Graph-powered code intelligence for AI agents. Index any codebase, query via MCP or CLI.
Drift inferred · capture-to-capture
tool count over time
05-30 12:55 now
0t
17t
transport stdio · streamable-http · http · sse counts 17 tools · 0 res
· 0 prompts
permission surface via README inference
tools
-
api_impact
Pre-change impact report for an API route handler
-
check
Read-only structural checks against the indexed graph
-
context
360-degree symbol view — categorized refs, process participation
-
cypher
Raw Cypher graph queries
-
detect_changes
Git-diff impact — maps changed lines to affected processes
-
explain
Explain persisted taint findings (source→sink flows, --pdg indexes)
-
group_list
List configured repository groups
-
group_sync
Rebuild a group's Contract Registry and cross-repo links
-
impact
Blast radius analysis with depth grouping and confidence
-
list_repos
Discover all indexed repositories (paginated — limit/offset)
-
pdg_query
Query control/data dependence at statement level (--pdg indexes)
-
query
Process-grouped hybrid search (BM25 + semantic + RRF)
-
rename
Multi-file coordinated rename with graph + text search
-
route_map
API route map — which components fetch which endpoints, and handlers
-
shape_check
Validate API response shapes against consumers' property accesses
-
tool_map
MCP/RPC tool definitions — where they're defined and handled
-
trace
Shortest directed path between two symbols (call + class-member edges)
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v1.6.9 · analyzer v33 · 1w ago
danger signals1
- dynamic code execution vm exec package/dist/storage/parsedfile-store.js :131
cachedGc = vm.runInNewContext('gc');
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 1631
filesystem 74
- fs package/dist/cli/ai-context.js :8
import fs from 'fs/promises'; - fs package/dist/cli/analyze-config.js :30
import fs from 'node:fs'; - fs package/dist/cli/analyze.js :25
import fs from 'fs/promises'; - fs package/dist/cli/clean.js :7
import fs from 'fs/promises'; - fs package/dist/cli/eval-server.js :34
import { writeSync } from 'node:fs'; - fs package/dist/cli/group.js :31
await fs.writeFile(path.join(groupDir, 'group.yaml'), yaml.dump(config), 'utf-8'); - fs package/dist/cli/index-repo.js :16
import fs from 'fs/promises'; - fs package/dist/cli/remove.js :22
* - Atomic order mirrors `clean`: fs.rm FIRST, then unregister. A - fs package/dist/cli/setup.js :8
import fs from 'fs/promises'; - fs package/dist/cli/skill-gen.js :9
import fs from 'fs/promises'; - fs package/dist/cli/tool.js :17
import { writeSync } from 'node:fs'; - fs package/dist/cli/uninstall.js :30
import fs from 'fs/promises'; - fs package/dist/config/ignore-service.js :2
import fs from 'fs/promises'; - fs package/dist/core/embeddings/onnxruntime-node-resolver.js :56
import { existsSync } from 'node:fs'; - fs package/dist/core/embeddings/server-mapping.js :7
import fs from 'fs/promises'; - fs package/dist/core/group/bridge-db.js :1
import fsp from 'node:fs/promises'; - fs package/dist/core/group/cross-impact.js :5
import fsp from 'node:fs/promises'; - fs package/dist/core/group/extractors/elixir-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/fs-utils.js :1
import * as fs from 'node:fs'; - fs package/dist/core/group/extractors/go-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/include-extractor.js :2
import * as fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/java-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/node-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/python-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/extractors/rust-workspace-extractor.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/service-boundary-detector.js :1
import fs from 'node:fs/promises'; - fs package/dist/core/group/service.js :5
import fsp from 'node:fs/promises'; - fs package/dist/core/group/storage.js :1
import * as fs from 'node:fs'; - fs package/dist/core/ingestion/filesystem-walker.js :3
import fs from 'fs/promises'; - fs package/dist/core/ingestion/language-config.js :1
