depwire-cli 0.9.29 → 1.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -1,183 +1,95 @@
1
1
  # Depwire
2
2
 
3
+ <div align="center">
4
+
3
5
  [![npm version](https://img.shields.io/npm/v/depwire-cli.svg?style=flat-square)](https://www.npmjs.com/package/depwire-cli)
4
6
  [![npm downloads](https://img.shields.io/npm/dm/depwire-cli.svg?style=flat-square)](https://www.npmjs.com/package/depwire-cli)
5
- [![depwire MCP server](https://glama.ai/mcp/servers/depwire/depwire/badges/score.svg)](https://glama.ai/mcp/servers/depwire/depwire)
6
- [![License](https://img.shields.io/badge/license-BUSL--1.1-blue.svg?style=flat-square)](LICENSE)
7
+ [![MCP Registry](https://img.shields.io/badge/MCP-registry-blue?style=flat-square)](https://registry.modelcontextprotocol.io/servers/io.github.atef-ataya/depwire)
8
+ [![Glama](https://glama.ai/mcp/servers/depwire/depwire/badges/score.svg)](https://glama.ai/mcp/servers/depwire/depwire)
9
+ [![License](https://img.shields.io/badge/license-BUSL--1.1-orange.svg?style=flat-square)](LICENSE)
7
10
  [![GitHub stars](https://img.shields.io/github/stars/depwire/depwire.svg?style=flat-square)](https://github.com/depwire/depwire/stargazers)
8
- [![GitHub forks](https://img.shields.io/github/forks/depwire/depwire.svg?style=flat-square)](https://github.com/depwire/depwire/network/members)
9
-
10
- ![Depwire - Arc diagram visualization of the Hono framework](./assets/depwire-hero.png)
11
-
12
- **The missing context layer for AI coding assistants.**
13
-
14
- Deterministic dependency graph. 17 MCP tools. Architecture health. What If simulation. Security scanner.
15
11
 
16
- The context layer that turns vibe coding into software engineering.
12
+ </div>
17
13
 
18
- **If Depwire helps you, please [star the repo](https://github.com/depwire/depwire)** it helps this open-source project grow into an enterprise tool.
14
+ **Your AI doesn't know your architecture. Depwire does.**
19
15
 
20
- Depwire analyzes codebases to build a cross-reference graph showing how every file, function, and import connects. It provides:
16
+ Depwire is the infrastructure layer between your AI coding assistant and your codebase. Before your AI touches a single file, Depwire has already mapped every connection, scored every risk, and simulated every change.
21
17
 
22
- - 🎨 **Beautiful arc diagram visualization** — Interactive Harrison Bible-style graphic
23
- - 🤖 **MCP server for AI tools** — Cursor, Claude Desktop get full dependency context
24
- - 📊 **Dependency health score** — 0-100 score across 6 dimensions (coupling, cohesion, circular deps, god files, orphans & dead code, depth)
25
- - 📄 **Auto-generated documentation** — 13 comprehensive documents: architecture, conventions, dependencies, onboarding, file catalog, API surface, error patterns, test coverage, git history, full snapshot, TODO/FIXME inventory, health report, and dead code analysis
26
- - 🔍 **Impact analysis** — "What breaks if I rename this function?" answered precisely
27
- - 🧹 **Dead code detection** — Find symbols that are defined but never referenced, categorized by confidence level
28
- - 👀 **Live updates** — Graph stays current as you edit code
29
- - 🌍 **Multi-language** — TypeScript, JavaScript, Python, Go, Rust, and C
18
+ ![Depwire CLI demo on honojs/hono](./assets/depwire-demo-cli.gif)
30
19
 
31
- ## Installation
20
+ If Depwire saves you from a broken build, [star the repo](https://github.com/depwire/depwire) — it helps this project grow.
32
21
 
33
- ![Installation](./assets/installation.gif)
22
+ ---
34
23
 
35
- ```bash
36
- npm install -g depwire-cli
37
- ```
24
+ ## The problem
38
25
 
39
- Or use directly with `npx`:
40
- ```bash
41
- npx depwire-cli --help
42
- ```
26
+ AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.
43
27
 
44
- ## Telemetry
28
+ You ask Claude to delete a utility file. It deletes it cleanly. Confident. No warnings.
45
29
 
46
- Depwire collects **anonymous usage data** to help prioritize development.
30
+ Then you run the build. 30 files broken.
47
31
 
48
- **What we collect:** Command name, Depwire version, OS, Node.js version
32
+ Claude had no idea. It saw one file. It didn't see the 30 downstream consumers.
49
33
 
50
- **What we never collect:** File paths, code content, repo names, usernames, emails, or any personal data.
34
+ This isn't a model problem. It's a context problem. The AI is flying blind.
51
35
 
52
- **To opt out:**
53
- ```bash
54
- export DEPWIRE_NO_TELEMETRY=1
55
- ```
36
+ ---
56
37
 
57
- We also respect `DO_NOT_TRACK=1`. [Privacy Policy](https://depwire.dev/privacy)
38
+ ## The infrastructure layer
58
39
 
59
- ## Quick Start
40
+ ![Depwire architecture](./assets/architecture.svg)
60
41
 
61
- ### CLI Usage
42
+ Depwire is the context and safety layer for AI-generated code.
62
43
 
