depwire-cli 0.9.29 → 1.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +258 -655
- package/dist/{chunk-FUIZQCYB.js → chunk-5BQLGAUL.js} +6 -6
- package/dist/{chunk-WUSXCZXA.js → chunk-IYKS66CG.js} +763 -156
- package/dist/index.js +4 -4
- package/dist/mcpb-entry.js +2 -2
- package/dist/parser/grammars/tree-sitter-c_sharp.wasm +0 -0
- package/dist/sdk.js +1 -1
- package/package.json +2 -1
package/README.md
CHANGED
|
@@ -1,183 +1,95 @@
|
|
|
1
1
|
# Depwire
|
|
2
2
|
|
|
3
|
+
<div align="center">
|
|
4
|
+
|
|
3
5
|
[](https://www.npmjs.com/package/depwire-cli)
|
|
4
6
|
[](https://www.npmjs.com/package/depwire-cli)
|
|
5
|
-
[](https://registry.modelcontextprotocol.io/servers/io.github.atef-ataya/depwire)
|
|
8
|
+
[](https://glama.ai/mcp/servers/depwire/depwire)
|
|
9
|
+
[](LICENSE)
|
|
7
10
|
[](https://github.com/depwire/depwire/stargazers)
|
|
8
|
-
[](https://github.com/depwire/depwire/network/members)
|
|
9
|
-
|
|
10
|
-

|
|
11
|
-
|
|
12
|
-
**The missing context layer for AI coding assistants.**
|
|
13
|
-
|
|
14
|
-
Deterministic dependency graph. 17 MCP tools. Architecture health. What If simulation. Security scanner.
|
|
15
11
|
|
|
16
|
-
|
|
12
|
+
</div>
|
|
17
13
|
|
|
18
|
-
|
|
14
|
+
**Your AI doesn't know your architecture. Depwire does.**
|
|
19
15
|
|
|
20
|
-
Depwire
|
|
16
|
+
Depwire is the infrastructure layer between your AI coding assistant and your codebase. Before your AI touches a single file, Depwire has already mapped every connection, scored every risk, and simulated every change.
|
|
21
17
|
|
|
22
|
-
|
|
23
|
-
- 🤖 **MCP server for AI tools** — Cursor, Claude Desktop get full dependency context
|
|
24
|
-
- 📊 **Dependency health score** — 0-100 score across 6 dimensions (coupling, cohesion, circular deps, god files, orphans & dead code, depth)
|
|
25
|
-
- 📄 **Auto-generated documentation** — 13 comprehensive documents: architecture, conventions, dependencies, onboarding, file catalog, API surface, error patterns, test coverage, git history, full snapshot, TODO/FIXME inventory, health report, and dead code analysis
|
|
26
|
-
- 🔍 **Impact analysis** — "What breaks if I rename this function?" answered precisely
|
|
27
|
-
- 🧹 **Dead code detection** — Find symbols that are defined but never referenced, categorized by confidence level
|
|
28
|
-
- 👀 **Live updates** — Graph stays current as you edit code
|
|
29
|
-
- 🌍 **Multi-language** — TypeScript, JavaScript, Python, Go, Rust, and C
|
|
18
|
+

|
|
30
19
|
|
|
31
|
-
|
|
20
|
+
⭐ If Depwire saves you from a broken build, [star the repo](https://github.com/depwire/depwire) — it helps this project grow.
|
|
32
21
|
|
|
33
|
-
|
|
22
|
+
---
|
|
34
23
|
|
|
35
|
-
|
|
36
|
-
npm install -g depwire-cli
|
|
37
|
-
```
|
|
24
|
+
## The problem
|
|
38
25
|
|
|
39
|
-
|
|
40
|
-
```bash
|
|
41
|
-
npx depwire-cli --help
|
|
42
|
-
```
|
|
26
|
+
AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.
|
|
43
27
|
|
|
44
|
-
|
|
28
|
+
You ask Claude to delete a utility file. It deletes it cleanly. Confident. No warnings.
|
|
45
29
|
|
|
46
|
-
|
|
30
|
+
Then you run the build. 30 files broken.
|
|
47
31
|
|
|
48
|
-
|
|
32
|
+
Claude had no idea. It saw one file. It didn't see the 30 downstream consumers.
|
|
49
33
|
|
|
50
|
-
|
|
34
|
+
This isn't a model problem. It's a context problem. The AI is flying blind.
|
|
51
35
|
|
|
52
|
-
|
|
53
|
-
```bash
|
|
54
|
-
export DEPWIRE_NO_TELEMETRY=1
|
|
55
|
-
```
|
|
36
|
+
---
|
|
56
37
|
|
|
57
|
-
|
|
38
|
+
## The infrastructure layer
|
|
58
39
|
|
|
59
|
-
|
|
40
|
+

|
|
60
41
|
|
|
61
|
-
|
|
42
|
+
Depwire is the context and safety layer for AI-generated code.
|
|
62
43
|
|
|
63
|
-
|
|
64
|
-
# Auto-detects project root from current directory
|
|
65
|
-
depwire viz
|
|
66
|
-
depwire parse
|
|
67
|
-
depwire docs
|
|
68
|
-
depwire health
|
|
69
|
-
depwire dead-code
|
|
70
|
-
depwire temporal
|
|
71
|
-
depwire whatif
|
|
72
|
-
depwire security
|
|
44
|
+
Depwire sits between your AI and your codebase. It builds a complete dependency graph using tree-sitter — deterministic, not probabilistic — and serves it to your AI through 17 MCP tools.
|
|
73
45
|
|
|
74
|
-
|
|
75
|
-
npx depwire-cli viz ./my-project
|
|
76
|
-
npx depwire-cli parse ./my-project
|
|
77
|
-
npx depwire-cli dead-code ./my-project
|
|
78
|
-
npx depwire-cli temporal ./my-project
|
|
46
|
+
Four guarantees:
|
|
79
47
|
|
|
80
|
-
|
|
81
|
-
|
|
48
|
+
- **Local** — everything runs on your machine. No cloud parsing. No data sent anywhere.
|
|
49
|
+
- **Secure** — your code never leaves your machine. The security scanner requires no API key.
|
|
50
|
+
- **Token-efficient** — Depwire serves pre-computed graph data. Your AI gets surgical answers, not file dumps. 40% fewer tool calls. 56% fewer file reads.
|
|
51
|
+
- **Deterministic** — tree-sitter parses your code the same way every time. 100% accurate. Not a guess.