import fs from 'fs/promises'; - fs package/dist/core/ingestion/languages/c/header-scan.js :1
import { readdirSync } from 'fs'; - fs package/dist/core/ingestion/languages/cpp/header-scan.js :1
import { readdirSync } from 'fs'; - fs package/dist/core/ingestion/languages/php/import-target.js :18
import { readFileSync } from 'node:fs'; - fs package/dist/core/ingestion/languages/typescript/nuxt-auto-imports.js :35
import fs from 'fs/promises'; - fs package/dist/core/ingestion/pipeline-phases/parse-impl.js :32
import fs from 'node:fs'; - fs package/dist/core/ingestion/utils/heap-probe.js :7
import { appendFileSync } from 'node:fs'; - fs package/dist/core/ingestion/workers/worker-pool.js :3
import fs from 'node:fs'; - fs package/dist/core/lbug/csv-generator.js :14
import fs from 'fs/promises'; - fs package/dist/core/lbug/lbug-adapter.js :1
import fs from 'fs/promises'; - fs package/dist/core/lbug/lbug-config.js :1
import fs from 'fs/promises'; - fs package/dist/core/lbug/native-check.js :1
import fs from 'fs'; - fs package/dist/core/lbug/pdg-emit-sink.js :45
import fs from 'fs'; - fs package/dist/core/lbug/pool-adapter.js :17
import fs from 'fs/promises'; - fs package/dist/core/lbug/rel-pair-routing.js :28
import { createWriteStream } from 'fs'; - fs package/dist/core/lbug/sidecar-recovery.js :1
import fs from 'fs/promises'; - fs package/dist/core/run-analyze.js :12
import fs from 'fs/promises'; - fs package/dist/core/wiki/generator.js :12
import fs from 'fs/promises'; - fs package/dist/core/wiki/html-viewer.js :7
import fs from 'fs/promises'; - fs package/dist/core/wiki/local-cli-client.js :7
import fs from 'fs/promises'; - fs package/dist/mcp/local/local-backend.js :8
import fs from 'fs/promises'; - fs package/dist/server/analyze-upload.js :11
import fsp from 'fs/promises'; - fs package/dist/server/api.js :13
import fs from 'fs/promises'; - fs package/dist/server/git-clone.js :9
import fs from 'fs/promises'; - fs package/dist/server/upload-ingest.js :16
import fs from 'fs'; - fs package/dist/server/upload-sweep.js :11
import fsp from 'fs/promises'; - fs package/dist/storage/file-hash.js :21
import fs from 'fs/promises'; - fs package/dist/storage/fs-atomic.js :9
import fsp from 'fs/promises'; - fs package/dist/storage/git.js :2
import { statSync } from 'fs'; - fs package/dist/storage/parse-cache.js :26
import fs from 'fs/promises'; - fs package/dist/storage/parsedfile-store.js :50
import { promises as fs, mkdirSync, writeFileSync } from 'node:fs'; - fs package/dist/storage/repo-manager.js :16
import fs from 'fs/promises'; - fs package/dist/storage/scope-index-store.js :28
import { mkdirSync, writeFileSync, readFileSync, rmSync } from 'node:fs'; - fs package/hooks/antigravity/gitnexus-antigravity-hook.cjs :23
const fs = require('fs'); - fs package/hooks/claude/gitnexus-hook.cjs :14
const fs = require('fs'); - fs package/hooks/claude/hook-db-lock-probe.cjs :59
const fs = require('fs'); - fs package/hooks/claude/hook-lock.cjs :1
const fs = require('fs'); - fs package/hooks/claude/resolve-analyze-cmd.cjs :30
const fs = require('fs'); - fs (weak) package/scripts/assert-publish-grammar-coverage.cjs :27
const fs = require('fs'); - fs (weak) package/scripts/bench/fts-evict-reload-rss.mjs :61
import fs from 'node:fs'; - fs (weak) package/scripts/build-tree-sitter-grammars.cjs :35
const fs = require('fs'); - fs (weak) package/scripts/build.js :12
import fs from 'node:fs'; - fs (weak) package/scripts/install-duckdb-extension.mjs :2
import fs from 'node:fs/promises'; - fs (weak) package/scripts/run-cross-platform.ts :13
import fs from 'fs'; - fs (weak) package/scripts/spikes/s1-reaching-def-index-bench.ts :20
import fs from 'fs/promises';
shell / exec 36
- shell package/dist/cli/analyze.js :12
import { spawn } from 'child_process'; - shell package/dist/cli/resolve-invocation.js :13
import { execFileSync } from 'node:child_process'; - shell package/dist/cli/setup.js :11
import { execFile, execFileSync } from 'child_process'; - shell package/dist/cli/uninstall.js :32
import { execFile } from 'child_process'; - shell package/dist/cli/wiki.js :9