63
- ```bash
64
- # Auto-detects project root from current directory
65
- depwire viz
66
- depwire parse
67
- depwire docs
68
- depwire health
69
- depwire dead-code
70
- depwire temporal
71
- depwire whatif
72
- depwire security
44
+ Depwire sits between your AI and your codebase. It builds a complete dependency graph using tree-sitter — deterministic, not probabilistic — and serves it to your AI through 17 MCP tools.
73
45
 
74
- # Or specify a directory explicitly
75
- npx depwire-cli viz ./my-project
76
- npx depwire-cli parse ./my-project
77
- npx depwire-cli dead-code ./my-project
78
- npx depwire-cli temporal ./my-project
46
+ Four guarantees:
79
47
 
80
- # Temporal visualization options
81
- npx depwire-cli temporal --commits 20 --strategy monthly --verbose --stats
48
+ - **Local** everything runs on your machine. No cloud parsing. No data sent anywhere.
49
+ - **Secure** your code never leaves your machine. The security scanner requires no API key.
50
+ - **Token-efficient** — Depwire serves pre-computed graph data. Your AI gets surgical answers, not file dumps. 40% fewer tool calls. 56% fewer file reads.
51
+ - **Deterministic** — tree-sitter parses your code the same way every time. 100% accurate. Not a guess.
82
52
 
83
- # Exclude test files and node_modules
84
- npx depwire-cli parse --exclude "**/*.test.*" "**/node_modules/**"
53
+ ---
85
54
 
86
- # Show detailed parsing progress
87
- npx depwire-cli parse --verbose
55
+ ## Start here
88
56
 
89
- # Export with pretty-printed JSON and statistics
90
- npx depwire-cli parse --pretty --stats
91
-
92
- # Generate codebase documentation
93
- npx depwire-cli docs --verbose --stats
94
-
95
- # Custom output file
96
- npx depwire-cli parse -o my-graph.json
97
- ```
98
-
99
- ### Claude Desktop
100
-
101
- Add to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):
102
-
103
- ```json
104
- {
105
- "mcpServers": {
106
- "depwire": {
107
- "command": "npx",
108
- "args": ["-y", "depwire-cli", "mcp"]
109
- }
110
- }
111
- }
57
+ ```bash
58
+ npm install -g depwire-cli
112
59
  ```
113
60
 
114
- **Depwire auto-detects your project root. No path configuration needed.**
61
+ Three commands to understand any codebase:
115
62
 
116
- Then in chat:
117
- ```
118
- Show me the architecture.
63
+ ```bash
64
+ depwire whatif # know what breaks before you change anything
65
+ depwire security # catch vulnerabilities before AI ships them
66
+ depwire viz # see your entire architecture instantly
119
67
  ```
120
68
 
121
- ### Cursor
122
-
123
- Settings → Features → Experimental → Enable MCP → Add Server:
124
- - Command: `npx`
125
- - Args: `-y depwire-cli mcp`
69
+ ---
126
70
 
127
- **Depwire auto-detects your project root from the current working directory.**
71
+ ## What If simulation
128
72
 
129
- ## Available MCP Tools
130
-
131
- | Tool | What It Does |
132
- |------|-------------|
133
- | `connect_repo` | Connect to any local project or GitHub repo |
134
- | `impact_analysis` | What breaks if you change a symbol? |
135
- | `get_file_context` | Full context — imports, exports, dependents |
136
- | `get_dependencies` | What does a symbol depend on? |
137
- | `get_dependents` | What depends on this symbol? |
138
- | `search_symbols` | Find symbols by name |
139
- | `get_architecture_summary` | High-level project overview |
140
- | `list_files` | List all files with stats |
141
- | `get_symbol_info` | Look up any symbol's details |
142
- | `visualize_graph` | Generate interactive arc diagram visualization |
143
- | `get_project_docs` | Retrieve auto-generated codebase documentation |
144
- | `update_project_docs` | Regenerate documentation on demand |
145
- | `get_health_score` | Get 0-100 dependency health score with recommendations |
146
- | `find_dead_code` | Find dead code — symbols defined but never referenced |
147
- | `get_temporal_graph` | Show how the graph evolved over git history |
148
- | `simulate_change` | Simulate a move/delete/rename/split/merge before touching code. Returns health score delta, broken imports, and affected nodes. Zero file I/O. |
149
- | `security_scan` | Scan for security vulnerabilities with graph-aware severity elevation. No API key required. |
150
-
151
- ## SDK
152
-
153
- depwire-cli exposes a public SDK for programmatic use:
73
+ Know the blast radius before you touch anything.
154
74
 
155
75
  ```bash
156
- npm install depwire-cli
76
+ depwire whatif . --simulate delete --target src/utils/encode.ts
157
77
  ```
158
78
 
159
- ```typescript
160
- import {
161
- parseProject,
162
- buildGraph,
163
- calculateHealthScore,
164
- analyzeDeadCode,
165
- generateDocs,
166
- scanSecurity,
167
- SimulationEngine,
168
- searchSymbols,
169
- getImpact,
170
- getArchitectureSummary,
171
- DepwireSDKVersion
172
- } from 'depwire-cli/sdk';
173
- ```
79
+ Real output on [honojs/hono](https://github.com/honojs/hono) — 352 files, 6,245 symbols:
174
80
 
175
- The SDK is the stable public API surface. All cloud and tooling integrations
176
- should import from `depwire-cli/sdk` — never from internal paths.
81
+ Health Score: 41 41 (+0 unchanged)
82
+ Affected Nodes: 29
83
+ Broken Imports: 30
84
+ • src/utils/jwt/jwt.ts imports decodeBase64Url
85
+ • src/adapter/aws-lambda/handler.ts imports encodeBase64
86
+ • src/utils/basic-auth.ts imports decodeBase64
87
+ [27 more...]
88
+ Removed Edges: 32
177
89
 
178
- ## What If Simulation
90
+ Before touching a single file. Zero file I/O. Pure in-memory simulation.
179
91
 
180
- Simulate architectural changes before touching any code:
92
+ Five operations:
181
93
 
182
94
  ```bash
183
95
  depwire whatif . --simulate delete --target src/utils/encode.ts
@@ -187,633 +99,324 @@ depwire whatif . --simulate split --target src/services/auth.ts --symbols "valid
187
99
  depwire whatif . --simulate merge --target src/utils/helpers.ts --merge-target src/utils/formatters.ts
188
100
  ```
189
101
 
190
- Returns: health score delta, broken imports, affected nodes, circular deps introduced/resolved.
191
- Also available as MCP tool `simulate_change` for AI coding assistants.
102
+ Run without `--simulate` to open the browser UI side-by-side arc diagrams showing current vs simulated state.
192
103
 
193
- ## Security Scanner
104
+ ---
194
105
 
195
- Scan your codebase for security vulnerabilities before AI-generated code ships to production:
106
+ ## Security scanner
107
+
108
+ AI will confidently ship vulnerable code. Depwire stops it before production.
196
109
 
197
110
  ```bash
198
- depwire security . # Full repo scan
199
- depwire security . --target src/auth.ts # Single file
200
- depwire security . --format sarif # GitHub Security tab
201
- depwire security . --fail-on high # CI gate — exit 1 if HIGH+
202
- depwire security . --class injection # Specific check only
111
+ depwire security . # full repo scan
112
+ depwire security . --target src/auth.ts # single file
113
+ depwire security . --format sarif # GitHub Security tab integration
114
+ depwire security . --fail-on high # CI gate — exit 1 if HIGH or above
115
+ depwire security . --class injection # specific check only
203
116
  ```
204
117
 
