Everything in CAP / Java

It audits through npm: a project that resolves its dependencies with another package manager, or has no `package.json`, has nothing for it to run. What it reports is what `npm audit` knows, so a vulnerability outside the npm advisory data is not in its table.

Not an editor integration. If you want completion, navigation and diagnostics, that is the CDS language server, not this.

There is nothing to run: it is published for a generator or a script to call, not for a developer to invoke in a project, and it declares Node.js 22 or later.

Everything it checks is a name: a file name under `rootDir`, or an identifier a parser extracted from a file, so a convention that cannot be written as a regex over one name has no rule shape here. Content rules targeting `.hdbanalyticalprivilege` or `.hdbconstraint` return no results, which the README states as not yet implemented, so conventions centred on those two artifact types go unchecked.

There is no repository and no README: what the eight commands do is only readable from the compiled dist that ships in the package. Three of them — npmrc, install, project — are written for "SimpleMDG" projects rather than for CAP generally, so the reusable part is bind-local, run-local and debug. Seven releases up to July 2026. Its binding step writes the resolved VCAP_SERVICES into default-env.json in the project, where [@sap/cds-dk](artifact:sap-cds-dk) keeps only the place the credentials can be fetched from, so a project using it needs that file kept out of version control.

It reads TypeScript exports only; a project written in plain JavaScript has no exported functions for it to extract. A call to the function name in a test file counts as tested, and a call through property access such as `.foo(` does not.