{"id":"a32d6c34-627b-4c71-8fa0-1000503b1b7f","slug":"kernlang-kern","kind":"mcp","name":"kern","summary":"MCP review engine with 182 + rules (taint tracking, OWASP LLM01, concept model) + universal IR compiler: .kern compiles to 13 targets including Next.js, Vue, Express, and FastAPI. AGPL-3.0.","owner":"KERNlang","repoUrl":"https://github.com/KERNlang/kern","license":"AGPL-3.0","licenseTier":"strong-copyleft","trust":"community","stars":9,"match":null,"fewStars":false,"format":"mcp","createdAt":"2026-03-17T07:31:17.000Z","addedAt":"2026-10-21T17:00:08.178Z","logoUrl":"https://avatars.githubusercontent.com/u/268833587?v=4","linkOnly":false,"collection":null,"skillPath":null,"categories":["developer-tools"],"tags":["claude","claude-code","codex","ollama","qwen"],"runtime":"binary","local":true,"cloudCapable":false,"cloudCapability":"unknown","cloudReadyOnPlatform":false,"needsApiKey":false,"reviewed":false,"syncedAt":"2026-10-25T19:32:09.634Z","sample":false,"url":"https://conduits.dev/tools/kernlang-kern","language":"TypeScript","transports":["stdio"],"install":{},"requirements":{"env":[],"upstreamMayCharge":false},"tools":null,"readme":"<div align=\"center\">\n  <br>\n  <img src=\"assets/banner.svg\" alt=\"KERN — The LLM Programming Language\" width=\"100%\">\n  <br><br>\n\n  [![npm](https://img.shields.io/npm/v/@kernlang/cli?color=cb3837&label=npm)](https://www.npmjs.com/package/@kernlang/cli)\n  [![CI](https://img.shields.io/github/actions/workflow/status/KERNlang/kern/ci.yml?branch=main&label=CI)](https://github.com/KERNlang/kern/actions/workflows/ci.yml)\n  [![GitHub release](https://img.shields.io/github/v/release/KERNlang/kern?label=release)](https://github.com/KERNlang/kern/releases)\n  [![license](https://img.shields.io/github/license/KERNlang/kern)](LICENSE)\n\n  <br>\n\n  **One backend spec. Real TypeScript and Python output.** 242 review rules.<br>\n  <sub>A .kern spec is ~70% fewer tokens than the TypeScript it generates — ~81% fewer than maintaining both backends (measured, GPT-class tokenizer, example corpus).</sub>\n\n  <br>\n\n  [**kernlang.dev**](https://kernlang.dev) &nbsp;&bull;&nbsp; [MCP](https://kernlang.dev/mcp) &nbsp;&bull;&nbsp; [Review](https://kernlang.dev/review) &nbsp;&bull;&nbsp; [Playground](https://kernlang.dev/playground) &nbsp;&bull;&nbsp; [Docs](https://kernlang.dev/docs) &nbsp;&bull;&nbsp; [For LLMs](https://kernlang.dev/llm)\n\n  <br>\n</div>\n\n---\n\n## Install\n\n```bash\nnpm install -g @kernlang/cli\n```\n\n```bash\nkern compile api.kern --target=express                        # Generate an Express backend\nkern compile api.kern --target=fastapi                        # Generate a FastAPI backend\nkern check                                                    # Nominal type checker (zero false positives)\nkern review src/ --recursive                                  # Static analysis (242 rules, taint tracking)\nkern context src/ --stdout                                    # Whole-project context map for an LLM/agent\nkern rag eval examples/rag-starter/eval-ci.kern --json         # CI-safe RAG retrieval contract eval\nkern init --template=fullstack my-app                          # Scaffold fullstack app (Next.js + Express + MCP)\nkern init --mcp                                               # Scaffold an MCP server with security guards\nkern import src/ --outdir=kern/                               # TypeScript → .kern\nkern schema --json                                            # Full schema for LLM consumption\n```\n\n---\n\n## What is KERN?\n\n**KERN is a backend structure and portable route-logic language** — and as of v4, a typed core language: classes with inheritance, enums, closures, and a built-in nominal type checker, all compiling to both TypeScript and Python with parity proven by differential conformance fixtures (every fixture executes on both runtimes and must produce identical results).\n\nDefine routes, schemas, handlers, API shape, validation, and small portable logic once, then emit real TypeScript/Express and Python/FastAPI code. Keep complex business logic in TypeScript or Python; move shared structure and parity-safe operations into KERN.