205
- 10 vulnerability categories:
206
- - Dependency CVEs (npm/pip/cargo/go audit)
207
- - Shell injection + code injection
208
- - Hardcoded secrets (API keys, passwords, private keys)
209
- - Path traversal
210
- - Auth bypass patterns
211
- - Input validation gaps
212
- - Information disclosure
213
- - Cryptography weaknesses
214
- - Frontend XSS (dangerouslySetInnerHTML, localStorage tokens)
215
- - Architecture-level risks (graph-powered severity elevation)
118
+ Real output on honojs/hono:
216
119
 
217
- Graph-aware severity: vulnerabilities reachable from MCP tools or HTTP routes are automatically elevated. Available as MCP tool `security_scan` and via `depwire-cli/sdk`.
120
+ 6 Critical 19 High 14 Medium 1 Low
218
121
 
219
- ## Why Depwire
220
-
221
- | Feature | Depwire | Standard RAG (Fuzzy Search) | LLM Native Scanning |
222
- |---------|---------|----------------------------|---------------------|
223
- | Logic | Deterministic Graph | Probabilistic Match | Brute Force Reading |
224
- | Precision | 100% (Tree-sitter AST) | ~70% (Embedding match) | Varies — hallucination prone |
225
- | Refactor Safety | High — traces full call chains | Low — misses indirect refs | Zero — blind edits |
226
- | Token Cost | Ultra-low — surgical reads | High — context stuffing | Extreme — scans everything |
227
- | Circular Detection | Built-in | Not possible | Occasional |
228
- | What If Simulation | Before touching code | Not possible | Not possible |
229
- | Architecture Health Score | 0-100 with dimensions | Not possible | Not possible |
230
-
231
- ## GitHub Action — PR Impact Analysis
232
-
233
- Depwire integrates directly into your CI/CD pipeline via the [depwire-action](https://github.com/depwire/depwire-action) GitHub Action.
234
-
235
- On every pull request, it automatically:
236
- - Analyzes which symbols and files are affected by the changes
237
- - Posts a dependency impact report as a PR comment
238
- - Shows added, removed, and changed dependencies
239
- - Helps reviewers understand the architectural blast radius before merging
240
-
241
- ### Usage
242
-
243
- Add this to `.github/workflows/depwire.yml`:
244
- ```yaml
245
- name: Depwire PR Impact
246
- on:
247
- pull_request:
248
- branches: [main]
249
-
250
- jobs:
251
- impact:
252
- runs-on: ubuntu-latest
253
- steps:
254
- - uses: actions/checkout@v4
255
- with:
256
- fetch-depth: 0
257
- - uses: depwire/depwire-action@v1
258
- with:
259
- github-token: ${{ secrets.GITHUB_TOKEN }}
260
- ```
122
+ 10 check categories — dependency CVEs, shell injection, hardcoded secrets, path traversal, auth bypass, input validation, information disclosure, cryptography weaknesses, frontend XSS, and architecture-level risks.
261
123
 
262
- ### Links
263
- - [GitHub Marketplace](https://github.com/marketplace/actions/depwire-pr-impact)
264
- - [depwire-action repository](https://github.com/depwire/depwire-action)
124
+ Graph-aware severity: a medium shell injection reachable from an MCP tool or HTTP route is automatically elevated to critical. This is what no generic SAST tool can replicate — Depwire knows your architecture, so it knows what's actually reachable.
265
125
 
266
- ## Supported Languages
126
+ Available as MCP tool `security_scan` and via `depwire-cli/sdk`.
267
127
 
268
- | Language | Extensions | Features |
269
- |----------|-----------|----------|
270
- | TypeScript | `.ts`, `.tsx` | Full support — imports, classes, interfaces, types |
271
- | JavaScript | `.js`, `.jsx`, `.mjs`, `.cjs` | ES modules, CommonJS require(), JSX components |
272
- | Python | `.py` | Imports, classes, decorators, inheritance |
273
- | Go | `.go` | go.mod resolution, structs, interfaces, methods |
274
- | Rust | `.rs` | Functions, structs, enums, traits, impl blocks, use declarations |
275
- | C | `.c`, `.h` | Functions, structs, enums, typedefs, macros, #include directives |
128
+ ---
276
129
 
277
130
  ## Visualization
278
131
 
279
- ![Depwire CLI](./assets/viz-command.gif)
280
-
281
- ![Interactive Arc Diagram](./assets/graph.gif)
132
+ ![Depwire arc diagram visualization](./assets/depwire-demo-viz.gif)
282
133
 
283
134
  ```bash
284
- # Auto-detects project root (run from anywhere in your project)
285
135
  depwire viz
286
-
287
- # Or specify a directory explicitly
288
- depwire viz ./my-project
289
-
290
- # Custom port
291
- depwire viz --port 8080
292
-
293
- # Exclude test files from visualization
294
- depwire viz --exclude "**/*.test.*"
295
-
296
- # Verbose mode with detailed parsing logs
297
- depwire viz --verbose
298
-
299
- # Don't auto-open browser
300
- depwire viz --no-open
301
136
  ```
302
137
 
303
- Opens an interactive arc diagram in your browser:
304
- - Rainbow-colored arcs showing cross-file dependencies
305
- - Hover to explore connections
306
- - Click to filter by file
307
- - Search by filename
308
- - **Live refresh when files change** — Edit code and see the graph update in real-time
309
- - Export as SVG or PNG
310
- - **Port collision handling** — Automatically finds an available port if default is in use
138
+ Interactive arc diagram of your entire codebase. Every file, every connection, every dependency visible at once. Hover to inspect. Click to filter. Export as PNG or SVG.
311
139
 
312
- ## Temporal Graph
140
+ ---
313
141
 
314
- Visualize how your codebase architecture evolved over git history. Scrub through time with an interactive timeline slider.
142
+ ## Temporal graph
315
143
 
316
- ![Depwire Temporal Graph](assets/depwire-temporal-hono.gif)
144
+ ![Depwire temporal graph on honojs/hono](./assets/depwire-temporal-hono.gif)
317
145
 
