Flutter Quality Analyzer

A Dart CLI that gives a health report for Flutter/Dart projects: dependency freshness, licenses, pub.dev scores, discontinued packages, security advisories, test coverage, AI summary, and optional auto-fix.

Features

	Feature	Flag
📦	Version check — current constraint vs latest package release	(always on)
🏷️	License detection — SPDX identifier per package	(always on)
📊	pub points & popularity score	(always on)
⛔	Discontinued package detection with replacement hint	(always on)
🔒	Security check via OSV API using resolved versions from `pubspec.lock`	`--security`
🧪	Test coverage analysis — test/source ratio + grade	`--coverage`
🤖	AI health summary (Gemini or Groq, with Gemini→Groq fallback on rate-limit)	`--ai-summary`
🔧	Auto-fix outdated constraints in `pubspec.yaml`	`--fix`
👁️	Dry-run preview for `--fix`	`--dry-run`
🎨	Colored console output or machine-readable single JSON object	`--format`

Installation

Global

dart pub global activate flutter_quality_analyzer

Run inside your project:

fqa

If fqa is not found:

export PATH="$PATH:$HOME/.pub-cache/bin"

As a dev dependency

dev_dependencies:
  flutter_quality_analyzer: ^2.2.3

dart run flutter_quality_analyzer

Usage

# Default checks (versions, licenses, scores, discontinued)
fqa

# Security using OSV
fqa --security

# Coverage
fqa --coverage

# AI summary (Gemini)
fqa --ai-summary --gemini-key YOUR_KEY

# AI summary (Groq)
fqa --ai-summary --ai-provider groq --groq-key YOUR_KEY

# Full run
fqa --security --coverage --ai-summary --gemini-key YOUR_KEY --groq-key YOUR_GROQ_KEY

# Fix outdated constraints
fqa --fix

# Preview fixes only
fqa --dry-run

JSON output (CI-friendly)

fqa --security --coverage --format json > report.json

JSON output is a single object and may include:

project
packages
summary
security
testCoverage
aiSummary
fix
errors (non-fatal/fatal runtime issues in JSON mode)

AI provider notes

--ai-provider gemini requires --gemini-key or GEMINI_API_KEY.
--ai-provider groq requires --groq-key.
Missing required AI keys exits with code 1.
If Gemini is rate-limited and --groq-key is provided, the tool retries with Groq.

All flags

Flag	Short	Description
`--path`	`-p`	Path to Flutter project (default: current directory)
`--format`	`-f`	Output format: `console` (default) or `json`
`--security`	`-s`	Check known vulnerabilities via OSV
`--coverage`	`-c`	Analyze test coverage
`--ai-summary`	`-a`	Generate AI health summary
`--ai-provider`		`gemini` (default) or `groq`
`--gemini-key`		Gemini API key (or `GEMINI_API_KEY`)
`--groq-key`		Groq API key
`--fix`		Auto-update outdated constraints
`--dry-run`		Preview `--fix` updates
`--verbose`	`-v`	Enable debug logging
`--help`	`-h`	Show usage

Exit codes

Code	Meaning
`0`	No issues found
`1`	Outdated/discontinued/vulnerable packages found, or fatal runtime/config error

Get free API keys

Provider	Link
Gemini	https://aistudio.google.com/app/apikey
Groq	https://console.groq.com
OSV (no key required)	https://osv.dev