\n\nKERN also includes four supporting capabilities: **Review**, **Infer**, **MCP Security**, and **Evolve**. You can skip `.kern` entirely and run `kern review` against existing TypeScript and Python for security bugs, unguarded effects, flaky tests, and prompt injection — 242 AST-based rules that catch what ESLint misses.\n\n### Backend Parity First\n\nKERN should own the repeatable parts of backend work:\n\n- route declarations and HTTP shape\n- request and response schemas\n- validation and status responses\n- small portable route logic\n- generated Express and FastAPI structure that stays aligned\n\nHost-language code should still own application-specific business logic, data access, and framework-specific integration. The goal is not to hide TypeScript or Python; it is to stop rewriting the same route/schema/controller structure twice.\n\n### Compile Target Status\n\n| Tier | Targets | Status |\n|:-----|:--------|:-------|\n| **Primary backend parity path** | Express, FastAPI | Maintained path for TypeScript/Python backend structure and portable route logic |\n| **Supported product/runtime targets** | MCP, CLI, Ink, Next.js, Web (React), Tailwind | Useful targets with schemas, deterministic output, and examples |\n| **Additional adapters** | Vue, Nuxt, React Native, Terminal | Available adapters; verify fit before making them your main production path |\n\nTiers are tracked per compile target, not per npm package. For example, `@kernlang/terminal` contains two separate targets: `--target=terminal` (pure ANSI/Node.js output) and `--target=ink` (React + Ink TSX output).\n\nFor detailed examples, interactive demos, and the full rule reference, visit **[kernlang.dev](https://kernlang.dev)**.\n\n---\n\n## The Language (v4)\n\nv4 turns KERN's portable layer into a typed core language. One source, two real runtimes, identical behavior:\n\n```kern\nenum name=Status values=\"Pending|Active|Done\"\n\nclass name=Shape abstract=true export=true\n  method name=area returns=number\nclass name=Square extends=Shape export=true\n  field name=side type=number value={{ 3 }}\n  method name=area returns=number\n    handler\n      return value=\"this.side * this.side\"\n\nfn name=measure returns=number\n  param name=shape type=Shape\n  handler\n    return value=\"shape.area()\"\n```\n\n- **Classes** — single inheritance, abstract classes, fields, getters, static members. Override variance is Liskov-checked by `kern check`.\n- **Enums** — TypeScript gets a native `enum`; Python gets a plain namespace class with identical member values (including TS auto-increment semantics). Operations the two targets *can't* represent identically — reverse indexing `Status[0]`, `Object.keys(Status)` iteration — are rejected at compile time for **both** targets, so neither side can silently diverge.\n- **Closures** — including captured-variable mutation, lowered correctly on both targets.\n- **Type checking** — `kern check` verifies class hierarchies, call-site arity and argument types, and declared returns. Zero false positives by design: it only reports violations it can prove.\n\nThe parity guarantee is enforced, not promised: every language construct ships with differential conformance fixtures that execute the generated TypeScript *and* the generated Python and require identical results — and anything outside the provable subset fails closed with an explicit error instead of guessing.\n\n---\n\n## Quick Example\n\n**8 lines of .kern:**\n\n```kern\nmachine name=Order\n  state name=pending\n  state name=confirmed\n  state name=shipped\n  state name=delivered\n  transition name=confirm from=pending to=confirmed\n  transition name=ship from=confirmed to=shipped\n  transition name=deliver from=shipped to=delivered\n```\n\n**Compiles to 40 lines** of typed TypeScript — a state union type, guarded transition functions, and a dedicated error class.\n\n---\n\n## 5-Minute Quickstart\n\nBuild a fullstack Todo app (Next.js + Express + MCP) from scratch:\n\n```bash\n# 1. Install\nnpm install -g @kernlang/cli\n\n# 2. Scaffold\nkern init --template=fullstack my-todo-app\ncd my-todo-app\n\n# 3. Compile everything\nkern compile models.kern                           # shared types\nkern compile api.kern --target=express              # backend API\nkern compile frontend.kern --target=nextjs          # Next.js frontend\nkern compile mcp-server.kern --target=mcp           # AI agent tools\n\n# 4. Run\ncd generated/api && npx tsx server.ts               # API on :3001\n```\n\nAvailable templates: `fullstack`, `nextjs`, `express`, `file-tools`, `api-gateway`, `database-tools`\n\nSee [`examples/starter/fullstack/`](examples/starter/fullstack/) for the generated files.