318
146
  ```bash
319
- # Auto-detects project root
320
147
  depwire temporal
321
-
322
- # Sample 20 commits with monthly snapshots
323
- depwire temporal --commits 20 --strategy monthly
324
-
325
- # Verbose mode with detailed progress
326
- depwire temporal --verbose --stats
327
-
328
- # Custom port
329
- depwire temporal --port 3335
330
148
  ```
331
149
 
332
- **Options:**
333
- - `--commits <number>` — Number of commits to sample (default: 20)
334
- - `--strategy <type>` — Sampling strategy: `even`, `weekly`, `monthly` (default: `even`)
335
- - `-p, --port <number>` — Server port (default: 3334)
336
- - `--output <path>` — Save snapshots to custom path (default: `.depwire/temporal/`)
337
- - `--verbose` — Show progress for each commit being parsed
338
- - `--stats` — Show summary statistics at end
339
-
340
- Opens an interactive temporal visualization in your browser:
341
- - Timeline slider showing all sampled commits
342
- - Arc diagram morphing between snapshots
343
- - Play/pause animation with speed controls (0.5×, 1×, 2×)
344
- - Statistics panel with growth deltas
345
- - Evolution chart tracking files/symbols/edges over time
346
- - Auto-zoom to fit all arcs on snapshot change
347
- - Search to highlight specific files across time
348
-
349
- ## 🪦 Dead Code Detection
350
-
351
- Find unused symbols across your codebase before they become technical debt.
352
-
353
- - Detects symbols with zero incoming references (never called, never imported)
354
- - Confidence scoring: **high** (definitely dead), **medium** (probably dead), **low** (might be dead)
355
- - Smart exclusion rules — ignores entry points, test files, barrel files, and config files to reduce false positives
356
- - Filter by confidence level, export as JSON for CI pipelines
357
- - Integrated into the health score (orphans dimension)
358
- - New MCP tool: `find_dead_code` — AI assistants can query dead code directly
359
- - New document generator: `DEAD_CODE.md` — auto-generated dead code report
360
-
361
- ```bash
362
- depwire dead-code
363
- depwire dead-code --confidence high
364
- depwire dead-code --stats
365
- depwire dead-code --json
366
- ```
367
-
368
- **Confidence Levels:**
369
- - 🔴 **High confidence (definitely dead)**: Not exported with zero references, or exported but never used
370
- - 🟡 **Medium confidence (probably dead)**: Exported from barrel files with zero dependents, or only used in test files
371
- - ⚪ **Low confidence (might be dead)**: Exported from package entry points, types with zero dependents, or in dynamic-use directories (routes, middleware, etc.)
372
-
373
- The dead code detector automatically excludes:
374
- - Entry point files (index.ts, main.ts, server.ts, etc.)
375
- - Test files (*.test.*, *.spec.*, __tests__/)
376
- - Config files (*.config.*)
377
- - Type declarations (*.d.ts)
378
- - Framework auto-loaded directories (pages/, routes/, middleware/, commands/)
150
+ Watch your architecture evolve over git history. Timeline slider scrubs through commits — the arc diagram morphs as your codebase grew, coupled, and refactored. Nobody else does this.
379
151
 
380
- ## How It Works
152
+ ---
381
153
 
382
- 1. **Parser** — tree-sitter extracts every symbol and reference
383
- 2. **Graph** — graphology builds an in-memory dependency graph
384
- 3. **MCP** — AI tools query the graph for context-aware answers
385
- 4. **Viz** — D3.js renders the graph as an interactive arc diagram
154
+ ## All commands
386
155
 
387
- ## CLI Reference
156
+ | Command | Description |
157
+ |---------|-------------|
158
+ | `depwire viz` | Interactive arc diagram in browser |
159
+ | `depwire whatif` | Simulate changes before touching code |
160
+ | `depwire security` | Scan for vulnerabilities — graph-aware severity |
161
+ | `depwire health` | 0-100 architecture health score across 6 dimensions |
162
+ | `depwire dead-code` | Find unused symbols with confidence scoring |
163
+ | `depwire docs` | Generate 13 architecture documents |
164
+ | `depwire temporal` | Visualize architecture evolution over git history |
165
+ | `depwire parse` | Parse and export dependency graph as JSON |
166
+ | `depwire mcp` | Start MCP server for AI coding assistants |
388
167
 
389
- ### `depwire parse [directory]`
168
+ All commands auto-detect your project root. No path configuration needed.
390
169
 
391
- Parse a project and export the dependency graph as JSON.
170
+ ---
392
171
 
393
- **Directory argument is optional** Depwire auto-detects your project root by looking for `package.json`, `tsconfig.json`, `go.mod`, `pyproject.toml`, `setup.py`, or `.git`.
172
+ ## MCP serverAI integration
394
173
 
395
- **Options:**
396
- - `-o, --output <path>` — Output file path (default: `depwire-output.json`)
397
- - `--exclude <patterns...>` — Glob patterns to exclude (e.g., `"**/*.test.*" "dist/**"`)
398
- - `--verbose` — Show detailed parsing progress (logs each file as it's parsed)
399
- - `--pretty` — Pretty-print JSON output with indentation
400
- - `--stats` — Print summary statistics (file count, symbol count, edges, timing)
401
-
402
- **Examples:**
403
- ```bash
404
- # Auto-detect project root
405
- depwire parse
406
-
407
- # Explicit directory
408
- depwire parse ./src
409
-
410
- # Exclude test files and build outputs
411
- depwire parse --exclude "**/*.test.*" "**/*.spec.*" "dist/**" "build/**"
412
-
413
- # Full verbosity with stats
414
- depwire parse --verbose --stats --pretty -o graph.json
415
- ```
174
+ Connect Depwire to any MCP-compatible AI tool. Your AI gets 17 tools it can call autonomously.
416
175
 
417
- ### `depwire viz [directory]`
176
+ **Claude Desktop** add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
418
177
 
