npm record says "SEE LICENSE IN LICENSE" and the licence page says no open-source licence is granted.
- First seen.
For your agent
- Ref
artifact:satiroglu-kaev- JSON
- /artifacts/satiroglu-kaev.json
- MCP
- Connecting an agent