\n\n---\n\n## kern check\n\nThe KERN nominal type checker — deterministic, zero false positives by design (it only fires on violations it can prove; anything ambiguous is skipped, never guessed).\n\n```bash\nkern check                              # Check every .kern file under cwd\nkern check src/                         # Check a directory\nkern check api.kern                     # Check one file\nkern check --json                       # Stable machine output (schemaVersion 1.0) for CI/bots\nkern check --with-semantics             # Also run semantic validation\n```\n\nWhat it checks: class declarations and override variance, call-site arity and argument types, and declared returns — annotate a function with `returns=<Class>` and the checker verifies every literal `return value=\"new <Class>(...)\"` against it:\n\n```kern\nclass name=Dog\nclass name=Cat\nfn name=mk returns=Dog\n  handler lang=kern\n    return value=\"new Cat()\"   # kern check: check-return-type error\n```\n\nExit codes: `0` clean, `1` findings, `2` operational failure — drop it straight into CI before `kern review`.\n\n---\n\n## kern rag\n\nKERN RAG declarations are consumed by the runner for local retrieval, persistent\nindex snapshots, and CI contract evals. Emitted targets do not generate\ntarget-native retrieval adapters yet.\n\n```bash\nkern rag retrieve examples/rag-starter/local-only.kern --param \"question=refund policy\" --json\nkern rag index examples/rag-starter/eval-ci.kern --status --json\nkern rag eval examples/rag-starter/eval-ci.kern --json\n```\n\nStart with [`examples/rag-starter/`](examples/rag-starter/), then read\n[`docs/rag.md`](docs/rag.md) and\n[`docs/rag-troubleshooting.md`](docs/rag-troubleshooting.md).\n\n---\n\n## kern review\n\nStatic analysis with taint tracking, concept-level checks, and OWASP LLM01 coverage. No AI needed.\n\n```bash\nkern review src/ --recursive            # Full scan\nkern review src/ --enforce --min-coverage=80  # CI gate\nkern review --diff origin/main          # Only changed files\nkern review src/ --lint                 # KERN + ESLint + tsc unified\nkern review src/ --llm                  # AI review (see below)\n```\n\n**242 rules** across base, security, framework, performance, test-quality, null-safety, dead-logic, concept, and taint-aware analysis layers.\n\nRecent coverage includes broadly reusable Next.js, React, Storybook, and Playwright checks: App Router body parsing, cache and header hazards, client-boundary env exposure, cookie hardening, SWR invalidation drift, browser storage parsing, client-side redirect sinks, wildcard `postMessage`, legacy React lifecycles, effect cleanup mistakes, timer cleanup drift, stale `.length`/`.size` hook deps, props-array mutation in render, focused tests, fixed Playwright sleeps, brittle `networkidle` waits, non-deterministic stories, and unmocked Storybook network calls.\n\n### AI-Assisted Review (`--llm`)\n\n`--llm` translates your code to KERN IR — a compressed semantic representation that strips framework sugar and gives raw meaning. Two modes:\n\n**Inside an AI CLI** (Claude Code, Codex, Cursor) — no env vars needed:\n```bash\nkern review src/ --llm    # Outputs KERN IR + findings + taint for the AI to review\n```\n\n**CI/CD pipeline** — set both env vars to call an LLM API directly:\n```bash\nKERN_LLM_API_KEY=sk-... KERN_LLM_MODEL=gpt-4o kern review src/ --llm\n```\n\nNo hardcoded model — you choose via `KERN_LLM_MODEL`. Files are batched by token size, not count.\n\nFull rule reference: **[kernlang.dev/review](https://kernlang.dev/review)**\n\n### MCP Server Security\n\nScan MCP servers for vulnerabilities. 12 rules mapped to the [OWASP MCP Top 10](https://owasp.org/www-project-mcp-top-10/). Plus live server inspection and tool pinning.\n\n```bash\nnpx kern-mcp-security ./src/server.ts\n```\n\nAvailable as: **[VS Code Extension](https://github.com/KERNlang/kern-sight-mcp)** | **CLI** (`npx kern-mcp-security`) | **GitHub Action** (see CI/CD below)\n\n### MCP Server\n\nKERN ships its own MCP server. AI agents can compile, review, inspect, and self-correct `.kern` files via the Model Context Protocol.