import { execSync, execFileSync } from 'child_process'; - shell package/dist/core/embeddings/onnxruntime-node-resolver.js :58
import { execFileSync } from 'node:child_process'; - shell package/dist/core/git-staleness.js :5
import { execFile, execFileSync } from 'node:child_process'; - shell package/dist/core/ingestion/cfg/emit.js :231
* block (`call`/`new` sites; the leaf of a dotted path — `child_process.exec` ⇒ - shell package/dist/core/ingestion/cfg/visitors/c-cpp-harvest.js :428
// any enclosing argument (`exec(escape(x))` must not put `escape` into - shell package/dist/core/ingestion/cfg/visitors/call-site-harvest.js :114
// Occurrence fan-out happens BEFORE the statement-level dedup: `exec(x, x)` - shell package/dist/core/ingestion/cfg/visitors/dart-harvest.js :597
// value occurrence in any enclosing argument (`exec(escape(x))` must not - shell package/dist/core/ingestion/cfg/visitors/java-harvest.js :379
* (`exec(x)`) has no `object`. Reproduces EXACTLY the uses the old default - shell package/dist/core/ingestion/cfg/visitors/typescript-harvest.js :585
// occurrence fan-out so `exec((log(x), 'safe'))` does not taint exec's - shell package/dist/core/ingestion/taint/emit.js :43
* conflation would drop `exec(req.body, req.query)`'s second finding). The - shell package/dist/core/ingestion/taint/match.js :19
* run } from 'child_process'` makes `run(c)` resolve to - shell package/dist/core/ingestion/taint/propagate.js :20
* finding (`exec(req.body)`). The same statement SEEDS taint: every binding - shell package/dist/core/ingestion/taint/summary-harvest.js :74
/** Last segment of a dotted callee path (`child_process.exec` ⇒ `exec`). */ - shell package/dist/core/lbug/extension-loader.js :1
import { spawn } from 'child_process'; - shell package/dist/core/lbug/lbug-config.js :6
import { execFileSync } from 'child_process'; - shell package/dist/core/run-analyze.js :13
import { execFileSync } from 'child_process'; - shell package/dist/core/wiki/cursor-client.js :9
import { spawn, execSync } from 'child_process'; - shell package/dist/core/wiki/generator.js :14
import { execSync, execFileSync } from 'child_process'; - shell package/dist/core/wiki/local-cli-client.js :11
import { execFileSync, spawn } from 'child_process'; - shell package/dist/mcp/local/local-backend.js :3211
const { execFileSync } = await import('child_process'); - shell package/dist/mcp/local/pdg-impact.js :151
const rows = await exec(lbugPath, `MATCH (a:BasicBlock)-[r:CodeRelation]->(a) - shell package/dist/server/analyze-launch.js :13
import { fork } from 'child_process'; - shell package/dist/server/analyze-worker.js :4
* This file is the entry point for `child_process.fork()`. - shell package/dist/server/git-clone.js :7
import { spawn } from 'child_process'; - shell package/dist/storage/git.js :1
import { execSync } from 'child_process'; - shell package/hooks/antigravity/gitnexus-antigravity-hook.cjs :25
const { spawnSync } = require('child_process'); - shell package/hooks/claude/gitnexus-hook.cjs :16
const { spawnSync } = require('child_process'); - shell package/hooks/claude/hook-db-lock-probe.cjs :61
const { spawnSync } = require('child_process'); - shell package/hooks/claude/resolve-analyze-cmd.cjs :29
const { execFileSync } = require('child_process'); - shell (weak) package/scripts/build-tree-sitter-grammars.cjs :37
const { execSync } = require('child_process'); - shell (weak) package/scripts/build.js :11
import { execSync } from 'node:child_process'; - shell (weak) package/scripts/run-cross-platform.ts :12
import { execFileSync } from 'child_process';
network 15
- net package/dist/cli/analyze-config.js :84
// `fetch()`; a wrapper built on axios / a custom client, or named outside the - net package/dist/cli/eval-server.js :31
import http from 'http'; - net package/dist/cli/publish.js :91
response = await fetch(UNDERSTAND_QUICKLY_DISPATCH_URL, { - net package/dist/core/group/extractors/http-patterns/node.js :8
* - `fetch(url)` / `fetch(url, { method: 'POST' })` consumers - net package/dist/core/group/extractors/http-patterns/python.js :282