419
- Start visualization server and open arc diagram in browser.
420
-
421
- **Directory argument is optional** — Auto-detects project root.
422
-
423
- **Options:**
424
- - `--port <number>` — Port number (default: 3456, auto-increments if in use)
425
- - `--exclude <patterns...>` — Glob patterns to exclude
426
- - `--verbose` — Show detailed parsing progress
427
- - `--no-open` — Don't automatically open browser
428
-
429
- **Examples:**
430
- ```bash
431
- # Auto-detect and visualize
432
- depwire viz
433
-
434
- # Explicit directory
435
- depwire viz ./src
436
-
437
- # Custom port without auto-open
438
- depwire viz --port 8080 --no-open
439
-
440
- # Exclude test files with verbose logging
441
- depwire viz --exclude "**/*.test.*" --verbose
178
+ ```json
179
+ {
180
+ "mcpServers": {
181
+ "depwire": {
182
+ "command": "npx",
183
+ "args": ["-y", "depwire-cli", "mcp"]
184
+ }
185
+ }
186
+ }
442
187
  ```
443
188
 
444
- ### `depwire mcp [directory]`
445
-
446
- Start MCP server for AI tool integration (Cursor, Claude Desktop).
447
-
448
- **Directory argument is optional** — Auto-detects project root and connects automatically.
449
-
450
- **Examples:**
451
- ```bash
452
- # Auto-detect and connect (recommended)
453
- depwire mcp
454
-
455
- # Explicit directory
456
- depwire mcp /path/to/project
457
- ```
189
+ **Cursor** Settings → Features → Experimental → Enable MCP → Add Server:
190
+ - Command: `npx`
191
+ - Args: `-y depwire-cli mcp`
458
192
 
459
- ### `depwire docs [directory]`
193
+ ![Claude Desktop with Depwire MCP](./assets/claude.gif)
460
194
 
461
- Generate comprehensive codebase documentation from your dependency graph.
195
+ ### 17 MCP tools
462
196
 
463
- **Directory argument is optional** — Auto-detects project root.
197
+ | Tool | Description |
198
+ |------|-------------|
199
+ | `connect_repo` | Connect to any local project or GitHub repo |
200
+ | `get_architecture_summary` | High-level project overview |
201
+ | `get_file_context` | Full context — imports, exports, dependents. Includes cross-language connections. |
202
+ | `get_dependencies` | What does a symbol depend on? |
203
+ | `get_dependents` | What depends on this symbol? |
204
+ | `get_symbol_info` | Look up any symbol's details |
205
+ | `search_symbols` | Find symbols by name across the codebase |
206
+ | `list_files` | List all files with stats |
207
+ | `impact_analysis` | What breaks if you change a symbol? Cross-language edges included. |
208
+ | `visualize_graph` | Generate interactive arc diagram |
209
+ | `get_health_score` | 0-100 health score with recommendations |
210
+ | `find_dead_code` | Symbols defined but never referenced |
211
+ | `get_project_docs` | Retrieve auto-generated codebase documentation |
212
+ | `update_project_docs` | Regenerate documentation on demand |
213
+ | `get_temporal_graph` | Architecture evolution over git history |
214
+ | `simulate_change` | Simulate move/delete/rename/split/merge before touching code. Returns health delta, broken imports, affected nodes. Cross-language edges included. |
215
+ | `security_scan` | Scan for vulnerabilities with graph-aware severity elevation. No API key required. |
464
216
 
465
- **Options:**
466
- - `--output <path>` — Output directory (default: `.depwire/` inside project)
467
- - `--format <type>` — Output format: `markdown` or `json` (default: `markdown`)
468
- - `--include <docs...>` — Comma-separated list of docs to generate (default: `all`)
469
- - Values: `architecture`, `conventions`, `dependencies`, `onboarding`, `files`, `api_surface`, `errors`, `tests`, `history`, `current`, `status`, `health`, `all`
470
- - `--update` — Regenerate existing documentation
471
- - `--only <docs...>` — Used with `--update`, regenerate only specific docs
472
- - `--verbose` — Show generation progress
473
- - `--stats` — Show generation statistics
474
- - `--gitignore` — Add `.depwire/` to `.gitignore` automatically
475
- - `--no-gitignore` — Don't modify `.gitignore`
217
+ ---
476
218
 
477
- **Examples:**
478
- ```bash
479
- # Auto-detect and generate all docs
480
- depwire docs
219
+ ## Cross-language edge detection
481
220
 
482
- # Explicit directory
483
- depwire docs ./my-project
221
+ Depwire detects connections between files written in different languages.
484
222
 
485
- # Show generation progress and stats
486
- depwire docs --verbose --stats
223
+ A TypeScript `fetch('/api/users')` call matched to a Python `@app.get('/api/users')` route definition — that's a cross-language edge. Delete the Python route and Depwire shows the TypeScript callers as broken.
487
224
 
488
- # Regenerate existing docs
489
- depwire docs --update
225
+ Supported patterns:
226
+ - REST API edges — fetch/axios calls matched to Express, FastAPI, Flask, Gin route definitions
227
+ - Subprocess edges — execSync/subprocess.run calls matched to target files in the graph
490
228
 
491
- # Generate specific docs only
492
- depwire docs --include architecture,dependencies
229
+ These edges flow through every existing feature: What If simulation, impact analysis, security scanner, and arc diagram visualization.
493
230
 
494
- # Custom output directory
495
- depwire docs --output ./docs
231
+ ---
496
232
 