\n\n```bash\nnpx @kernlang/mcp-server                   # Start locally (stdio)\n```\n\nOr use the **hosted endpoint** — no install required:\n```\nhttps://kernlang.dev/api/mcp               # Streamable HTTP — point any MCP client here\n```\n\n**Claude Desktop** — add to `claude_desktop_config.json`:\n```json\n{\n  \"mcpServers\": {\n    \"kern\": { \"command\": \"npx\", \"args\": [\"@kernlang/mcp-server\"] }\n  }\n}\n```\n\n**Claude Code:**\n```bash\nclaude mcp add kern -- npx @kernlang/mcp-server\n```\n\n**16 tools** including `compile`, `compile-json`, `compile-and-review`, `review`, `review-kern`, `review-mcp-server`, `inspect-mcp-servers`, `verify-tool-pins`, `audit-mcp-config`, `generate-security-tests`, `parse`, `decompile`, `validate`, `list-targets`, `list-nodes`, `schema`\n**3 resources:** `kern://spec`, `kern://targets`, `kern://examples/{category}`\n**1 prompt:** `write-kern` (system prompt with full language spec)\n\nSelf-correction loop: `schema` → write `.kern` → `compile-json` → fix from diagnostics → done. Zero human intervention.\n\nFull setup guide: **[kernlang.dev/mcp](https://kernlang.dev/mcp)**\n\n### Build MCP Servers from .kern\n\n30 lines of .kern generates a production MCP server with auto-injected security guards:\n\n```bash\nkern init --mcp                                   # Scaffold with templates\nkern compile server.kern --target=mcp --watch      # Compile + hot reload\n```\n\nTemplates: `file-tools`, `api-gateway`, `database-tools`\n\n---\n\n## kern context\n\nGive an LLM or agent **instant whole-project context** — not just for review. `kern context` walks your project's import graph and call graph and emits a compact, token-budgeted map of how the codebase fits together: which symbols exist, **who calls/uses each one** (cross-file blast radius), imports, and taint flows.\n\n```bash\nkern context src/                       # write kern-context.json (full artifact)\nkern context src/ --stdout              # print the JSON to stdout\nkern context src/ --spine --stdout      # compact <kern-map> spine, ready to drop in a prompt\nkern context src/ --spine --spine-budget 3000   # cap the spine at ~3000 tokens\nkern context src/ --max-depth=2         # limit import-graph depth\n```\n\nTwo forms: the full **`kern-context.json`** artifact (default), and — with `--spine` — the compact **`<kern-map>`** spine, the same prompt-ready form `kern review --llm` injects per batch. Feed the spine to a coding agent and it starts the task already knowing the project's structure — \"`validateSession` → used by 6 files\" — instead of cold-reading every file to map dependencies. `--spine-budget` fits it to a token budget, degrading gracefully on large projects. It's **deterministic and cacheable**: regenerate after each change and the context stays fresh.\n\nPaths are relative by default (`--absolute` for absolute, `--base=<dir>` to rebase). Analyzes TypeScript sources (`.ts`, `.tsx`, `.mts`, `.cts`); for a `.kern` project, point it at the compiled TypeScript output.\n\n---\n\n## CI/CD\n\n### KERN Review — GitHub Action\n\nDrop this into `.github/workflows/kern-review.yml` to run `kern review` on every push and PR:\n\n```yaml\nname: KERN Review\n\non:\n  push:\n    branches: [main, dev]\n  pull_request:\n    branches: [main]\n\njobs:\n  review:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v6\n\n      - uses: actions/setup-node@v6\n        with:\n          node-version: '22'\n\n      - name: Activate pnpm\n        run: |\n          corepack enable\n          corepack prepare pnpm@10.32.1 --activate\n          pnpm --version\n\n      - run: pnpm install --frozen-lockfile --ignore-scripts\n      - run: pnpm build\n\n      - name: KERN Review\n        run: npx @kernlang/cli review src/ --recursive\n\n      # Optional: enforce minimum coverage\n      # - name: KERN Review (enforced)\n      #   run: npx @kernlang/cli review src/ --recursive --enforce --min-coverage=80\n\n      # Optional: LLM-assisted review (set secrets in repo settings)\n      # - name: KERN Review (AI)\n      #   run: npx @kernlang/cli review src/ --recursive --llm\n      #   env:\n      #     KERN_LLM_API_KEY: ${{ secrets.KERN_LLM_API_KEY }}\n      #     KERN_LLM_MODEL: ${{ vars.KERN_LLM_MODEL }}\n```\n\n### MCP