// obj.fetch(uri="api/v1/camera/info/") - net package/dist/core/ingestion/call-processor.js :13
* from `fetch()` calls to Next.js Route nodes. - net package/dist/core/ingestion/pipeline-phases/routes.js :6
* Also links middleware, processes fetch() calls, and scans HTML templates. - net package/dist/core/ingestion/route-extractors/nextjs.js :13
// from page-level route handlers that fetch() calls won't match anyway). - net package/dist/core/ingestion/tree-sitter-queries.js :335
; HTTP consumers: fetch('/path'), axios.get('/path'), $.get('/path'), etc. - net package/dist/core/ingestion/workers/parse-worker.js :635
* Walk a tree-sitter AST subtree looking for a call to the global `fetch()` function. - net package/dist/core/wiki/llm-client.js :147
// Validate base URL before any fetch (CodeQL js/http-to-file-access) - net package/dist/server/git-clone.js :10
import { isIP } from 'net'; - net package/web/assets/agent-Dli_x7bU.js :8
i=`langsmith.usage_metadata`,Hi=(...e)=>fetch(...e),Ui=void 0,Wi=Symbol.for(`ls:fetch_implementation`),Gi=()=>globalThis[Wi]===void 0?!0:Ui??!1,Ki=e=>async(...t)=>{if(e||wo(`DEBUG`)===`true`){let[e,n] - net package/web/assets/index-KctnI3Vq.js :2
n(e){if(e.ep)return;e.ep=!0;let n=t(e);fetch(e.href,n)}})();var Fe=je((e=>{var t=Symbol.for(`react.transitional.element`),n=Symbol.for(`react.portal`),r=Symbol.for(`react.fragment`),i=Symbol.for(`rea - net package/web/assets/katex-K3KEBU37-CTc5BslQ.js :256
ndGroup(),e.gullet.beginGroup();var n=e.fetch().text;if(n===`&`||n===`\\\\`)e.consume();else if(n===`\\end`){t[t.length-1].length===0&&t.pop();break}else throw new r(`Expected \\\\ or \\cr or \\end`,e
secrets 4
- secrets package/dist/cli/analyze.js :757
process.env.GITNEXUS_EMBEDDING_API_KEY = token; - secrets package/dist/cli/wiki.js :314
const envKey = process.env.GITNEXUS_API_KEY || process.env.OPENAI_API_KEY || ''; - secrets package/dist/core/embeddings/http-client.js :45
apiKey: process.env.GITNEXUS_EMBEDDING_API_KEY ?? 'unused', - secrets package/dist/core/wiki/llm-client.js :27
process.env.GITNEXUS_API_KEY ||
install hooks 3
- postinstall package/package.json :52
node scripts/build-tree-sitter-grammars.cjs - prepare package/package.json :54
node scripts/build.js - prepack package/package.json :55
node scripts/assert-publish-grammar-coverage.cjs && node scripts/build.js
declared dependencies 53
- @modelcontextprotocol/sdk@^1.0.0
- @huggingface/transformers@^4.1.0
- @ladybugdb/core@^0.18.0
- @scarf/scarf@^1.4.0
- busboy@^1.6.0
- cli-progress@^3.12.0
- commander@^15.0.0
- cors@^2.8.5
- express@^5.2.1
- express-rate-limit@^8.4.1
- glob@^13.0.6
- graphology@^0.26.0
- graphology-indices@^0.17.0
- graphology-utils@^2.3.0
- ignore@^7.0.5
- js-yaml@^4.1.1
- jsonc-parser@^3.3.1
- mnemonist@^0.40.3
- node-addon-api@^8.0.0
- node-gyp-build@^4.8.0
- onnxruntime-common@^1.26.0
- onnxruntime-node@^1.24.0
- pandemonium@^2.4.0
- pino@^10.3.1
- pino-pretty@^13.1.3
- tree-sitter@0.21.1
- tree-sitter-c-sharp@0.23.1
- tree-sitter-cpp@0.23.2
- tree-sitter-go@^0.23.0
- tree-sitter-java@^0.23.5
- tree-sitter-javascript@^0.23.0
- tree-sitter-php@^0.23.0
- tree-sitter-python@0.23.4
- tree-sitter-ruby@^0.23.1
- tree-sitter-rust@0.23.1
- tree-sitter-typescript@^0.23.2
- uuid@^14.0.0
- @babel/generator@^7.29.7
- @babel/parser@^7.29.7
- @babel/traverse@^7.29.7
- @babel/types@^7.29.7
- @types/busboy@^1.5.4
- @types/cli-progress@^3.11.6
- @types/cors@^2.8.17
- @types/express@^5.0.6
- @types/js-yaml@^4.0.9
- @types/node@^25.6.0
- @types/uuid@^11.0.0
- @vitest/coverage-v8@^4.0.18
- gitnexus-shared@file:../gitnexus-shared
- tsx@^4.0.0
- typescript@^5.4.5
- vitest@^4.0.18
obfuscation 1
- dynamic require()/import() package/vendor/tree-sitter-kotlin/bindings/node/index.js :6
? require(`../../prebuilds/${process.platform}-${process.arch}/tree-sitter-kotlin.node`)
perm:untrusted 1
- untrusted package/web/assets/agent-Dli_x7bU.js :25
,...n)}fetch(...e){return this.call(()=>fetch(...e).then(e=>e.ok?e:Promise.reject(e)))}},xd=class extends Yc{name=`RootListenersTracer`;rootId;config;argOnStart;argOnEnd;argOnError;constructor({config