|
|
82
52
|
|
|
83
|
-
|
|
84
|
-
npx depwire-cli parse --exclude "**/*.test.*" "**/node_modules/**"
|
|
53
|
+
---
|
|
85
54
|
|
|
86
|
-
|
|
87
|
-
npx depwire-cli parse --verbose
|
|
55
|
+
## Start here
|
|
88
56
|
|
|
89
|
-
|
|
90
|
-
|
|
91
|
-
|
|
92
|
-
# Generate codebase documentation
|
|
93
|
-
npx depwire-cli docs --verbose --stats
|
|
94
|
-
|
|
95
|
-
# Custom output file
|
|
96
|
-
npx depwire-cli parse -o my-graph.json
|
|
97
|
-
```
|
|
98
|
-
|
|
99
|
-
### Claude Desktop
|
|
100
|
-
|
|
101
|
-
Add to your Claude Desktop config (`~/Library/Application Support/Claude/claude_desktop_config.json` on macOS):
|
|
102
|
-
|
|
103
|
-
```json
|
|
104
|
-
{
|
|
105
|
-
"mcpServers": {
|
|
106
|
-
"depwire": {
|
|
107
|
-
"command": "npx",
|
|
108
|
-
"args": ["-y", "depwire-cli", "mcp"]
|
|
109
|
-
}
|
|
110
|
-
}
|
|
111
|
-
}
|
|
57
|
+
```bash
|
|
58
|
+
npm install -g depwire-cli
|
|
112
59
|
```
|
|
113
60
|
|
|
114
|
-
|
|
61
|
+
Three commands to understand any codebase:
|
|
115
62
|
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
63
|
+
```bash
|
|
64
|
+
depwire whatif # know what breaks before you change anything
|
|
65
|
+
depwire security # catch vulnerabilities before AI ships them
|
|
66
|
+
depwire viz # see your entire architecture instantly
|
|
119
67
|
```
|
|
120
68
|
|
|
121
|
-
|
|
122
|
-
|
|
123
|
-
Settings → Features → Experimental → Enable MCP → Add Server:
|
|
124
|
-
- Command: `npx`
|
|
125
|
-
- Args: `-y depwire-cli mcp`
|
|
69
|
+
---
|
|
126
70
|
|
|
127
|
-
|
|
71
|
+
## What If simulation
|
|
128
72
|
|
|
129
|
-
|
|
130
|
-
|
|
131
|
-
| Tool | What It Does |
|
|
132
|
-
|------|-------------|
|
|
133
|
-
| `connect_repo` | Connect to any local project or GitHub repo |
|
|
134
|
-
| `impact_analysis` | What breaks if you change a symbol? |
|
|
135
|
-
| `get_file_context` | Full context — imports, exports, dependents |
|
|
136
|
-
| `get_dependencies` | What does a symbol depend on? |
|
|
137
|
-
| `get_dependents` | What depends on this symbol? |
|
|
138
|
-
| `search_symbols` | Find symbols by name |
|
|
139
|
-
| `get_architecture_summary` | High-level project overview |
|
|
140
|
-
| `list_files` | List all files with stats |
|
|
141
|
-
| `get_symbol_info` | Look up any symbol's details |
|
|
142
|
-
| `visualize_graph` | Generate interactive arc diagram visualization |
|
|
143
|
-
| `get_project_docs` | Retrieve auto-generated codebase documentation |
|
|
144
|
-
| `update_project_docs` | Regenerate documentation on demand |
|
|
145
|
-
| `get_health_score` | Get 0-100 dependency health score with recommendations |
|
|
146
|
-
| `find_dead_code` | Find dead code — symbols defined but never referenced |
|
|
147
|
-
| `get_temporal_graph` | Show how the graph evolved over git history |
|
|
148
|
-
| `simulate_change` | Simulate a move/delete/rename/split/merge before touching code. Returns health score delta, broken imports, and affected nodes. Zero file I/O. |
|
|
149
|
-
| `security_scan` | Scan for security vulnerabilities with graph-aware severity elevation. No API key required. |
|
|
150
|
-
|
|
151
|
-
## SDK
|
|
152
|
-
|
|
153
|
-
depwire-cli exposes a public SDK for programmatic use:
|
|
73
|
+
Know the blast radius before you touch anything.
|
|
154
74
|
|
|
155
75
|
```bash
|
|
156
|
-
|
|
76
|
+
depwire whatif . --simulate delete --target src/utils/encode.ts
|
|
157
77
|
```
|
|
158
78
|
|
|
159
|
-
|
|
160
|
-
import {
|
|
161
|
-
parseProject,
|
|
162
|
-
buildGraph,
|
|
163
|
-
calculateHealthScore,
|
|
164
|
-
analyzeDeadCode,
|
|
165
|
-
generateDocs,
|
|
166
|
-
scanSecurity,
|
|
167
|
-
SimulationEngine,
|
|
168
|
-
searchSymbols,
|
|
169
|
-
getImpact,
|
|
170
|
-
getArchitectureSummary,
|
|
171
|
-
DepwireSDKVersion
|
|
172
|
-
} from 'depwire-cli/sdk';
|
|
173
|
-
```
|
|
79
|
+
Real output on [honojs/hono](https://github.com/honojs/hono) — 352 files, 6,245 symbols:
|
|
174
80
|
|
|
175
|
-
|
|
176
|
-
|
|
81
|
+
Health Score: 41 → 41 (+0 → unchanged)
|
|
82
|
+
Affected Nodes: 29
|
|
83
|
+
Broken Imports: 30
|
|
84
|
+
• src/utils/jwt/jwt.ts imports decodeBase64Url
|
|
85
|
+
• src/adapter/aws-lambda/handler.ts imports encodeBase64
|
|
86
|
+
• src/utils/basic-auth.ts imports decodeBase64
|
|
87
|
+
[27 more...]
|
|
88
|
+
Removed Edges: 32
|
|
177
89
|
|
|
178
|
-
|
|
90
|
+
Before touching a single file. Zero file I/O. Pure in-memory simulation.
|
|
179
91
|
|
|
180
|
-
|
|
92
|
+
Five operations:
|
|
181
93
|
|
|
182
94
|
```bash
|
|
183
95
|
depwire whatif . --simulate delete --target src/utils/encode.ts
|
|
@@ -187,633 +99,324 @@ depwire whatif . --simulate split --target src/services/auth.ts --symbols "valid
|
|
|
187
99
|
depwire whatif . --simulate merge --target src/utils/helpers.ts --merge-target src/utils/formatters.ts
|
|
188
100
|
```
|
|
189
101
|
|
|
190
|
-
|
|
191
|
-
Also available as MCP tool `simulate_change` for AI coding assistants.
|
|
102
|
+
Run without `--simulate` to open the browser UI — side-by-side arc diagrams showing current vs simulated state.
|
|
192
103
|
|
|
193
|
-
|
|
104
|
+
---
|
|
194
105
|
|
|
195
|
-
|
|
106
|
+
## Security scanner
|
|
107
|
+
|
|
108
|
+
AI will confidently ship vulnerable code. Depwire stops it before production.
|
|
196
109
|
|
|
197
110
|
```bash
|
|
198
|
-
depwire security .