497
- # Regenerate only conventions doc
498
- depwire docs --update --only conventions
499
- ```
233
+ ## Architecture health score
500
234
 
501
- **Generated Documents (13 total):**
502
-
503
- | Document | What It Contains |
504
- |----------|------------------|
505
- | `ARCHITECTURE.md` | Module structure, entry points, hub files, layer analysis, circular dependencies |
506
- | `CONVENTIONS.md` | Naming patterns, import/export style, detected design patterns |
507
- | `DEPENDENCIES.md` | Module dependency matrix, high-impact symbols, longest dependency chains |
508
- | `ONBOARDING.md` | Reading order (Foundation/Core/Entry Points), module map, key concepts, high-impact file warnings |
509
- | `FILES.md` | Complete file catalog with stats, orphan files, hub files |
510
- | `API_SURFACE.md` | All exported symbols (public API), most-used exports, unused exports |
511
- | `ERRORS.md` | Error handling patterns, error-prone files, custom error classes |
512
- | `TESTS.md` | Test file inventory, test-to-source mapping, untested files |
513
- | `HISTORY.md` | Git history + graph analysis, file churn, feature timeline |
514
- | `CURRENT.md` | Complete codebase snapshot (every file, symbol, connection) |
515
- | `STATUS.md` | TODO/FIXME/HACK inventory with priority matrix |
516
- | `HEALTH.md` | Dependency health score (0-100) across 6 dimensions with recommendations |
517
- | `DEAD_CODE.md` | Unused symbols by confidence level (high/medium/low) with smart exclusions |
518
-
519
- Documents are stored in `.depwire/` with `metadata.json` tracking generation timestamps for staleness detection.
520
-
521
- ### `depwire health [directory]`
522
-
523
- Analyze dependency architecture health and get a 0-100 score across 6 quality dimensions.
524
-
525
- **Directory argument is optional** — Auto-detects project root.
526
-
527
- **Options:**
528
- - `--json` — Output as JSON (for CI/automation)
529
- - `--verbose` — Show detailed per-dimension breakdown
530
-
531
- **Dimensions Measured:**
532
- 1. **Coupling (25%)** — How tightly connected are modules? Lower coupling = easier changes
533
- 2. **Cohesion (20%)** — Do files in the same directory relate? Higher cohesion = better organization
534
- 3. **Circular Dependencies (20%)** — Files depending on each other in cycles
535
- 4. **God Files (15%)** — Files with abnormally high connection counts
536
- 5. **Orphan Files (10%)** — Files with zero connections (dead code?)
537
- 6. **Dependency Depth (10%)** — How deep are the dependency chains?
538
-
539
- **Examples:**
540
235
  ```bash
541
- # Auto-detect and analyze
542
- depwire health
543
-
544
- # Explicit directory
545
- depwire health ./my-project
546
-
547
- # Detailed breakdown
548
- depwire health --verbose
549
-
550
- # JSON output for CI
551
- depwire health --json
236
+ depwire health .
552
237
  ```
553
238
 
554
- **Output:**
555
- - Overall score (0-100) with letter grade (A-F)
556
- - Per-dimension scores and grades
557
- - Actionable recommendations
558
- - Trend indicator (↑/↓ from last check)
559
-
560
- Health history is stored in `.depwire/health-history.json` (last 50 checks).
239
+ Overall: 68/100 (Grade: D)
240
+ Coupling 70 C
241
+ Cohesion 80 B
242
+ Circular Dependencies 100 A
243
+ God Files 40 F
244
+ Orphans & Dead Code 20 F
245
+ Dependency Depth 60 D
561
246
 
562
- ### `depwire dead-code [directory]`
247
+ 6 dimensions. Letter grades. Actionable recommendations. Trend tracking across runs.
563
248
 
564
- Detect unused symbols across your codebase with confidence-based classification.
249
+ ---
565
250
 
566
- **Directory argument is optional** — Auto-detects project root.
567
-
568
- **Options:**
569
- - `--confidence <level>` — Minimum confidence level to show: `high`, `medium`, `low` (default: `medium`)
570
- - `--include-low` — Shortcut for `--confidence low`
571
- - `--verbose` — Show detailed info for each dead symbol (file, line, kind, reason)
572
- - `--stats` — Show summary statistics
573
- - `--include-tests` — Include test files in analysis (excluded by default)
574
- - `--json` — Output as JSON for CI/automation
251
+ ## SDK
575
252
 
576
- **Confidence Levels:**
577
- - 🔴 **High confidence (definitely dead)**: Not exported with zero references, or exported but never used
578
- - 🟡 **Medium confidence (probably dead)**: Exported from barrel files with zero dependents, or only used in test files
579
- - ⚪ **Low confidence (might be dead)**: Exported from package entry points, types with zero dependents, or in dynamic-use directories (routes, middleware, etc.)
253
+ Depwire exposes a stable public API for programmatic use and CI pipelines:
580
254
 
581
- **Examples:**
582
255
  ```bash
583
- # Analyze dead code (default: medium confidence and above)
584
- depwire dead-code
585
-
586
- # Show only high-confidence dead code
587
- depwire dead-code --confidence high
588
-
589
- # Show all potential dead code (including low confidence)
590
- depwire dead-code --confidence low
591
- # Or use shortcut
592
- depwire dead-code --include-low
593
-
594
- # Detailed analysis with reasons and statistics
595
- depwire dead-code --verbose --stats
596
-
597
- # Include test files in analysis (excluded by default)
598
- depwire dead-code --include-tests
599
-
600
- # JSON output for CI/automation
601
- depwire dead-code --json
256
+ npm install depwire-cli
602
257
  ```
603
258
 
604
- **Automatic Exclusions:**
605
- The dead code detector automatically excludes:
606
- - Entry point files (index.ts, main.ts, server.ts, etc.)
607
- - Test files (*.test.*, *.spec.*, __tests__/)
608
- - Config files (*.config.*)
609
- - Type declarations (*.d.ts)
610
- - Framework auto-loaded directories (pages/, routes/, middleware/, commands/)
611
-
612
- ### `depwire temporal [directory]`
613
-
614
- Visualize how the dependency graph evolved over git history.
615
-
616
- **Directory argument is optional** — Auto-detects project root.
617
-
618
- **Options:**
619
- - `--commits <number>` — Number of commits to sample (default: 20)
620
- - `--strategy <type>` — Sampling strategy: `even` (every Nth), `weekly`, `monthly` (default: `even`)
621
- - `-p, --port <number>` — Server port (default: 3334)
622
- - `--output <path>` — Save snapshots to custom path (default: `.depwire/temporal/`)
623
- - `--verbose` — Show progress for each commit being parsed
624
- - `--stats` — Show summary statistics at end
625
-
626
- **Examples:**
627
- ```bash
628
- # Auto-detect and analyze 20 commits
629
- depwire temporal
630
-
631
- # Sample 50 commits with monthly snapshots
632
- depwire temporal --commits 50 --strategy monthly
633
-
634
- # Verbose mode with stats
635
- depwire temporal --verbose --stats
636
-
637
- # Custom output directory
638
- depwire temporal --output ./temp-snapshots
259
+ ```typescript
260
+ import {
261
+ parseProject,
262
+ buildGraph,
263
+ calculateHealthScore,
264
+ analyzeDeadCode,
265
+ generateDocs,
266
+ scanSecurity,
267
+ SimulationEngine,
268
+ detectCrossLanguageEdges,
269
+ searchSymbols,
270
+ getImpact,
271
+ getArchitectureSummary,
272
+ DepwireSDKVersion
273
+ } from 'depwire-cli/sdk';
639
274
  ```
640
275
 
