onedevatlasBeta
Browse the atlas
AllUI5CAPABAPBTP
CLICLItypeA command you run, rather than a dependency you import.See every one →What this type is →independently maintainedindependently maintainedoriginPublished by one person or a small company outside SAP. Says nothing about quality; the readings say that.See every one →

@satiroglu/kaev

A command line that runs rule-based checks over a SAPUI5 or OpenUI5 project, reporting each finding with a rule id, a category, a severity, a confidence and the file it sits in.

KAEV is a command line run inside a UI5 project directory: it identifies the project context first, modelling application, component, library, theme-library and module projects, and runs only the checks that apply, over a catalogue covering project and configuration, UI5 API use, OData with architecture and performance, and security. It also runs the official @ui5/linter in a restricted child process, which its rule reference limits to applicable application roots with a manifest; a manifest-less legacy project stays analysable by KAEV's own rules, and --no-ui5-lint skips the adapter where partial coverage is intentional. Every finding states what it rests on: Official for directly documented UI5 guidance, Derived for a static interpretation of documented behaviour, Heuristic for a KAEV risk pattern that needs project context, and the README states that fully dynamic URL construction and arbitrary cross-function data flow are not resolved. A run writes terminal, Markdown, JSON, SARIF, JUnit or GitHub Actions output; check and doctor are read-only, report, init and baseline create only the files asked for, and the documentation states the analysis is local and offline, with no telemetry and no source-code upload. Its own documentation places it beside UI5 CLI, UI5 Linter, TypeScript, ESLint, SAP Fiori tools, runtime testing and professional security review, and says it does not replace them.

GitHub0 ★
npm7/wk
Homepage
Docs
Changelog

Facts

Latestv0.3.0ReleasedLast pushLicenceSEE LICENSE IN LICENSE

Where it sits

Lives in
UI5
Provides
LintingUI5LintingcapabilityCatching in the editor what would otherwise be caught at deploy time, or not at all — problems in source code and models and in the project's configuration, found by rules rather than by review.Frontend performanceUI5Frontend performancecapabilityFinding why a browser UI is slow to start or to respond, and what to change: how many requests it sends and whether they block each other, how large its bundles are, and which OData round trips it waits on. Distinct from [query profiling](capability:query-profiling), which starts at the service and the database rather than at the browser's network log.
Requires
@ui5/linter@ui5/linterartifactBundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as UI5LINT/<original-rule-id> rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and --no-ui5-lint skips it for partial coverage.

Who is behind it

aesatirogluaesatirogluPersonMaintains this
In the atlas: maintains 1, contributes to 1@satiroglumaintainer

Before choosing this

Conditions

PracticalFunctional boundary

Not in a project whose dependencies must all carry an open-source licence: KAEV is proprietary software, its licence page states that downloading or viewing the npm package does not by itself grant permission to use, copy, modify, redistribute, sublicense, sell, host or create derivative works, and the LICENSE file shipped with the package carries the controlling terms. Not as the last word on whether a UI5 application is secure: its rule reference states that a heuristic finding is not proof of a vulnerability, and its documentation puts professional security review beside it rather than under it.

What it declares

Every artifact

Type
CLI
Origin
Independently maintained
Runtime
Node.js

As a CLI

Distributed through
npm

Connections3

Download
@satiroglu/kaev connections@satiroglu/kaevPROVIDES→ provides2provides stated Reports, by static rule rather than by measurement, the patterns in a project's own code that make a UI5 application slow to start or to respond: a synchronous jQuery, XHR or legacy OData read call, an OData model refreshed inside a loop, a literal setSizeLimit above 10,000, a local .filter() or .sort() over a traced OData collection, and an EventBus subscription or interval left without cleanup in onExit. Every row carries its basis and its boundary, so the refresh-in-a-loop and size-limit rules are marked heuristic, and the size-limit one states that it does not itself prove that all data is fetched. KAEV — Performance & OData: https://kaev.org/ KAEV documentation — Rules, OData, architecture, and performance: https://docs.kaev.org/reference/rules/ KAEV documentation — Rules, OData, architecture, and performance: https://docs.kaev.org/reference/rules/Frontend performanceprovides stated Brings a rule catalogue of its own to a UI5 project, covering project and configuration, UI5 API use, OData with architecture and performance, and security, and runs the official UI5 linter alongside it, each finding carrying a category, a severity, a confidence and a file location. KAEV documentation: https://docs.kaev.org/ KAEV documentation — Rules: https://docs.kaev.org/reference/rules/ KAEV — What KAEV Checks: https://kaev.org/LintingNEEDS→ needs1needs stated Bundled and run through its Node API in a restricted child process, so KAEV's own report carries the official linter's findings as `UI5LINT/<original-rule-id>` rows classified as modernization. The adapter runs only for applicable application roots with a manifest, and `--no-ui5-lint` skips it for partial coverage. satiroglu/kaev — README, Why Kaev?: https://github.com/satiroglu/kaev KAEV documentation — Rules, Official UI5 Linter: https://docs.kaev.org/reference/rules/ npm registry — @satiroglu/kaev 0.3.0, dependencies: https://registry.npmjs.org/@satiroglu/kaev@ui5/linter