|
|
199
|
-
depwire security . --target src/auth.ts
|
|
200
|
-
depwire security . --format sarif
|
|
201
|
-
depwire security . --fail-on high
|
|
202
|
-
depwire security . --class injection
|
|
111
|
+
depwire security . # full repo scan
|
|
112
|
+
depwire security . --target src/auth.ts # single file
|
|
113
|
+
depwire security . --format sarif # GitHub Security tab integration
|
|
114
|
+
depwire security . --fail-on high # CI gate — exit 1 if HIGH or above
|
|
115
|
+
depwire security . --class injection # specific check only
|
|
203
116
|
```
|
|
204
117
|
|
|
205
|
-
|
|
206
|
-
- Dependency CVEs (npm/pip/cargo/go audit)
|
|
207
|
-
- Shell injection + code injection
|
|
208
|
-
- Hardcoded secrets (API keys, passwords, private keys)
|
|
209
|
-
- Path traversal
|
|
210
|
-
- Auth bypass patterns
|
|
211
|
-
- Input validation gaps
|
|
212
|
-
- Information disclosure
|
|
213
|
-
- Cryptography weaknesses
|
|
214
|
-
- Frontend XSS (dangerouslySetInnerHTML, localStorage tokens)
|
|
215
|
-
- Architecture-level risks (graph-powered severity elevation)
|
|
118
|
+
Real output on honojs/hono:
|
|
216
119
|
|
|
217
|
-
|
|
120
|
+
6 Critical 19 High 14 Medium 1 Low
|
|
218
121
|
|
|
219
|
-
|
|
220
|
-
|
|
221
|
-
| Feature | Depwire | Standard RAG (Fuzzy Search) | LLM Native Scanning |
|
|
222
|
-
|---------|---------|----------------------------|---------------------|
|
|
223
|
-
| Logic | Deterministic Graph | Probabilistic Match | Brute Force Reading |
|
|
224
|
-
| Precision | 100% (Tree-sitter AST) | ~70% (Embedding match) | Varies — hallucination prone |
|
|
225
|
-
| Refactor Safety | High — traces full call chains | Low — misses indirect refs | Zero — blind edits |
|
|
226
|
-
| Token Cost | Ultra-low — surgical reads | High — context stuffing | Extreme — scans everything |
|
|
227
|
-
| Circular Detection | Built-in | Not possible | Occasional |
|
|
228
|
-
| What If Simulation | Before touching code | Not possible | Not possible |
|
|
229
|
-
| Architecture Health Score | 0-100 with dimensions | Not possible | Not possible |
|
|
230
|
-
|
|
231
|
-
## GitHub Action — PR Impact Analysis
|
|
232
|
-
|
|
233
|
-
Depwire integrates directly into your CI/CD pipeline via the [depwire-action](https://github.com/depwire/depwire-action) GitHub Action.
|
|
234
|
-
|
|
235
|
-
On every pull request, it automatically:
|
|
236
|
-
- Analyzes which symbols and files are affected by the changes
|
|
237
|
-
- Posts a dependency impact report as a PR comment
|
|
238
|
-
- Shows added, removed, and changed dependencies
|
|
239
|
-
- Helps reviewers understand the architectural blast radius before merging
|
|
240
|
-
|
|
241
|
-
### Usage
|
|
242
|
-
|
|
243
|
-
Add this to `.github/workflows/depwire.yml`:
|
|
244
|
-
```yaml
|
|
245
|
-
name: Depwire PR Impact
|
|
246
|
-
on:
|
|
247
|
-
pull_request:
|
|
248
|
-
branches: [main]
|
|
249
|
-
|
|
250
|
-
jobs:
|
|
251
|
-
impact:
|
|
252
|
-
runs-on: ubuntu-latest
|
|
253
|
-
steps:
|
|
254
|
-
- uses: actions/checkout@v4
|
|
255
|
-
with:
|
|
256
|
-
fetch-depth: 0
|
|
257
|
-
- uses: depwire/depwire-action@v1
|
|
258
|
-
with:
|
|
259
|
-
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
260
|
-
```
|
|
122
|
+
10 check categories — dependency CVEs, shell injection, hardcoded secrets, path traversal, auth bypass, input validation, information disclosure, cryptography weaknesses, frontend XSS, and architecture-level risks.
|
|
261
123
|
|
|
262
|
-
|
|
263
|
-
- [GitHub Marketplace](https://github.com/marketplace/actions/depwire-pr-impact)
|
|
264
|
-
- [depwire-action repository](https://github.com/depwire/depwire-action)
|
|
124
|
+
Graph-aware severity: a medium shell injection reachable from an MCP tool or HTTP route is automatically elevated to critical. This is what no generic SAST tool can replicate — Depwire knows your architecture, so it knows what's actually reachable.
|
|
265
125
|
|
|
266
|
-
|
|
126
|
+
Available as MCP tool `security_scan` and via `depwire-cli/sdk`.
|
|
267
127
|
|
|
268
|
-
|
|
269
|
-
|----------|-----------|----------|
|
|
270
|
-
| TypeScript | `.ts`, `.tsx` | Full support — imports, classes, interfaces, types |
|
|
271
|
-
| JavaScript | `.js`, `.jsx`, `.mjs`, `.cjs` | ES modules, CommonJS require(), JSX components |
|
|
272
|
-
| Python | `.py` | Imports, classes, decorators, inheritance |
|
|
273
|
-
| Go | `.go` | go.mod resolution, structs, interfaces, methods |
|
|
274
|
-
| Rust | `.rs` | Functions, structs, enums, traits, impl blocks, use declarations |
|
|
275
|
-
| C | `.c`, `.h` | Functions, structs, enums, typedefs, macros, #include directives |
|
|
128
|
+
---
|
|
276
129
|
|
|
277
130
|
## Visualization
|
|
278
131
|
|
|
279
|
-

|
|
132
|
+

|
|
282
133
|
|
|
283
134
|
```bash
|
|
284
|
-
# Auto-detects project root (run from anywhere in your project)
|
|
285
135
|
depwire viz
|
|
286
|
-
|
|
287
|
-
# Or specify a directory explicitly
|
|
288
|
-
depwire viz ./my-project
|
|
289
|
-
|
|
290
|
-
# Custom port
|
|
291
|
-
depwire viz --port 8080
|
|
292
|
-
|
|
293
|
-
# Exclude test files from visualization
|
|
294
|
-
depwire viz --exclude "**/*.test.*"
|
|
295
|
-
|
|
296
|
-
# Verbose mode with detailed parsing logs
|
|
297
|
-
depwire viz --verbose
|
|
298
|
-
|
|
299
|
-
# Don't auto-open browser
|
|
300
|
-
depwire viz --no-open
|
|
301
136
|
```
|
|
302
137
|
|
|
303
|
-
|
|
304
|
-
- Rainbow-colored arcs showing cross-file dependencies
|
|
305
|
-
- Hover to explore connections
|
|
306
|
-
- Click to filter by file
|
|
307
|
-
- Search by filename
|
|
308
|
-
- **Live refresh when files change** — Edit code and see the graph update in real-time
|
|
309
|
-
- Export as SVG or PNG
|
|
310
|
-
- **Port collision handling** — Automatically finds an available port if default is in use
|
|
138
|
+
Interactive arc diagram of your entire codebase. Every file, every connection, every dependency visible at once. Hover to inspect. Click to filter. Export as PNG or SVG.
