What it does, command by command.

The workflow

npx soundings-cli scan .                  # what does the code show? writes soundings-evidence.json
npx soundings-cli questions               # ask only what the code can't answer
npx soundings-cli answers --output a.md   # the 43-question bank, every sentence sourced   (Pro)
npx soundings-cli answer client.csv       # fill in a client's questionnaire              (Pro)
npx soundings-cli document privacy-notice # also: subprocessors, dpia, ai-use, trust-page (Pro)
npx soundings-cli verify draft.md         # check any text against the evidence

The evidence file

The scan writes paths, line numbers and short claims, never code or secret values. Each fact says how sure it is (stated by the code, inferred, or not found by the scan), and anything the code can't show becomes a question. See the evidence format.

What each detector reads

Detectors read the structure of your code (imports, calls, property names), so a library named in a comment, a string or a test file is not mistaken for a real use. Every detector's scope, and where it stops, is listed in the detector reference.

Checking text

soundings verify fails any statement about your project that has no real source, names something its sources don't mention, says something is absent when the cited fact shows it is present, or implies legal assurance. It can show a sentence is unsupported; it cannot show one is true. See how verification works.

Questionnaires and documents

See filling in a client's questionnaire (including how well matching works) and the documents and their formats.

Plans and the licence check

Exactly what the one licence check sends is documented in plans and licensing. In CI, set your key as SOUNDINGS_LICENCE.