Install

npx @satiroglu/kaev@latest
Minimal example
npm install --save-dev @satiroglu/kaev
npx kaev check

Copied from KAEV documentation — Installation, read . Not run by the atlas.

Architecture

Download
Where @satiroglu/kaev runsBy its type: a CLI is run from a terminalcallsdocumentedrequiresYour terminal, actorYour terminal@satiroglu/kaev, module@satiroglu/kaev@ui5/linter, module@ui5/linter
SAPnot SAP's, or the project's ownstated in the documentdocumented only

README

quoted from satiroglu/kaev, read
satiroglu/kaev/README.mdOn GitHub

Kaev

Production-oriented health, security, performance, and architecture analysis for SAPUI5, OpenUI5, and SAP Fiori projects.

Kaev identifies the project context first, runs only applicable checks, and turns each finding into a source location, severity, confidence level, evidence basis, and actionable recommendation.

Website · Documentation · Changelog

Local by design: Kaev analyzes source code on your machine. It has no telemetry and does not upload project files.

KAEV v0.3.0

sales-app · sapui5 application
UI5 1.120.21 · CLI spec 3.0 · freestyle · javascript · OData v2

Checks

Configuration
  ✓ PASS  Manifest readability · KAEV-CONFIG-001
  ✓ PASS  UI5 configuration availability · KAEV-CONFIG-002

Security
  ✓ PASS  Frontend credential exposure · KAEV-SEC-001
  ✗ ISSUE  Sensitive browser storage · KAEV-SEC-002 · 1 finding(s)
      HIGH · HIGH confidence · webapp/util/Auth.js:41:5

Project Health 88/100 · Security Posture 88/100
1 findings · 19 evaluated · 0 not applicable · 0 skipped · 0 unavailable
Checks: 18 passed · 1 with findings
Severity: 1 high

Top priorities
  KAEV-SEC-002 · Sensitive browser storage
excerpt, SEE LICENSE IN LICENSE, read the rest, on GitHub

History

Latest

v0.3.0

  1. v0.2.1

  2. v0.2.0

  3. v0.1.0

On npm
7downloads per week, npm
Weekly downloads for @satiroglu/kaev26 complete calendar weeks from 2026-04-20 to 2026-10-18; the latest total is 7.20 Apr – 26 Apr: 027 Apr – 3 May: 04 May – 10 May: 011 May – 17 May: 018 May – 24 May: 025 May – 31 May: 01 Jun – 7 Jun: 08 Jun – 14 Jun: 015 Jun – 21 Jun: 022 Jun – 28 Jun: 029 Jun – 5 Jul: 06 Jul – 12 Jul: 013 Jul – 19 Jul: 020 Jul – 26 Jul: 027 Jul – 2 Aug: 03 Aug – 9 Aug: 010 Aug – 16 Aug: 017 Aug – 23 Aug: 024 Aug – 30 Aug: 031 Aug – 6 Sept: 07 Sept – 13 Sept: 014 Sept – 20 Sept: 021 Sept – 27 Sept: 16528 Sept – 4 Oct: 5375 Oct – 11 Oct: 1612 Oct – 18 Oct: 7

Others providing4

Linting
  1. ui5plugin-linterCommand-line linter for UI5 classes, XML views and i18n files
  2. ui5pluginSAPUI5 extension for Visual Studio Code
  3. vscode-ui5-language-assistantVS Code extension for SAPUI5 and OpenUI5 XML views and manifest
  4. @ui5/linterStatic analysis tool for UI5 projects

Details

Sources4
Added by handdiscovered herechecked
npm registry, @satiroglu/kaevversion, releases, installschecked
github.com/git+https://github.com/satiroglu/kaev.gittree, pushes, contributors, CIchecked
README.mdquoted, and what the entry declareschecked

Sources are graph entities: the same page may back several entries, and an unreachable source flags every row that rests on it.

