How the Playground works
The Playground loads the TypeScript compiler into a Web Worker in your browser and analyzes the code you type. Nothing is sent to a server.
| Question | Answer |
|---|---|
| Where does analysis run? | In your browser, inside a dedicated Web Worker. |
| Is my code uploaded? | No. CodeGuard does not intentionally transmit it, and the page makes no analysis requests. |
| Is my code executed? | No. It is parsed and type-checked as text, never evaluated. |
| Is an AI model used? | No. Results come from the TypeScript compiler and deterministic CodeGuard rules. |
| Is my code saved? | No. Nothing is stored unless you copy it yourself; it is lost when you close the page. |
What is analyzed
| Check | TypeScript | JavaScript |
|---|---|---|
| Syntax errors | Yes | Yes |
Type errors (for example TS2322) | Yes, from a real TypeScript program in strict mode | No, syntax only |
| Security rules SEC001–SEC005 | Yes | Yes |
| ARCH001, ARCH002 | No | No |
Type checking uses TypeScript's own ES5–ES2022 library declarations, bundled with the page, plus a few hand-written declarations for console, timers, process.env, require and child_process. The DOM and Node.js type packages are not included, so code that relies on document, window or other Node APIs reports unknown-name errors.
Security rules
The security rules use the same AST logic as the CodeGuard CLI. Because the CLI analyzer reads files through Node.js, the detection code is mirrored for the browser, and an automated test runs both on the same sources and fails if their findings differ. Severities, messages and remediation text match the CLI. Each rule ID links to its entry in the Rules Explorer.
Architecture rules are not available
ARCH001 (circular dependencies) and ARCH002 (unresolved local imports) need every file in a project and its module resolution settings. A single snippet cannot provide that, so the Playground does not run them. Use the CLI or the MCP server for project-wide analysis. See Rules Explorer for what each rule detects.
Differences from the CLI
- One snippet, one file: no imports are resolved, so unresolved-import errors (
TS2307,TS2792,TS7016) are omitted and counted instead of shown. - No
tsconfig.json,jsconfig.json,codeguard.config.jsonor rule configuration: every security rule is on and TypeScript runs in strict mode. - JavaScript is checked for syntax only. The CLI checks JavaScript types only when a project configuration enables
checkJs. - Source is limited to 20,000 characters, and at most 100 findings are listed (the counts include all findings). An analysis that runs for more than 20 seconds is stopped.
This is a convenient way to learn what CodeGuard reports, not a replacement for analyzing a whole project. See Security & Privacy for the CLI and MCP trust model.