Meziantou Analyzer

Meziantou.Analyzer

Trigger On

• the repo uses or wants Meziantou.Analyzer
• the team wants one analyzer pack that covers design, usage, security, performance, and style

Value

• produce a concrete project delta: code, docs, config, tests, CI, or review artifact
• reduce ambiguity through explicit planning, verification, and final validation skills
• leave reusable project context so future tasks are faster and safer

Do Not Use For

• repos that already enforce an overlapping analyzer baseline and do not want extra diagnostics
• formatting-only work

Inputs

• the nearest AGENTS.md
• current analyzer packages
• .editorconfig

Quick Start

1. Read the nearest AGENTS.md and confirm scope and constraints. 2. Run this skill's Workflow through the Ralph Loop until outcomes are acceptable. 3. Return the Required Result Format with concrete artifacts and verification evidence.

Workflow

1. Add Meziantou.Analyzer when the repo wants broader rules than the SDK baseline. 2. Keep rule severity in the repo-root .editorconfig. 3. Review overlaps with SDK analyzers and Roslynator before mass-enabling everything as errors.

Bootstrap When Missing

If Meziantou.Analyzer is not configured yet:

1. Detect current state:

• rg -n "Meziantou\\.Analyzer" -g '*.csproj' .

2. Add the package to the intended scope (project-level or shared props strategy):

• dotnet add PROJECT.csproj package Meziantou.Analyzer

3. Set severity in root .editorconfig for the enabled MAxxxx rules. 4. Keep overlap with SDK analyzers and Roslynator explicit to avoid duplicate noise. 5. Run dotnet build SOLUTION_OR_PROJECT and return status: configured or status: improved. 6. If the repo intentionally keeps a smaller analyzer surface, return status: not_applicable.

Deliver

• explicit Meziantou package setup
• repo-owned severity and warning policy

Validate

• the added rules are understood by the team
• CI runs stay actionable instead of noisy

Ralph Loop

Use the Ralph Loop for every task, including docs, architecture, testing, and tooling work.

1. Plan first (mandatory):

• analyze current state
• define target outcome, constraints, and risks
• write a detailed execution plan
• list final validation skills to run at the end, with order and reason

2. Execute one planned step and produce a concrete delta. 3. Review the result and capture findings with actionable next fixes. 4. Apply fixes in small batches and rerun the relevant checks or review steps. 5. Update the plan after each iteration. 6. Repeat until outcomes are acceptable or only explicit exceptions remain. 7. If a dependency is missing, bootstrap it or return status: not_applicable with explicit reason and fallback path.

Required Result Format

• status: complete | clean | improved | configured | not_applicable | blocked
• plan: concise plan and current iteration step
• actions_taken: concrete changes made
• validation_skills: final skills run, or skipped with reasons
• verification: commands, checks, or review evidence summary
• remaining: top unresolved items or none

For setup-only requests with no execution, return status: configured and exact next commands.

Load References

• references/meziantou-analyzer.md
• references/rules.md
• references/config.md

Example Requests

• "Add Meziantou analyzers to the repo."
• "Use Meziantou for extra quality and security checks."

Meziantou.Analyzer EditorConfig Configuration

Basic Setup

Add configuration to the root .editorconfig file to control rule severities.

Severity Levels

• none - Disable the rule
• silent - Hidden from user, still runs
• suggestion - Shows as info message
• warning - Shows as warning
• error - Shows as error, fails build

Recommended Starter Configuration

[*.cs]
# === Meziantou.Analyzer Configuration ===

# String handling - enforce explicit culture
dotnet_diagnostic.MA0001.severity = warning
dotnet_diagnostic.MA0002.severity = warning
dotnet_diagnostic.MA0006.severity = warning
dotnet_diagnostic.MA0011.severity = warning
dotnet_diagnostic.MA0074.severity = warning
dotnet_diagnostic.MA0076.severity = warning

# Async best practices
dotnet_diagnostic.MA0004.severity = warning
dotnet_diagnostic.MA0040.severity = warning
dotnet_diagnostic.MA0042.severity = warning
dotnet_diagnostic.MA0045.severity = warning
dotnet_diagnostic.MA0067.severity = warning

# Performance
dotnet_diagnostic.MA0005.severity = warning
dotnet_diagnostic.MA0020.severity = warning
dotnet_diagnostic.MA0028.severity = warning
dotnet_diagnostic.MA0029.severity = warning
dotnet_diagnostic.MA0031.severity = warning
dotnet_diagnostic.MA0063.severity = suggestion

# Design
dotnet_diagnostic.MA0015.severity = warning
dotnet_diagnostic.MA0025.severity = warning
dotnet_diagnostic.MA0047.severity = warning

# Security
dotnet_diagnostic.MA0014.severity = error
dotnet_diagnostic.MA0035.severity = error
dotnet_diagnostic.MA0055.severity = warning

# Regex
dotnet_diagnostic.MA0009.severity = suggestion
dotnet_diagnostic.MA0110.severity = suggestion

# Style - often project-specific
dotnet_diagnostic.MA0003.severity = none
dotnet_diagnostic.MA0026.severity = none
dotnet_diagnostic.MA0048.severity = none
dotnet_diagnostic.MA0051.severity = none
dotnet_diagnostic.MA0053.severity = none

Library Configuration

Libraries should be stricter about async patterns and public API design:

[*.cs]
# Library-specific: require ConfigureAwait
dotnet_diagnostic.MA0004.severity = error