|
|
311
139
|
|
|
312
|
-
|
|
140
|
+
---
|
|
313
141
|
|
|
314
|
-
|
|
142
|
+
## Temporal graph
|
|
315
143
|
|
|
316
|
-

|
|
317
145
|
|
|
318
146
|
```bash
|
|
319
|
-
# Auto-detects project root
|
|
320
147
|
depwire temporal
|
|
321
|
-
|
|
322
|
-
# Sample 20 commits with monthly snapshots
|
|
323
|
-
depwire temporal --commits 20 --strategy monthly
|
|
324
|
-
|
|
325
|
-
# Verbose mode with detailed progress
|
|
326
|
-
depwire temporal --verbose --stats
|
|
327
|
-
|
|
328
|
-
# Custom port
|
|
329
|
-
depwire temporal --port 3335
|
|
330
148
|
```
|
|
331
149
|
|
|
332
|
-
|
|
333
|
-
- `--commits <number>` — Number of commits to sample (default: 20)
|
|
334
|
-
- `--strategy <type>` — Sampling strategy: `even`, `weekly`, `monthly` (default: `even`)
|
|
335
|
-
- `-p, --port <number>` — Server port (default: 3334)
|
|
336
|
-
- `--output <path>` — Save snapshots to custom path (default: `.depwire/temporal/`)
|
|
337
|
-
- `--verbose` — Show progress for each commit being parsed
|
|
338
|
-
- `--stats` — Show summary statistics at end
|
|
339
|
-
|
|
340
|
-
Opens an interactive temporal visualization in your browser:
|
|
341
|
-
- Timeline slider showing all sampled commits
|
|
342
|
-
- Arc diagram morphing between snapshots
|
|
343
|
-
- Play/pause animation with speed controls (0.5×, 1×, 2×)
|
|
344
|
-
- Statistics panel with growth deltas
|
|
345
|
-
- Evolution chart tracking files/symbols/edges over time
|
|
346
|
-
- Auto-zoom to fit all arcs on snapshot change
|
|
347
|
-
- Search to highlight specific files across time
|
|
348
|
-
|
|
349
|
-
## 🪦 Dead Code Detection
|
|
350
|
-
|
|
351
|
-
Find unused symbols across your codebase before they become technical debt.
|
|
352
|
-
|
|
353
|
-
- Detects symbols with zero incoming references (never called, never imported)
|
|
354
|
-
- Confidence scoring: **high** (definitely dead), **medium** (probably dead), **low** (might be dead)
|
|
355
|
-
- Smart exclusion rules — ignores entry points, test files, barrel files, and config files to reduce false positives
|
|
356
|
-
- Filter by confidence level, export as JSON for CI pipelines
|
|
357
|
-
- Integrated into the health score (orphans dimension)
|
|
358
|
-
- New MCP tool: `find_dead_code` — AI assistants can query dead code directly
|
|
359
|
-
- New document generator: `DEAD_CODE.md` — auto-generated dead code report
|
|
360
|
-
|
|
361
|
-
```bash
|
|
362
|
-
depwire dead-code
|
|
363
|
-
depwire dead-code --confidence high
|
|
364
|
-
depwire dead-code --stats
|
|
365
|
-
depwire dead-code --json
|
|
366
|
-
```
|
|
367
|
-
|
|
368
|
-
**Confidence Levels:**
|
|
369
|
-
- 🔴 **High confidence (definitely dead)**: Not exported with zero references, or exported but never used
|
|
370
|
-
- 🟡 **Medium confidence (probably dead)**: Exported from barrel files with zero dependents, or only used in test files
|
|
371
|
-
- ⚪ **Low confidence (might be dead)**: Exported from package entry points, types with zero dependents, or in dynamic-use directories (routes, middleware, etc.)
|
|
372
|
-
|
|
373
|
-
The dead code detector automatically excludes:
|
|
374
|
-
- Entry point files (index.ts, main.ts, server.ts, etc.)
|
|
375
|
-
- Test files (*.test.*, *.spec.*, __tests__/)
|
|
376
|
-
- Config files (*.config.*)
|
|
377
|
-
- Type declarations (*.d.ts)
|
|
378
|
-
- Framework auto-loaded directories (pages/, routes/, middleware/, commands/)
|
|
150
|
+
Watch your architecture evolve over git history. Timeline slider scrubs through commits — the arc diagram morphs as your codebase grew, coupled, and refactored. Nobody else does this.
|
|
379
151
|
|
|
380
|
-
|
|
152
|
+
---
|
|
381
153
|
|
|
382
|
-
|
|
383
|
-
2. **Graph** — graphology builds an in-memory dependency graph
|
|
384
|
-
3. **MCP** — AI tools query the graph for context-aware answers
|
|
385
|
-
4. **Viz** — D3.js renders the graph as an interactive arc diagram
|
|
154
|
+
## All commands
|
|
386
155
|
|
|
387
|
-
|
|
156
|
+
| Command | Description |
|
|
157
|
+
|---------|-------------|
|
|
158
|
+
| `depwire viz` | Interactive arc diagram in browser |
|
|
159
|
+
| `depwire whatif` | Simulate changes before touching code |
|
|
160
|
+
| `depwire security` | Scan for vulnerabilities — graph-aware severity |
|
|
161
|
+
| `depwire health` | 0-100 architecture health score across 6 dimensions |
|
|
162
|
+
| `depwire dead-code` | Find unused symbols with confidence scoring |
|
|
163
|
+
| `depwire docs` | Generate 13 architecture documents |
|
|
164
|
+
| `depwire temporal` | Visualize architecture evolution over git history |
|
|
165
|
+
| `depwire parse` | Parse and export dependency graph as JSON |
|
|
166
|
+
| `depwire mcp` | Start MCP server for AI coding assistants |
|
|
388
167
|
|
|
389
|
-
|
|
168
|
+
All commands auto-detect your project root. No path configuration needed.
