What to read and check before you change a file.

Coding agents follow imports fine. What they don't know is what your team knows: amounts here are in cents, the mobile app reads this table, run the payment e2e after touching this. readfirst keeps that next to the code and hands it out, file by file, right before someone changes something.

MIT, no dependencies, no account, no model calls. Or let AI write the first map, free once.

how it works

1. One map, in your repo. .readfirst/map.json groups your files and lists, for each group, the checks to run, the traps to know about, and the rules the code must keep. It's reviewed like code.
2. Handed out per file. npx readfirst read <file> prints what applies, plus the tests and callers that reach that file. With npx readfirst hook --install, Claude Code gets it by itself before every edit; for other agents, init --agent adds one line to CLAUDE.md or AGENTS.md.
3. Checked on every pull request. The GitHub Action comments with the rules, risks and checks for the changed files, and fails when the map stops covering the code, so it gets fixed in the same PR.

what the pull request sees

One comment per PR, updated on every push. This is a real one, from readfirst's own repository.

the first map

Writing down what only the team knows is the part nobody gets to. The hosted fill reads the repository and your existing notes (README, CLAUDE.md, docs) and opens the first map as a pull request. Each risk lists the file and line it came from, so you can check it before you merge. From a run on Express:

res.sendFile throws unless the path is absolute or opts.root is given, and dotfiles are denied by default; relaxing this exposes files from user-supplied pathslib/response.js

test/acceptance/ runs the examples through the real app, so editing an example can break npm testtest/acceptance/

.npmrc sets ignore-scripts, a 7-day min-release-age and no lockfile; installs are intentionally unlocked and script-free.npmrc

try it on your repository

1. Install readfirst-app on one repository. It reads the code and opens one pull request from a new branch; it never pushes to your existing branches.
2. Comment /readfirst fill on any issue there. Only owners, members and collaborators can start a run.
3. Review the PR that arrives 5–20 minutes later. Delete what's wrong, keep the rest.

Free once per account, for repositories up to 200 files, while today's free runs last.

pricing