# Public API design
dotnet_diagnostic.MA0011.severity = error
dotnet_diagnostic.MA0015.severity = error
dotnet_diagnostic.MA0016.severity = error
dotnet_diagnostic.MA0018.severity = warning

Application Configuration

Applications can be more relaxed about some rules:

[*.cs]
# Applications may not need ConfigureAwait
dotnet_diagnostic.MA0004.severity = none

# More relaxed on certain design rules
dotnet_diagnostic.MA0053.severity = suggestion

Test Project Configuration

Test projects often need different rules:

[**/Tests/**/*.cs]
[**/Test/**/*.cs]
[**/*.Tests/**/*.cs]

# Disable sealed class requirement for test fixtures
dotnet_diagnostic.MA0053.severity = none

# Allow longer methods in tests
dotnet_diagnostic.MA0051.severity = none

# Allow TODO comments in tests
dotnet_diagnostic.MA0026.severity = none

# Tests may have blocking calls
dotnet_diagnostic.MA0042.severity = suggestion
dotnet_diagnostic.MA0045.severity = suggestion

Generated Code Configuration

Exclude generated files from analysis:

[*.Generated.cs]
[*.g.cs]
[*.designer.cs]
generated_code = true

Combining with Other Analyzers

When using Meziantou.Analyzer with other analyzers, avoid duplicate diagnostics:

With Roslynator

# Roslynator RCS1197 overlaps with MA0020 (LINQ optimization)
# Pick one and disable the other
dotnet_diagnostic.RCS1197.severity = none
dotnet_diagnostic.MA0020.severity = warning

# Roslynator RCS1075 overlaps with MA0042 (async blocking)
dotnet_diagnostic.RCS1075.severity = none
dotnet_diagnostic.MA0042.severity = warning

With StyleCop

# StyleCop SA1649 overlaps with MA0048 (file naming)
# Pick one and disable the other
dotnet_diagnostic.SA1649.severity = none
dotnet_diagnostic.MA0048.severity = warning

Rule-Specific Options

Some Meziantou rules support additional configuration:

MA0051 - Method Length

# Configure maximum method length
MA0051.maximum_lines_per_method = 60
MA0051.maximum_statements_per_method = 40

MA0053 - Sealed Classes

# Configure when to suggest sealing
MA0053.public_class_should_be_sealed = true

Migration Strategy

When adding Meziantou.Analyzer to an existing project:

Phase 1: Start with suggestions

[*.cs]
dotnet_analyzer_diagnostic.category-Meziantou.severity = suggestion

Phase 2: Gradually increase severity

[*.cs]
# Keep most as suggestions
dotnet_analyzer_diagnostic.category-Meziantou.severity = suggestion

# Promote critical rules to warnings
dotnet_diagnostic.MA0001.severity = warning
dotnet_diagnostic.MA0004.severity = warning
dotnet_diagnostic.MA0040.severity = warning

Phase 3: Enforce in CI

[*.cs]
dotnet_analyzer_diagnostic.category-Meziantou.severity = warning

# Security rules as errors
dotnet_diagnostic.MA0014.severity = error
dotnet_diagnostic.MA0035.severity = error

CI Integration

Build with warnings as errors for enforced rules:

dotnet build -warnaserror:MA0001,MA0004,MA0014,MA0035,MA0040

Or use the global setting:

<PropertyGroup>
  <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>

Sources

• Meziantou.Analyzer Configuration
• .editorconfig Documentation

Meziantou.Analyzer

Open/Free Status

• open source
• free to use

Install

dotnet add package Meziantou.Analyzer

Verify First

Before adding the package, check whether the repo already references it:

rg -n "Meziantou\\.Analyzer" -g '*.csproj' .

Common Usage

dotnet build MySolution.sln -warnaserror

Configure severity in .editorconfig, for example:

[*.cs]
dotnet_diagnostic.MA0004.severity = warning

CI Fit

• use dotnet build as the main enforcement gate
• keep severities explicit in repo config

When Not To Use

• when the repo already decided the analyzer surface is intentionally smaller

Sources

• Meziantou.Analyzer repository

Meziantou.Analyzer Rules

Rule Categories

Meziantou.Analyzer organizes rules into several categories:

• Design - API design and architecture patterns
• Usage - Correct API usage and common pitfalls
• Security - Security best practices
• Performance - Performance optimizations
• Style - Code style and readability

Commonly Used Rules

Design Rules

Usage Rules

Security Rules

Performance Rules

Style Rules

High-Value Rules for New Projects

When starting a new project, consider enabling these rules as errors:

# Async best practices
dotnet_diagnostic.MA0004.severity = error
dotnet_diagnostic.MA0040.severity = error
dotnet_diagnostic.MA0042.severity = error

# String handling
dotnet_diagnostic.MA0001.severity = error
dotnet_diagnostic.MA0006.severity = error
dotnet_diagnostic.MA0011.severity = error

# Performance
dotnet_diagnostic.MA0005.severity = error
dotnet_diagnostic.MA0020.severity = error
dotnet_diagnostic.MA0029.severity = error

# Design
dotnet_diagnostic.MA0015.severity = error
dotnet_diagnostic.MA0053.severity = error

Rules to Consider Disabling

Some rules may conflict with project style or be too strict:

Rule Interaction Notes

• MA0001 and MA0006 both deal with string comparisons; enable both for complete coverage
• MA0004 is essential for library code but can be disabled for application code
• MA0040, MA0042, and MA0045 all relate to async patterns; keep them aligned
• MA0020, MA0029, MA0031, and MA0063 overlap with LINQ optimization; configure consistently

Sources

• Meziantou.Analyzer Rules Documentation