|
|
390
169
|
|
|
391
|
-
|
|
170
|
+
---
|
|
392
171
|
|
|
393
|
-
|
|
172
|
+
## MCP server — AI integration
|
|
394
173
|
|
|
395
|
-
|
|
396
|
-
- `-o, --output <path>` — Output file path (default: `depwire-output.json`)
|
|
397
|
-
- `--exclude <patterns...>` — Glob patterns to exclude (e.g., `"**/*.test.*" "dist/**"`)
|
|
398
|
-
- `--verbose` — Show detailed parsing progress (logs each file as it's parsed)
|
|
399
|
-
- `--pretty` — Pretty-print JSON output with indentation
|
|
400
|
-
- `--stats` — Print summary statistics (file count, symbol count, edges, timing)
|
|
401
|
-
|
|
402
|
-
**Examples:**
|
|
403
|
-
```bash
|
|
404
|
-
# Auto-detect project root
|
|
405
|
-
depwire parse
|
|
406
|
-
|
|
407
|
-
# Explicit directory
|
|
408
|
-
depwire parse ./src
|
|
409
|
-
|
|
410
|
-
# Exclude test files and build outputs
|
|
411
|
-
depwire parse --exclude "**/*.test.*" "**/*.spec.*" "dist/**" "build/**"
|
|
412
|
-
|
|
413
|
-
# Full verbosity with stats
|
|
414
|
-
depwire parse --verbose --stats --pretty -o graph.json
|
|
415
|
-
```
|
|
174
|
+
Connect Depwire to any MCP-compatible AI tool. Your AI gets 17 tools it can call autonomously.
|
|
416
175
|
|
|
417
|
-
|
|
176
|
+
**Claude Desktop** — add to `~/Library/Application Support/Claude/claude_desktop_config.json`:
|
|
418
177
|
|
|
419
|
-
|
|
420
|
-
|
|
421
|
-
|
|
422
|
-
|
|
423
|
-
|
|
424
|
-
|
|
425
|
-
|
|
426
|
-
|
|
427
|
-
|
|
428
|
-
|
|
429
|
-
**Examples:**
|
|
430
|
-
```bash
|
|
431
|
-
# Auto-detect and visualize
|
|
432
|
-
depwire viz
|
|
433
|
-
|
|
434
|
-
# Explicit directory
|
|
435
|
-
depwire viz ./src
|
|
436
|
-
|
|
437
|
-
# Custom port without auto-open
|
|
438
|
-
depwire viz --port 8080 --no-open
|
|
439
|
-
|
|
440
|
-
# Exclude test files with verbose logging
|
|
441
|
-
depwire viz --exclude "**/*.test.*" --verbose
|
|
178
|
+
```json
|
|
179
|
+
{
|
|
180
|
+
"mcpServers": {
|
|
181
|
+
"depwire": {
|
|
182
|
+
"command": "npx",
|
|
183
|
+
"args": ["-y", "depwire-cli", "mcp"]
|
|
184
|
+
}
|
|
185
|
+
}
|
|
186
|
+
}
|
|
442
187
|
```
|
|
443
188
|
|
|
444
|
-
|
|
445
|
-
|
|
446
|
-
|
|
447
|
-
|
|
448
|
-
**Directory argument is optional** — Auto-detects project root and connects automatically.
|
|
449
|
-
|
|
450
|
-
**Examples:**
|
|
451
|
-
```bash
|
|
452
|
-
# Auto-detect and connect (recommended)
|
|
453
|
-
depwire mcp
|
|
454
|
-
|
|
455
|
-
# Explicit directory
|
|
456
|
-
depwire mcp /path/to/project
|
|
457
|
-
```
|
|
189
|
+
**Cursor** — Settings → Features → Experimental → Enable MCP → Add Server:
|
|
190
|
+
- Command: `npx`
|
|
191
|
+
- Args: `-y depwire-cli mcp`
|
|
458
192
|
|
|
459
|
-
|
|
193
|
+

|
|
460
194
|
|
|
461
|
-
|
|
195
|
+
### 17 MCP tools
|
|
462
196
|
|
|
463
|
-
|
|
197
|
+
| Tool | Description |
|
|
198
|
+
|------|-------------|
|
|
199
|
+
| `connect_repo` | Connect to any local project or GitHub repo |
|
|
200
|
+
| `get_architecture_summary` | High-level project overview |
|
|
201
|
+
| `get_file_context` | Full context — imports, exports, dependents. Includes cross-language connections. |
|
|
202
|
+
| `get_dependencies` | What does a symbol depend on? |
|
|
203
|
+
| `get_dependents` | What depends on this symbol? |
|
|
204
|
+
| `get_symbol_info` | Look up any symbol's details |
|
|
205
|
+
| `search_symbols` | Find symbols by name across the codebase |
|
|
206
|
+
| `list_files` | List all files with stats |
|
|
207
|
+
| `impact_analysis` | What breaks if you change a symbol? Cross-language edges included. |
|
|
208
|
+
| `visualize_graph` | Generate interactive arc diagram |
|
|
209
|
+
| `get_health_score` | 0-100 health score with recommendations |
|
|
210
|
+
| `find_dead_code` | Symbols defined but never referenced |
|
|
211
|
+
| `get_project_docs` | Retrieve auto-generated codebase documentation |
|
|
212
|
+
| `update_project_docs` | Regenerate documentation on demand |
|
|
213
|
+
| `get_temporal_graph` | Architecture evolution over git history |
|
|
214
|
+
| `simulate_change` | Simulate move/delete/rename/split/merge before touching code. Returns health delta, broken imports, affected nodes. Cross-language edges included. |
|
|
215
|
+
| `security_scan` | Scan for vulnerabilities with graph-aware severity elevation. No API key required. |
|
|
464
216
|
|
|
465
|
-
|
|
466
|
-
- `--output <path>` — Output directory (default: `.depwire/` inside project)
|
|
467
|
-
- `--format <type>` — Output format: `markdown` or `json` (default: `markdown`)
|
|
468
|
-
- `--include <docs...>` — Comma-separated list of docs to generate (default: `all`)
|
|
469
|
-
- Values: `architecture`, `conventions`, `dependencies`, `onboarding`, `files`, `api_surface`, `errors`, `tests`, `history`, `current`, `status`, `health`, `all`
|
|
470
|
-
- `--update` — Regenerate existing documentation
|
|
471
|
-
- `--only <docs...>` — Used with `--update`, regenerate only specific docs
|
|
472
|
-
- `--verbose` — Show generation progress
|
|
473
|
-
- `--stats` — Show generation statistics
|
|
474
|
-
- `--gitignore` — Add `.depwire/` to `.gitignore` automatically
|
|
475
|
-
- `--no-gitignore` — Don't modify `.gitignore`
|
|
217
|
+
---
|
|
476
218
|
|
|
477
|
-
|
|
478
|
-
```bash
|
|
479
|
-
# Auto-detect and generate all docs
|
|
480
|
-
depwire docs
|
|
219
|
+
## Cross-language edge detection
|
|
481
220
|
|
|
482
|
-
|
|
483
|
-
depwire docs ./my-project
|
|
221
|
+
Depwire detects connections between files written in different languages.
