Skip to content
← All docsCLI

norma check and norma fix

Install Norma, run a check locally, scope it to a diff, set a threshold, and generate fixes.

Install

npm install -g @norma-sh/norma
export ANTHROPIC_API_KEY=sk-...

norma check

No global install? Run it once with npx @norma-sh/norma check. To use OpenAI instead, set OPENAI_API_KEY and pass --provider openai.

What a run looks like

Norma auto detects your spec (specs/, spec.md, AGENTS.md, CLAUDE.md, or PRD.md), reads your code, and prints a score with the drift located per requirement.

  Spec Fidelity Score  78/100
  4 requirements  2 met  1 partial  0 missing  1 contradicted
  contradictions present, review before shipping

  drift:
  R004  Rate limit is 100 requests per minute  (src/limit.ts)
  R002  Users can reset their password by email (src/users.ts)

Commands

norma check [path]            score a project (defaults to the current dir)
norma check --pr main...HEAD  score only the files changed in a range
norma check --format json     machine readable, for CI
norma check --threshold 85    exit non-zero if the score is below 85
norma check --provider openai use OpenAI instead of Anthropic
norma fix                     explain each finding and write a repair prompt
norma fix --prompt            output only the repair prompts
norma fix --json              the full remediation report as JSON
norma init                    write a norma.config.json
norma report                  re-render the last run

Every run writes norma-report.json, the canonical artifact. See Reports for the schema, and Remediation for how norma fix works.

What the score means

Norma splits your spec into atomic requirements, judges each against the code, and aggregates the verdicts. Requirements are weighted by priority (must, should, may), so dropping a must costs more than a may.

VerdictCounts asMeaning
metfullimplemented and consistent with the spec
partialhalfimplemented incompletely or with caveats
missingzerono implementation found
contradictedzeroimplemented in a way that conflicts with the spec

A contradiction always raises a flag, never just a quiet low score.

Privacy. Norma runs locally. Code is read on your machine and only the slices needed for judging are sent to your configured model provider. Bring your own key. Files matching the secret patterns in the default exclude list (.env files, private keys, and similar) are never indexed or sent.
Did the build keep its promises?

AI can write the code.
Who verifies the intent?