641
- **Output:**
642
- - Interactive browser visualization at `http://127.0.0.1:3334`
643
- - Timeline slider to scrub through git history
644
- - Arc diagram morphing between snapshots
645
- - Growth statistics showing files/symbols/edges evolution
646
- - Auto-zoom to fit full diagram on each snapshot change
647
-
648
- Snapshots are cached in `.depwire/temporal/` for fast re-rendering.
649
-
650
- ### `depwire whatif [directory]`
276
+ The SDK is the stable public API surface. All integrations should import from `depwire-cli/sdk` — never from internal paths.
651
277
 
652
- Simulate architectural changes before touching code.
278
+ ---
653
279
 
654
- **Directory argument is optional** — Auto-detects project root.
655
-
656
- **Options:**
657
- - `--simulate <action>` — Action to simulate: `move`, `delete`, `rename`, `split`, `merge`
658
- - `--target <file>` — File to apply the action to
659
- - `--destination <file>` — Destination path (for move action)
660
- - `--new-name <name>` — New name (for rename action)
661
- - `--source <file>` — Source file (for merge action)
662
- - `--new-file <file>` — New file path (for split action)
663
- - `--symbols <symbols>` — Comma-separated symbol names (for split action)
664
-
665
- **Examples:**
666
- ```bash
667
- # What breaks if I delete this file?
668
- depwire whatif --simulate delete --target src/auth/service.ts
280
+ ## Why Depwire
669
281
 
670
- # What happens if I move this module?
671
- depwire whatif --simulate move --target src/utils.ts --destination src/core/utils.ts
282
+ | | Depwire | RAG-based tools | LLM scanning |
283
+ |--|---------|-----------------|--------------|
284
+ | Approach | Deterministic graph | Probabilistic match | Brute force |
285
+ | Accuracy | 100% — tree-sitter AST | ~70% — embedding match | Varies |
286
+ | Refactor safety | Full call chain tracing | Misses indirect refs | Blind edits |
287
+ | Token cost | Ultra-low — surgical reads | High — context stuffing | Extreme |
288
+ | Cross-language | REST + subprocess edges | None | None |
289
+ | Security scanner | Graph-aware severity | None | None |
290
+ | What If simulation | Before touching code | None | None |
291
+ | Runs locally | Always | Varies | Never |
672
292
 
673
- # Rename a file
674
- depwire whatif --simulate rename --target src/router.ts --new-name routes.ts
293
+ ---
675
294
 
676
- # Split symbols into a new file
677
- depwire whatif --simulate split --target src/utils.ts --new-file src/helpers.ts --symbols "formatDate,parseUrl"
295
+ ## Language support
678
296
 
679
- # Merge two files
680
- depwire whatif --simulate merge --target src/auth.ts --source src/login.ts
681
- ```
297
+ TypeScript, JavaScript, Python, Go, Rust, C, C# with cross-language edge detection between all supported languages.
682
298
 
683
- **Output:**
684
- - Health score delta (before/after with improvement indicator)
685
- - Broken imports with file and symbol details
686
- - Affected nodes count
687
- - Circular dependencies introduced or resolved
688
- - Added and removed edge counts
299
+ ---
689
300
 
690
- ### Error Handling
301
+ ## GitHub Action — PR Impact Analysis
691
302
 
692
- Depwire gracefully handles parse errors:
693
- - **Malformed files** — Skipped with warning, parsing continues
694
- - **Large files** — Files over 1MB are automatically skipped
695
- - **Port collisions** — Auto-increments to next available port (3456 → 3457 → 3458...)
696
- - **Protected paths** — Blocks access to sensitive directories (.ssh, .aws, /etc)
303
+ Depwire integrates into your CI/CD pipeline via the [depwire-action](https://github.com/depwire/depwire-action) GitHub Action.
697
304
 
305
+ On every pull request it automatically posts a dependency impact report — which symbols changed, what breaks, health score before and after. Code reviewers see the architectural blast radius before merging.
698
306
 
699
- ## Example Workflows
307
+ Add to `.github/workflows/depwire.yml`:
700
308
 
701
- ### Refactoring with AI
309
+ ```yaml
310
+ name: Depwire PR Impact
311
+ on:
312
+ pull_request:
313
+ branches: [main]
702
314
 
703
- ![Claude Desktop with Depwire MCP](./assets/claude.gif)
315
+ permissions:
316
+ contents: read
317
+ pull-requests: write
704
318
 
319
+ jobs:
320
+ depwire:
321
+ runs-on: ubuntu-latest
322
+ steps:
323
+ - uses: actions/checkout@v4
324
+ with:
325
+ fetch-depth: 0
326
+ - uses: actions/setup-node@v4
327
+ with:
328
+ node-version: '20'
329
+ - uses: depwire/depwire-action@v1
330
+ with:
331
+ github-token: ${{ secrets.GITHUB_TOKEN }}
705
332
  ```
706
- # In Claude Desktop or Cursor with Depwire MCP:
707
333
 
708
- "Analyze the impact of renaming UserService to UserRepository"
334
+ Block PRs that hurt your architecture:
709
335
 
710
- # Depwire responds with:
711
- # - All files that import UserService
712
- # - All call sites
713
- # - All type references
714
- # - Suggested find-and-replace strategy
336
+ ```yaml
337
+ - uses: depwire/depwire-action@v1
338
+ with:
339
+ github-token: ${{ secrets.GITHUB_TOKEN }}
340
+ fail-on-score-drop: 5
715
341
  ```
716
342
 
717
- ### Understanding a New Codebase
343
+ [GitHub Marketplace](https://github.com/marketplace/actions/depwire-pr-impact) [depwire-action repo](https://github.com/depwire/depwire-action)
718
344
 
719
- ```
720
- "Show me the architecture summary"
345
+ ---
721
346
 
722
- # Depwire responds with:
723
- # - Language breakdown
724
- # - Module/package structure
725
- # - Most-connected files (architectural hubs)
726
- # - Entry points
727
- ```
347
+ ## Cloud dashboard
728
348
 
729
- ### Pre-Commit Impact Check
349
+ [app.depwire.dev](https://app.depwire.dev) full dependency graph, health score, dead code report, and AI codebase chat in the browser. No local setup required.
730
350
 