|
|
484
222
|
|
|
485
|
-
|
|
486
|
-
depwire docs --verbose --stats
|
|
223
|
+
A TypeScript `fetch('/api/users')` call matched to a Python `@app.get('/api/users')` route definition — that's a cross-language edge. Delete the Python route and Depwire shows the TypeScript callers as broken.
|
|
487
224
|
|
|
488
|
-
|
|
489
|
-
|
|
225
|
+
Supported patterns:
|
|
226
|
+
- REST API edges — fetch/axios calls matched to Express, FastAPI, Flask, Gin route definitions
|
|
227
|
+
- Subprocess edges — execSync/subprocess.run calls matched to target files in the graph
|
|
490
228
|
|
|
491
|
-
|
|
492
|
-
depwire docs --include architecture,dependencies
|
|
229
|
+
These edges flow through every existing feature: What If simulation, impact analysis, security scanner, and arc diagram visualization.
|
|
493
230
|
|
|
494
|
-
|
|
495
|
-
depwire docs --output ./docs
|
|
231
|
+
---
|
|
496
232
|
|
|
497
|
-
|
|
498
|
-
depwire docs --update --only conventions
|
|
499
|
-
```
|
|
233
|
+
## Architecture health score
|
|
500
234
|
|
|
501
|
-
**Generated Documents (13 total):**
|
|
502
|
-
|
|
503
|
-
| Document | What It Contains |
|
|
504
|
-
|----------|------------------|
|
|
505
|
-
| `ARCHITECTURE.md` | Module structure, entry points, hub files, layer analysis, circular dependencies |
|
|
506
|
-
| `CONVENTIONS.md` | Naming patterns, import/export style, detected design patterns |
|
|
507
|
-
| `DEPENDENCIES.md` | Module dependency matrix, high-impact symbols, longest dependency chains |
|
|
508
|
-
| `ONBOARDING.md` | Reading order (Foundation/Core/Entry Points), module map, key concepts, high-impact file warnings |
|
|
509
|
-
| `FILES.md` | Complete file catalog with stats, orphan files, hub files |
|
|
510
|
-
| `API_SURFACE.md` | All exported symbols (public API), most-used exports, unused exports |
|
|
511
|
-
| `ERRORS.md` | Error handling patterns, error-prone files, custom error classes |
|
|
512
|
-
| `TESTS.md` | Test file inventory, test-to-source mapping, untested files |
|
|
513
|
-
| `HISTORY.md` | Git history + graph analysis, file churn, feature timeline |
|
|
514
|
-
| `CURRENT.md` | Complete codebase snapshot (every file, symbol, connection) |
|
|
515
|
-
| `STATUS.md` | TODO/FIXME/HACK inventory with priority matrix |
|
|
516
|
-
| `HEALTH.md` | Dependency health score (0-100) across 6 dimensions with recommendations |
|
|
517
|
-
| `DEAD_CODE.md` | Unused symbols by confidence level (high/medium/low) with smart exclusions |
|
|
518
|
-
|
|
519
|
-
Documents are stored in `.depwire/` with `metadata.json` tracking generation timestamps for staleness detection.
|
|
520
|
-
|
|
521
|
-
### `depwire health [directory]`
|
|
522
|
-
|
|
523
|
-
Analyze dependency architecture health and get a 0-100 score across 6 quality dimensions.
|
|
524
|
-
|
|
525
|
-
**Directory argument is optional** — Auto-detects project root.
|
|
526
|
-
|
|
527
|
-
**Options:**
|
|
528
|
-
- `--json` — Output as JSON (for CI/automation)
|
|
529
|
-
- `--verbose` — Show detailed per-dimension breakdown
|
|
530
|
-
|
|
531
|
-
**Dimensions Measured:**
|
|
532
|
-
1. **Coupling (25%)** — How tightly connected are modules? Lower coupling = easier changes
|
|
533
|
-
2. **Cohesion (20%)** — Do files in the same directory relate? Higher cohesion = better organization
|
|
534
|
-
3. **Circular Dependencies (20%)** — Files depending on each other in cycles
|
|
535
|
-
4. **God Files (15%)** — Files with abnormally high connection counts
|
|
536
|
-
5. **Orphan Files (10%)** — Files with zero connections (dead code?)
|
|
537
|
-
6. **Dependency Depth (10%)** — How deep are the dependency chains?
|
|
538
|
-
|
|
539
|
-
**Examples:**
|
|
540
235
|
```bash
|
|
541
|
-
|
|
542
|
-
depwire health
|
|
543
|
-
|
|
544
|
-
# Explicit directory
|
|
545
|
-
depwire health ./my-project
|
|
546
|
-
|
|
547
|
-
# Detailed breakdown
|
|
548
|
-
depwire health --verbose
|
|
549
|
-
|
|
550
|
-
# JSON output for CI
|
|
551
|
-
depwire health --json
|
|
236
|
+
depwire health .
|
|
552
237
|
```
|
|
553
238
|
|
|
554
|
-
|
|
555
|
-
|
|
556
|
-
|
|
557
|
-
|
|
558
|
-
|
|
559
|
-
|
|
560
|
-
|
|
239
|
+
Overall: 68/100 (Grade: D)
|
|
240
|
+
Coupling 70 C
|
|
241
|
+
Cohesion 80 B
|
|
242
|
+
Circular Dependencies 100 A
|
|
243
|
+
God Files 40 F
|
|
244
|
+
Orphans & Dead Code 20 F
|
|
245
|
+
Dependency Depth 60 D
|
|
561
246
|
|
|
562
|
-
|
|
247
|
+
6 dimensions. Letter grades. Actionable recommendations. Trend tracking across runs.
|
|
563
248
|
|
|
564
|
-
|
|
249
|
+
---
|
|
565
250
|
|
|
566
|
-
|
|
567
|
-
|
|
568
|
-
**Options:**
|
|
569
|
-
- `--confidence <level>` — Minimum confidence level to show: `high`, `medium`, `low` (default: `medium`)
|
|
570
|
-
- `--include-low` — Shortcut for `--confidence low`
|
|
571
|
-
- `--verbose` — Show detailed info for each dead symbol (file, line, kind, reason)
|
|
572
|
-
- `--stats` — Show summary statistics
|
|
573
|
-
- `--include-tests` — Include test files in analysis (excluded by default)
|
|
574
|
-
- `--json` — Output as JSON for CI/automation
|
|
251
|
+
## SDK
|
|
575
252
|
|
|
576
|
-
|
|
577
|
-
- 🔴 **High confidence (definitely dead)**: Not exported with zero references, or exported but never used
|
|
578
|
-
- 🟡 **Medium confidence (probably dead)**: Exported from barrel files with zero dependents, or only used in test files
|
|
579
|
-
- ⚪ **Low confidence (might be dead)**: Exported from package entry points, types with zero dependents, or in dynamic-use directories (routes, middleware, etc.)
