🥩Marinate

Your AI model config is a
dependency that rots.

Model IDs get retired. Newer, cheaper versions ship every few weeks. Pinned names silently drift. Nobody re-checks. Marinate scans your repo locally and tells you what's stale — with sources — before it breaks production.

$npx marinate-audit check

What you actually see

One command. No API key, no account, no signup. The catalog ships inside the package, so the scan itself makes no network calls at all. Every finding carries the file, line, and an official source link.

🥩 marinate check — 3 files · 0 call sites · 3 references        data 2026.07.24.4 · cli 0.1.0

 ▲ BEHAVIOR    .claude/settings.json:1
      "opus[1m]" is a floating alias that currently resolves to
      claude-opus-5. It last re-pointed on 2026-07-24 (previously
      claude-opus-4-8). Pin an explicit version so the deployed model
      can't change under you without a code edit.
      fix: Replace "opus" with an explicit version such as claude-opus-5.
      source: code.claude.com/docs/en/model-config · verified 2026-07-24

 ▲ REVIEW      src/agent.py:1
      claude-3-5-sonnet-20241022 is documented as retired; documented
      successor is claude-sonnet-4-6.
      source: platform.claude.com/../model-deprecations · verified 2026-07-23

 ● STALE       src/classify.ts:1
      gemini-2.5-pro is documented as deprecated. It is scheduled to
      retire on 2026-10-16. Documented successor: gemini-3.1-pro-preview.
      source: ai.google.dev/gemini-api/docs/pricing · verified 2026-07-23

 2 behavior/review · 1 stale

It doesn't phone home

Marinate is a linter, not a service. There is no backend, no account, and nothing to opt out of.

The catalog is bundled

Model lifecycle data is compiled into the package at build time and versioned with it — the report prints which catalog it used. There is no registry to call and no key to hold.

The scan opens no socket

No HTTP, no DNS, no fetch. A test in CI reads the CLI's own source and fails the build if any networking module or fetch call appears in it.

The one exception, stated plainly: npx downloads the package from the npm registry, exactly like installing anything else. After that the tool is airtight — your source, prompts, file paths, credentials and results never go anywhere, because there is no code path that could send them.

The failures that don't raise an error

A retired model at least fails loudly. These three don't fail at all — your code runs, returns a normal response, and quietly does something other than what you configured. Every claim below is the provider's own wording, checked against the live page on 2026-07-25.

Case 1 · caching turns itself off

Your prompt cache stopped working and nothing said so

Minimum cacheable prompt length is set per model — and it is not monotonic across generations. Claude Opus 4.6 requires 4,096 tokens. Opus 5 requires 512. A 3,000-token cached prefix works on one and is ignored by the other.

“Any requests to cache fewer than this number of tokens will be processed without caching, and no error is returned.”platform.claude.com/docs/en/build-with-claude/prompt-caching

you wrote: cache_control on a ~3,000-token system prompt
you assumed: cache reads at 0.1× input rate
what happens: full input rate, every request, no warning

Case 2 · the tokenizer changed

The same text became 30% more tokens

Claude 4.7 introduced a new tokenizer. Nothing in your request changed, but every count derived from the old one — a tuned max_tokens, a context budget, a cost model — is now wrong in the same direction.

“Claude 4.7 and later models … use a newer tokenizer … This tokenizer produces approximately 30% more tokens for the same text.”platform.claude.com/docs/en/about-claude/pricing

you wrote: max_tokens sized against a pre-4.7 model
you assumed: the same prompt costs the same
what happens: responses truncate; spend drifts up ~30%

Case 3 · the name moved

Your config points at a different model than it did yesterday

Tier aliases re-point when a generation ships. On 2026-07-24 the opus alias moved from Claude Opus 4.8 to Claude Opus 5. Same config file, same deploy, different model — with different cache minimums and different behaviour.

“Before v2.1.219, opus resolved to Opus 4.8 on the Anthropic API.”code.claude.com/docs/en/model-config

you wrote: "model": "opus[1m]"
you assumed: a pin
what happens: the model changes under you, with no code edit

And when a model does finally go: “Deprecated models are likely to be less reliable than active models.” — Anthropic, model-deprecations. Nine OpenAI models shut down on 2026-07-23. Marinate reads the same pages these quotes come from, every day, and tells you which of them your repo is standing on.

Why it won't cry wolf

A false alarm on a private repo is the one thing that gets a tool uninstalled. So caution is built in, not hoped for:

A model named in a README or comment is never a build-failing error — only real config is.
A variable named o1 is never mistaken for the o1 model. Only quoted pins count.
Every finding links an official source + date — verify any claim in seconds.
The catalog is compiled from provider documentation by us, before each release — never from a model's memory, which is the exact bug this tool exists to catch.
Your scan is offline. The catalog ships inside the package, so the CLI opens no socket while it runs — asserted by a test in CI, not promised in a README.
This first version structurally cannot fail your build with a false positive — worst case is a warning.

Why a provider can't build this

Anthropic will never tell you to move a call site to Gemini. OpenAI will never recommend Claude. Marinate is neutral — its only job is keeping your config current, wherever the frontier is this month. Anthropic · OpenAI · Google · xAI · Mistral.

Free, forever

The CLI and release alerts. Local, zero-credential, one command. For solo devs and small projects.

Teams (soon)

Fleet view across repos, automated upgrade PRs, spend attribution — for teams with a real AI bill.

Get release alerts

Be notified when a provider change affects one of your pinned models. No spam, unsubscribe anytime.

Building now: Anthropic + OpenAI compat rules, all-provider staleness catalog.