Check
Anchor.toml, Cargo.toml, Cargo.lock, package.json and source files, and it does not run your code. It compares what it finds with Anchor 1.2.2, Solana and Agave 4.4.1, platform-tools 1.58, npm and SBPF arch v3. See Project detection.
Each finding has a rule id (anchor, pins, crates, duplicates, client, transaction, arch or advisory), a source URL and an observation date.
Fix
fix only prints proposed edits. It does not change files, and any commands are proposed, not run.
--apply writes the edits, but only inside a linked Git worktree and after preimage checks. Add --verify to verify afterwards.
If it fails
TOML parsing needs Python 3.11 or newer, so checkpython3 --version. --apply refuses to run outside a linked Git worktree, so create one and run it again. If you hit a limit (depth 12, 2,000 files, 2 MB per file, 16 MB total), narrow --project to the package you care about.