|
|
253
|
+
Depwire exposes a stable public API for programmatic use and CI pipelines:
|
|
580
254
|
|
|
581
|
-
**Examples:**
|
|
582
255
|
```bash
|
|
583
|
-
|
|
584
|
-
depwire dead-code
|
|
585
|
-
|
|
586
|
-
# Show only high-confidence dead code
|
|
587
|
-
depwire dead-code --confidence high
|
|
588
|
-
|
|
589
|
-
# Show all potential dead code (including low confidence)
|
|
590
|
-
depwire dead-code --confidence low
|
|
591
|
-
# Or use shortcut
|
|
592
|
-
depwire dead-code --include-low
|
|
593
|
-
|
|
594
|
-
# Detailed analysis with reasons and statistics
|
|
595
|
-
depwire dead-code --verbose --stats
|
|
596
|
-
|
|
597
|
-
# Include test files in analysis (excluded by default)
|
|
598
|
-
depwire dead-code --include-tests
|
|
599
|
-
|
|
600
|
-
# JSON output for CI/automation
|
|
601
|
-
depwire dead-code --json
|
|
256
|
+
npm install depwire-cli
|
|
602
257
|
```
|
|
603
258
|
|
|
604
|
-
|
|
605
|
-
|
|
606
|
-
|
|
607
|
-
|
|
608
|
-
|
|
609
|
-
|
|
610
|
-
|
|
611
|
-
|
|
612
|
-
|
|
613
|
-
|
|
614
|
-
|
|
615
|
-
|
|
616
|
-
|
|
617
|
-
|
|
618
|
-
|
|
619
|
-
- `--commits <number>` — Number of commits to sample (default: 20)
|
|
620
|
-
- `--strategy <type>` — Sampling strategy: `even` (every Nth), `weekly`, `monthly` (default: `even`)
|
|
621
|
-
- `-p, --port <number>` — Server port (default: 3334)
|
|
622
|
-
- `--output <path>` — Save snapshots to custom path (default: `.depwire/temporal/`)
|
|
623
|
-
- `--verbose` — Show progress for each commit being parsed
|
|
624
|
-
- `--stats` — Show summary statistics at end
|
|
625
|
-
|
|
626
|
-
**Examples:**
|
|
627
|
-
```bash
|
|
628
|
-
# Auto-detect and analyze 20 commits
|
|
629
|
-
depwire temporal
|
|
630
|
-
|
|
631
|
-
# Sample 50 commits with monthly snapshots
|
|
632
|
-
depwire temporal --commits 50 --strategy monthly
|
|
633
|
-
|
|
634
|
-
# Verbose mode with stats
|
|
635
|
-
depwire temporal --verbose --stats
|
|
636
|
-
|
|
637
|
-
# Custom output directory
|
|
638
|
-
depwire temporal --output ./temp-snapshots
|
|
259
|
+
```typescript
|
|
260
|
+
import {
|
|
261
|
+
parseProject,
|
|
262
|
+
buildGraph,
|
|
263
|
+
calculateHealthScore,
|
|
264
|
+
analyzeDeadCode,
|
|
265
|
+
generateDocs,
|
|
266
|
+
scanSecurity,
|
|
267
|
+
SimulationEngine,
|
|
268
|
+
detectCrossLanguageEdges,
|
|
269
|
+
searchSymbols,
|
|
270
|
+
getImpact,
|
|
271
|
+
getArchitectureSummary,
|
|
272
|
+
DepwireSDKVersion
|
|
273
|
+
} from 'depwire-cli/sdk';
|
|
639
274
|
```
|
|
640
275
|
|
|
641
|
-
|
|
642
|
-
- Interactive browser visualization at `http://127.0.0.1:3334`
|
|
643
|
-
- Timeline slider to scrub through git history
|
|
644
|
-
- Arc diagram morphing between snapshots
|
|
645
|
-
- Growth statistics showing files/symbols/edges evolution
|
|
646
|
-
- Auto-zoom to fit full diagram on each snapshot change
|
|
647
|
-
|
|
648
|
-
Snapshots are cached in `.depwire/temporal/` for fast re-rendering.
|
|
649
|
-
|
|
650
|
-
### `depwire whatif [directory]`
|
|
276
|
+
The SDK is the stable public API surface. All integrations should import from `depwire-cli/sdk` — never from internal paths.
|
|
651
277
|
|
|
652
|
-
|
|
278
|
+
---
|
|
653
279
|
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
**Options:**
|
|
657
|
-
- `--simulate <action>` — Action to simulate: `move`, `delete`, `rename`, `split`, `merge`
|
|
658
|
-
- `--target <file>` — File to apply the action to
|
|
659
|
-
- `--destination <file>` — Destination path (for move action)
|
|
660
|
-
- `--new-name <name>` — New name (for rename action)
|
|
661
|
-
- `--source <file>` — Source file (for merge action)
|
|
662
|
-
- `--new-file <file>` — New file path (for split action)
|
|
663
|
-
- `--symbols <symbols>` — Comma-separated symbol names (for split action)
|
|
664
|
-
|
|
665
|
-
**Examples:**
|
|
666
|
-
```bash
|
|
667
|
-
# What breaks if I delete this file?
|
|
668
|
-
depwire whatif --simulate delete --target src/auth/service.ts
|
|
280
|
+
## Why Depwire
|
|
669
281
|
|
|
670
|
-
|
|
671
|
-
|
|
282
|
+
| | Depwire | RAG-based tools | LLM scanning |
|
|
283
|
+
|--|---------|-----------------|--------------|
|
|
284
|
+
| Approach | Deterministic graph | Probabilistic match | Brute force |
|
|
285
|
+
| Accuracy | 100% — tree-sitter AST | ~70% — embedding match | Varies |
|
|
286
|
+
| Refactor safety | Full call chain tracing | Misses indirect refs | Blind edits |
|
|
287
|
+
| Token cost | Ultra-low — surgical reads | High — context stuffing | Extreme |
|
|
288
|
+
| Cross-language | REST + subprocess edges | None | None |
|
|
289
|
+
| Security scanner | Graph-aware severity | None | None |
|
|
290
|
+
| What If simulation | Before touching code | None | None |
|
|
291
|
+
| Runs locally | Always | Varies | Never |
|
|
672
292
|
|
|
673
|
-
|
|
674
|
-
depwire whatif --simulate rename --target src/router.ts --new-name routes.ts
|
|
293
|
+
---
|
|
675
294
|
|
|
676
|
-
|
|
677
|
-
depwire whatif --simulate split --target src/utils.ts --new-file src/helpers.ts --symbols "formatDate,parseUrl"
|
|
295
|
+
## Language support
|
|
678
296
|
|
|
679
|
-
#
|
|
680
|
-
depwire whatif --simulate merge --target src/auth.ts --source src/login.ts
|
|
681
|
-
```
|
|
297
|
+
TypeScript, JavaScript, Python, Go, Rust, C, C# — with cross-language edge detection between all supported languages.