Security — GitHub Action\n\nDrop this into `.github/workflows/mcp-security.yml` for MCP server scanning with SARIF upload and PR comments:\n\n```yaml\nname: MCP Security\n\non:\n  push:\n    branches: [main, dev]\n  pull_request:\n    branches: [main]\n\npermissions:\n  contents: read\n  security-events: write\n  pull-requests: write\n\njobs:\n  scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - uses: actions/setup-node@v4\n        with:\n          node-version: '20'\n\n      - name: Install KERN MCP Security\n        run: npm install -g @kernlang/review-mcp@latest\n\n      - name: Scan MCP server code\n        id: scan\n        run: |\n          kern-mcp-security --format json --output kern-mcp-security.json . || true\n          kern-mcp-security --format sarif --output kern-mcp-security.sarif . || true\n\n          RESULT=$(kern-mcp-security --quiet . 2>&1) || true\n          GRADE=$(echo \"$RESULT\" | head -1 | awk '{print $1}')\n          SCORE=$(echo \"$RESULT\" | head -1 | awk '{print $2}')\n\n          echo \"grade=$GRADE\" >> $GITHUB_OUTPUT\n          echo \"score=$SCORE\" >> $GITHUB_OUTPUT\n          echo \"MCP Security Score: $GRADE ($SCORE/100)\"\n\n      - name: Verify tool pinning lockfile\n        run: |\n          if [ -f .kern-mcp-lock.json ]; then\n            kern-mcp-security --verify . || echo \"::warning::Tool pinning drift detected\"\n          else\n            echo \"No .kern-mcp-lock.json found — run 'npx kern-mcp-security --lock .' to generate one\"\n          fi\n\n      - name: Upload SARIF to Code Scanning\n        if: always() && hashFiles('kern-mcp-security.sarif') != ''\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: kern-mcp-security.sarif\n          category: kern-mcp-security\n        continue-on-error: true\n\n      - name: Post PR comment\n        if: github.event_name == 'pull_request' && always()\n        uses: actions/github-script@v7\n        with:\n          script: |\n            const fs = require('fs');\n            let report;\n            try {\n              report = JSON.parse(fs.readFileSync('kern-mcp-security.json', 'utf-8'));\n            } catch { return; }\n\n            const { grade, total } = report.score;\n            const color = { A: '22c55e', B: '84cc16', C: 'f97316', D: 'f59e0b', F: 'ef4444' }[grade];\n            const badge = `![Score](https://img.shields.io/badge/MCP_Security-${grade}_(${total}%25)-${color})`;\n\n            let body = `## KERN MCP Security Report\\n\\n${badge}\\n\\n`;\n            body += `| Metric | Score |\\n|--------|-------|\\n`;\n            body += `| Guard Coverage | ${report.score.guardCoverage}% |\\n`;\n            body += `| Input Validation | ${report.score.inputValidation}% |\\n`;\n            body += `| Rule Compliance | ${report.score.ruleCompliance}% |\\n`;\n            body += `| Auth Posture | ${report.score.authPosture}% |\\n\\n`;\n            body += `**${report.findingsCount} finding(s)**\\n\\n`;\n            body += `> Scanned by [KERN MCP Security](https://kernlang.dev/review)`;\n\n            const { data: comments } = await github.rest.issues.listComments({\n              owner: context.repo.owner, repo: context.repo.repo,\n              issue_number: context.issue.number,\n            });\n            const existing = comments.find(c => c.body?.includes('KERN MCP Security Report'));\n\n            if (existing) {\n              await github.rest.issues.updateComment({\n                owner: context.repo.owner, repo: context.repo.repo,\n                comment_id: existing.id, body,\n              });\n            } else {\n              await github.rest.issues.createComment({\n                owner: context.repo.owner, repo: context.repo.repo,\n                issue_number: context.issue.number, body,\n              });\n            }\n\n      - name: Enforce score threshold\n        if: always()\n        run: |\n          SCORE=\"${{ steps.scan.outputs.score }}\"\n          THRESHOLD=60\n          if [ -n \"$SCORE\" ] && [ \"$SCORE\" -lt \"$THRESHOLD\" ] 2>/dev/null; then\n            echo \"::error::MCP Security score $SCORE is below threshold $THRESHOLD\"\n            exit 1\n          fi\n```\n\n### KERN Compile + Validate — GitHub Action\n\nDrop this into `.github/workflows/kern-compile.yml` to validate `.kern` files