731
- ```bash
732
- # Check what your changes affect before committing
733
- depwire viz
734
- # Review the arc diagram — red arcs show files you touched
735
- ```
351
+ - Free for public repos
352
+ - Pro ($19/month) unlimited repos, private repo support, AI codebase chat
736
353
 
737
- ## Security
354
+ ---
738
355
 
739
- Depwire is **read-only** — it never writes to, modifies, or executes your code.
356
+ ## Roadmap
740
357
 
741
- - Parses source files with tree-sitter (the same parser used by VS Code and Zed)
358
+ **Shipped**
359
+ - Arc diagram visualization
360
+ - 17 MCP tools
361
+ - Multi-language support (TypeScript, JavaScript, Python, Go, Rust, C, C#)
362
+ - Architecture health score
363
+ - Dead code detection
364
+ - Temporal graph
365
+ - What If simulation — CLI + browser UI
366
+ - Security scanner — graph-aware severity elevation
367
+ - Cross-language edge detection — REST API + subprocess
368
+ - Public SDK — `depwire-cli/sdk`
369
+ - Cloud dashboard — app.depwire.dev
370
+ - PR Impact GitHub Action
371
+
372
+ **Coming next**
373
+ - C# / .NET language support
374
+ - AI-suggested refactors
375
+ - VSCode extension
376
+ - Natural language architecture queries
377
+
378
+ ---
379
+
380
+ ## Security posture
381
+
382
+ Depwire is read-only. It never writes to, modifies, or executes your code.
383
+
384
+ - Parses with tree-sitter — the same parser used by VS Code and Zed
742
385
  - Visualization server binds to localhost only
743
- - No data leaves your machine — everything runs locally
744
- - Blocks access to sensitive system directories (.ssh, .aws, /etc)
386
+ - No data leaves your machine
387
+ - Blocks access to sensitive system directories
745
388
  - npm packages published with provenance verification
746
389
 
747
390
  See [SECURITY.md](SECURITY.md) for full details.
748
391
 
749
- ## Roadmap
750
-
751
- ### ✅ Shipped
752
- - [x] Arc diagram visualization
753
- - [x] MCP server (17 tools)
754
- - [x] Multi-language support (TypeScript, JavaScript, Python, Go, Rust, C)
755
- - [x] File watching + live refresh
756
- - [x] Auto-generated documentation (13 documents)
757
- - [x] Dependency health score (0-100)
758
- - [x] Dead code detection with confidence scoring
759
- - [x] Temporal graph — watch your architecture evolve over git history
760
- - [x] PR Impact GitHub Action (depwire-action v1.0.0)
761
- - [x] Auto-detect project root (no path needed)
762
- - [x] WASM migration (Windows support)
763
- - [x] Cloud dashboard — [app.depwire.dev](https://app.depwire.dev)
764
- - [x] What If simulation — simulate refactors before touching code
765
- - [x] Security scanner — deterministic vulnerability detection with graph-aware severity
766
-
767
- ### Coming Next
768
- - [ ] New language support (Java, C++, Ruby — community requested)
769
- - [ ] Cross-language edge detection (API routes ↔ frontend calls)
770
- - [ ] AI-suggested refactors
771
- - [ ] Natural language architecture queries
772
- - [ ] VSCode extension
773
-
774
- ## Cloud Dashboard
775
-
776
- Prefer a browser interface? [app.depwire.dev](https://app.depwire.dev) gives you the full dependency graph, health score, dead code report, and AI codebase chat — without any local setup. Free tier available.
777
-
778
- - **Free** for public repos
779
- - **Pro** ($19/month) — unlimited repos + private repo support
392
+ ---
780
393
 
781
394
  ## Contributing
782
395
 
783
- Contributions welcome! Please note:
784
-
785
396
  1. Fork the repository
786
397
  2. Create a feature branch
787
398
  3. Add tests for new functionality
788
399
  4. Submit a pull request
789
400
  5. Sign the CLA (handled automatically on your first PR)
790
401
 
791
- All contributors must sign the Contributor License Agreement before their PR can be merged.
402
+ ---
792
403
 
793
404
  ## Author
794
405
 
795
406
  **Atef Ataya** — AI architect, author, and creator of Depwire.
796
407
 
797
- - 🎥 [YouTube](https://www.youtube.com/@atefataya) — 600K+ subscribers covering AI agents, MCP, and LLMs
798
- - 📖 [The Architect's Playbook: 5 Pillars](https://www.amazon.com/dp/B0GCHNW2W8) — Best practices for AI agent architecture
799
- - 💼 [LinkedIn](https://www.linkedin.com/in/atefataya/)
408
+ - [YouTube](https://www.youtube.com/@atefataya) — 600K+ subscribers covering AI agents, MCP, and LLMs
409
+ - [The Architect's Playbook: 5 Pillars](https://www.amazon.com/dp/B0GCHNW2W8)
410
+ - [LinkedIn](https://www.linkedin.com/in/atefataya/)
800
411
 
801
- ## License
802
-
803
- Depwire is licensed under the [Business Source License 1.1](LICENSE).
412
+ ---
804
413
 
805
- - **Use it freely** for personal projects, internal company use, and development
806
- - **Cannot** be offered as a hosted/managed service to third parties
807
- - **Converts** to Apache 2.0 on February 25, 2029
414
+ ## License
808
415
 
809
- For commercial licensing inquiries: atef@depwire.dev
416
+ [Business Source License 1.1](LICENSE) — free for personal and internal company use. Converts to Apache 2.0 on February 25, 2029.
810
417
 
811
- ## Credits
418
+ Commercial licensing: atef@depwire.dev
812
419
 
813
- Built by [ATEF ATAYA LLC](https://depwire.dev)
420
+ ---
814
421
 
815
- Powered by:
816
- - [tree-sitter](https://tree-sitter.github.io/tree-sitter/) — Fast, reliable parsing
817
- - [graphology](https://graphology.github.io/) — Powerful graph data structure
818
- - [D3.js](https://d3js.org/) — Data visualization
819
- - [Model Context Protocol](https://modelcontextprotocol.io/) — AI tool integration
422
+ Built with [tree-sitter](https://tree-sitter.github.io/tree-sitter/), [graphology](https://graphology.github.io/), [D3.js](https://d3js.org/), and the [Model Context Protocol](https://modelcontextprotocol.io/).