lizard-complexity

Lizard analyzes source code per function for NLOC (non-comment LoC), CCN (cyclomatic complexity), token count, and parameter count across 30+ languages including C/C++, Java, Python, JavaScript, Go, Rust, TypeScript, Swift, Kotlin (per the Lizard README (opens in new window)). Default CCN warning threshold is 15.

When to use

• Polyglot codebase where per-language linters give inconsistent complexity metrics.
• Adding a CCN ceiling to CI without buying a commercial scanner.
• One-off audit of "where is the most complex code?" before a refactor.

Step 1 - Install

pip install lizard

Or run the standalone script:

python lizard.py path/to/code

Per the Lizard README (opens in new window), no external deps required.

Step 2 - Baseline scan

lizard src/

Default output groups by file with per-function NLOC/CCN/token/param counts. Default warning threshold: CCN ≥ 15.

Step 3 - Set production-only thresholds

lizard src/ \
  -x"./tests/*" \
  -x"./vendor/*" \
  -C 10 \
  -L 100 \
  -a 5

Step 4 - CSV/XML for CI

# CSV for grep / jq pipelines
lizard src/ -x"./tests/*" -C 10 --csv > lizard.csv

# XML for CI parsers (cppncss-style)
lizard src/ -x"./tests/*" -C 10 -X > lizard.xml

# HTML for human review
lizard src/ -x"./tests/*" -C 10 -H > lizard.html

Step 5 - Fail CI on warnings

lizard src/ -x"./tests/*" -C 10 -L 100 -a 5 -w
EXIT=$?
if [ "$EXIT" -ne 0 ]; then
  echo "Complexity threshold breached. See report."
  exit 1
fi

-w prints warnings only (clang/gcc style). Lizard exits non-zero when any function exceeds the configured threshold.

Step 6 - Per-language scope

# Only Python
lizard src/ -l python -C 10

# Only TypeScript + JS
lizard src/ -l typescript -l javascript -C 10

Useful when a polyglot repo has language-specific budgets (e.g., Python tolerates higher CCN than C).

Anti-patterns

Limitations

• Lizard's CCN counts decision points (if/else/case/&&/||/?:); doesn't reflect cognitive complexity (nesting depth weight). Use SonarQube / sonarqube-maintainability-gate for cognitive complexity if needed.
• No per-class metrics for OO code beyond per-method.

References

• Lizard README (opens in new window) - CLI reference, language list, threshold flags