compile correctly on every PR:\n\n```yaml\nname: KERN Compile\n\non:\n  push:\n    branches: [main, dev]\n  pull_request:\n    branches: [main]\n\njobs:\n  compile:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v6\n\n      - uses: actions/setup-node@v6\n        with:\n          node-version: '22'\n\n      - name: Activate pnpm\n        run: |\n          corepack enable\n          corepack prepare pnpm@10.32.1 --activate\n          pnpm --version\n\n      - run: pnpm install --frozen-lockfile --ignore-scripts\n      - run: pnpm build\n\n      - name: Validate .kern files\n        run: npx @kernlang/cli compile src/ --target=nextjs --json\n\n      - name: Type-check generated output\n        run: npx tsc --noEmit\n```\n\n### Release Process\n\nUse the built-in release workflows in this order:\n\n1. Run `Release Preflight` from `main` with a plain semver like `3.2.4`.\n2. Wait for the preflight run to pass build, test, and `pnpm publish --dry-run`.\n3. Publish a GitHub Release with a lowercase tag like `v3.2.4`.\n4. Let `Version & Publish` publish to npm and sync versions back to `dev`.\n\nContributor architecture guide: [docs/architecture.md](docs/architecture.md)\n\n---\n\n## Ecosystem\n\n| Package | What it does |\n|:--------|:-------------|\n| **[@kernlang/cli](https://www.npmjs.com/package/@kernlang/cli)** | CLI — compile, review, context, evolve, dev |\n| **[@kernlang/core](https://www.npmjs.com/package/@kernlang/core)** | Parser, codegen, types — the compiler engine |\n| **[@kernlang/test](https://www.npmjs.com/package/@kernlang/test)** | Native KERN structural test runner |\n| **[@kernlang/review](https://www.npmjs.com/package/@kernlang/review)** | 242 rules, taint tracking, OWASP LLM01, concept model |\n| **[@kernlang/review-mcp](https://www.npmjs.com/package/@kernlang/review-mcp)** | MCP security scanner (12 rules, OWASP MCP Top 10) |\n| @kernlang/react | Next.js, Tailwind, Web transpilers |\n| @kernlang/vue | Vue 3 SFC, Nuxt 3 transpilers |\n| @kernlang/native | React Native transpiler |\n| @kernlang/express | Express backend + WebSocket transpiler |\n| @kernlang/python | Python backend codegen (FastAPI router target + WebSocket) |\n| @kernlang/mcp | MCP server transpiler — .kern to secure MCP servers |\n| @kernlang/mcp-server | KERN's own MCP server — compile, review, parse via MCP |\n| @kernlang/terminal | ANSI terminal + Ink transpilers |\n| @kernlang/evolve | Self-extending template system |\n| @kernlang/review-python | Python review support (FastAPI, Django) |\n| @kernlang/playground | [Interactive compiler UI](https://kernlang.dev/playground) |\n| @kernlang/metrics | Language coverage analysis |\n| @kernlang/protocol | AI draft communication protocol |\n\n### VS Code Extensions\n\n- **[Kern MCP Security](https://marketplace.visualstudio.com/items?itemName=KERNlang.kern-mcp-security)** — MCP security scanner with inline findings, Security Score, autofixes ([Open VSX](https://open-vsx.org/extension/KERNlang/kern-mcp-security))\n- **[Kern Sight](https://marketplace.visualstudio.com/items?itemName=KERNlang.kern-sight)** — Review findings as inline diagnostics, sidebar panel, .kern syntax highlighting\n\n---\n\n## License\n\n**Dual-licensed: AGPL-3.0 + Commercial.**\n\n| Use case | License | Cost |\n|:---------|:--------|:-----|\n| Personal projects | AGPL-3.0 | Free |\n| Open-source projects | AGPL-3.0 | Free |\n| Education & research | AGPL-3.0 | Free |\n| Internal company tools (not distributed) | AGPL-3.0 | Free |\n| Commercial products & SaaS | **Commercial license** | [Contact us](mailto:hello@kernlang.dev) |\n\n**Why AGPL?** AGPL means if you use KERN in a product you distribute or serve to users, you must open-source your modifications. If you don't want that obligation, the commercial license gives you full freedom to use KERN in proprietary products without disclosure.\n\n**What the commercial license includes:**\n- Use KERN in closed-source products and SaaS\n- No obligation to open-source your code\n- Priority support and issue resolution\n- License for your entire engineering team\n\n**Contact:** [hello@kernlang.dev](mailto:hello@kernlang.dev) — we respond within 24 hours.\n\nCopyright (c) 2026 KERNlang\n\n---\n\n<div align=\"center\">\n  <a href=\"https://kernlang.dev\"><strong>kernlang.dev</strong></a>\n</div>\n"}