MetaGuard

Repo metadata hygiene scanner for Python packages. Catches the boring, shippable-but-broken mistakes that slip past pytest and build:

• Version drift — pyproject.toml version vs src/<pkg>/__init__.__version__ vs the latest git tag. Mismatches are flagged as errors.
• Stale CHANGELOG — top entry doesn't match the declared version.
• Missing PEP 621 fields — description, authors, license, requires-python, readme…
• License declared, file missing — [project].license but no LICENSE at root.
• Committed secret files — .env, *.pem, *.key, credentials*, .pypirc, *.tfstate… (respects .gitignore so intentional secrets don't false-positive).
• Dead README links — optional network probe (--check-links).

Install

pip install kryptorious-metaguard

Usage

# Scan current dir
metaguard check

# Scan a path, emit JSON for CI
metaguard check ./my-package --json

# Also probe README URLs
metaguard check . --check-links

Exit code is 1 if any error-severity issue is found (CI gate), 0 otherwise.

Example output

Metadata Health: 75/100
  Checks run: 6
  Errors: 1   Warnings: 1

ERROR  VERSION_DRIFT   pyproject='1.2.3' but init:demo='9.9.9'
                     /repo
WARN   NO_CHANGELOG   No CHANGELOG file found

CI integration

- name: Metadata hygiene
  run: metaguard check . --check-links

Part of the Kryptorious developer toolkit. Built for the 32-package fleet and shipped so you can use it too.