Compatibility and provenance
runtimesnode
latestv0.3.0
first release
releases and cadence4, ~2d median
discovered viaAdded by hand
first seen in the atlas
ecosystem and domainui5, developer-experience
History in the atlas9
  1. The repository the npm record declares is now reachable. It returned 404 on 2026-09-30, 2026-10-01 and 2026-10-02; today it answers, as a public repository created on 2026-09-16 and last pushed on 2026-09-30, not a fork, carrying `src`, `tests`, `scripts`, `docs`, the README and the LICENSE file, with GitHub reading the licence as NOASSERTION. `source_available` moves to true with it: `src/index.ts` and the directories under it are the TypeScript the tool is built from, so there is source to read. The licence has not changed and grants no rights to use it — the README states "Public npm publication makes package contents downloadable and inspectable; a proprietary license restricts legal rights but does not technically hide those contents." — which is why `identity.license` stays "Proprietary" and `when_not_to_use` stands as written.
  2. The one key the `cli` type owns (TYPE_PROPERTIES in vocab.json), stated from the README's CI/CD section, "npm install --save-dev @satiroglu/kaev", and the installation page, which gives the same command for a project-level install beside `npx @satiroglu/kaev@latest` and a global install. The installation page's "Package installation requires registry access. Project analysis itself runs offline." is the second sentence it rests on: the registry is how the command arrives and the only thing it needs the network for.
  3. The dependency the entry could not point at before. [@ui5/linter](artifact:ui5-linter) is pinned at 1.23.7 in the npm record's dependencies and the README states "Integrates the official `@ui5/linter` in a restricted child process", so the edge is the maker's own statement; the `for` sentence carries the conditions the rule reference puts on the adapter rather than on the dependency, which ships with every install. Written now because the artifact exists to point at: it was not in the graph when this entry was drafted, and the prose link in `what_it_solves` moves from the repository address to the entry with it.
  4. the adapter is limited to applicable application roots with a manifest, and a manifest-less legacy project stays analysable by KAEV's own rules
  5. Stated rather than left absent. The licence page says "KAEV is proprietary software. No open-source license is granted.", and the repository the npm record declares, git+https://github.com/satiroglu/kaev.git, returned 404 on 2026-09-30, on 2026-10-01 and again today, so there is no source to read and the entry now says so instead of staying silent. The same page's "Public npm publication makes packaged files downloadable and inspectable. A proprietary license restricts legal rights but does not technically hide package contents." is about the published tarball, whose `bin` is the build output `dist/cli/cli.js`, and not about source anyone may read, so it is recorded here rather than carried as a true value.
  6. capability:linting, capability:frontend-performance
  7. the UI5 linter runs in a restricted child process, for application roots
  8. Handed over as three URLs. Typed `cli` because what is published is a command with a `kaev` bin entry, run in a project directory rather than installed into a UI5 build; `independent` because the site states "Independent developer tool. Not affiliated with or endorsed by SAP." It answers [linting](capability:linting) on the UI5 door, where the graph already reads UI5 linter as the core's answer and KAEV's own documentation names that linter as something it runs alongside its own rules — and it would be the first provider that capability holds on that door, whose coverage was assessed core-only on 2026-09-14 with a note saying the graph holds no UI5 provider. No repo link: the repository field of the npm record points at github.com/satiroglu/kaev, which still returned 404 on 2026-09-30, so the entry is reachable through npm, the site and the documentation. `when_not_to_use` states the proprietary licence and the heuristic disclaimer, both from the maker's own pages; `identity.license` is "Proprietary" because the npm record says "SEE LICENSE IN LICENSE" and the licence page says no open-source licence is granted.
  9. First seen.
For your agent
Ref
artifact:satiroglu-kaev
JSON
/artifacts/satiroglu-kaev.json
MCP
Connecting an agent