|
|
682
298
|
|
|
683
|
-
|
|
684
|
-
- Health score delta (before/after with improvement indicator)
|
|
685
|
-
- Broken imports with file and symbol details
|
|
686
|
-
- Affected nodes count
|
|
687
|
-
- Circular dependencies introduced or resolved
|
|
688
|
-
- Added and removed edge counts
|
|
299
|
+
---
|
|
689
300
|
|
|
690
|
-
|
|
301
|
+
## GitHub Action — PR Impact Analysis
|
|
691
302
|
|
|
692
|
-
Depwire
|
|
693
|
-
- **Malformed files** — Skipped with warning, parsing continues
|
|
694
|
-
- **Large files** — Files over 1MB are automatically skipped
|
|
695
|
-
- **Port collisions** — Auto-increments to next available port (3456 → 3457 → 3458...)
|
|
696
|
-
- **Protected paths** — Blocks access to sensitive directories (.ssh, .aws, /etc)
|
|
303
|
+
Depwire integrates into your CI/CD pipeline via the [depwire-action](https://github.com/depwire/depwire-action) GitHub Action.
|
|
697
304
|
|
|
305
|
+
On every pull request it automatically posts a dependency impact report — which symbols changed, what breaks, health score before and after. Code reviewers see the architectural blast radius before merging.
|
|
698
306
|
|
|
699
|
-
|
|
307
|
+
Add to `.github/workflows/depwire.yml`:
|
|
700
308
|
|
|
701
|
-
|
|
309
|
+
```yaml
|
|
310
|
+
name: Depwire PR Impact
|
|
311
|
+
on:
|
|
312
|
+
pull_request:
|
|
313
|
+
branches: [main]
|
|
702
314
|
|
|
703
|
-
|
|
315
|
+
permissions:
|
|
316
|
+
contents: read
|
|
317
|
+
pull-requests: write
|
|
704
318
|
|
|
319
|
+
jobs:
|
|
320
|
+
depwire:
|
|
321
|
+
runs-on: ubuntu-latest
|
|
322
|
+
steps:
|
|
323
|
+
- uses: actions/checkout@v4
|
|
324
|
+
with:
|
|
325
|
+
fetch-depth: 0
|
|
326
|
+
- uses: actions/setup-node@v4
|
|
327
|
+
with:
|
|
328
|
+
node-version: '20'
|
|
329
|
+
- uses: depwire/depwire-action@v1
|
|
330
|
+
with:
|
|
331
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
705
332
|
```
|
|
706
|
-
# In Claude Desktop or Cursor with Depwire MCP:
|
|
707
333
|
|
|
708
|
-
|
|
334
|
+
Block PRs that hurt your architecture:
|
|
709
335
|
|
|
710
|
-
|
|
711
|
-
|
|
712
|
-
|
|
713
|
-
|
|
714
|
-
|
|
336
|
+
```yaml
|
|
337
|
+
- uses: depwire/depwire-action@v1
|
|
338
|
+
with:
|
|
339
|
+
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
340
|
+
fail-on-score-drop: 5
|
|
715
341
|
```
|
|
716
342
|
|
|
717
|
-
|
|
343
|
+
[GitHub Marketplace](https://github.com/marketplace/actions/depwire-pr-impact) — [depwire-action repo](https://github.com/depwire/depwire-action)
|
|
718
344
|
|
|
719
|
-
|
|
720
|
-
"Show me the architecture summary"
|
|
345
|
+
---
|
|
721
346
|
|
|
722
|
-
|
|
723
|
-
# - Language breakdown
|
|
724
|
-
# - Module/package structure
|
|
725
|
-
# - Most-connected files (architectural hubs)
|
|
726
|
-
# - Entry points
|
|
727
|
-
```
|
|
347
|
+
## Cloud dashboard
|
|
728
348
|
|
|
729
|
-
|
|
349
|
+
[app.depwire.dev](https://app.depwire.dev) — full dependency graph, health score, dead code report, and AI codebase chat in the browser. No local setup required.
|
|
730
350
|
|
|
731
|
-
|
|
732
|
-
|
|
733
|
-
depwire viz
|
|
734
|
-
# Review the arc diagram — red arcs show files you touched
|
|
735
|
-
```
|
|
351
|
+
- Free for public repos
|
|
352
|
+
- Pro ($19/month) — unlimited repos, private repo support, AI codebase chat
|
|
736
353
|
|
|
737
|
-
|
|
354
|
+
---
|
|
738
355
|
|
|
739
|
-
|
|
356
|
+
## Roadmap
|
|
740
357
|
|
|
741
|
-
|
|
358
|
+
**Shipped**
|
|
359
|
+
- Arc diagram visualization
|
|
360
|
+
- 17 MCP tools
|
|
361
|
+
- Multi-language support (TypeScript, JavaScript, Python, Go, Rust, C, C#)
|
|
362
|
+
- Architecture health score
|
|
363
|
+
- Dead code detection
|
|
364
|
+
- Temporal graph
|
|
365
|
+
- What If simulation — CLI + browser UI
|
|
366
|
+
- Security scanner — graph-aware severity elevation
|
|
367
|
+
- Cross-language edge detection — REST API + subprocess
|
|
368
|
+
- Public SDK — `depwire-cli/sdk`
|
|
369
|
+
- Cloud dashboard — app.depwire.dev
|
|
370
|
+
- PR Impact GitHub Action
|
|
371
|
+
|
|
372
|
+
**Coming next**
|
|
373
|
+
- C# / .NET language support
|
|
374
|
+
- AI-suggested refactors
|
|
375
|
+
- VSCode extension
|
|
376
|
+
- Natural language architecture queries
|
|
377
|
+
|
|
378
|
+
---
|
|
379
|
+
|
|
380
|
+
## Security posture
|
|
381
|
+
|
|
382
|
+
Depwire is read-only. It never writes to, modifies, or executes your code.
|
|
383
|
+
|
|
384
|
+
- Parses with tree-sitter — the same parser used by VS Code and Zed
|
|
742
385
|
- Visualization server binds to localhost only
|
|
743
|
-
- No data leaves your machine
|
|
744
|
-
- Blocks access to sensitive system directories
|
|
386
|
+
- No data leaves your machine
|
|
387
|
+
- Blocks access to sensitive system directories
|
|
745
388
|
- npm packages published with provenance verification
|
|
746
389
|
|
|
747
390
|
See [SECURITY.md](SECURITY.md) for full details.
|
|
748
391
|
|
|
749
|
-
|
|
750
|
-
|
|
751
|
-
### ✅ Shipped
|
|
752
|
-
- [x] Arc diagram visualization
|
|
753
|
-
- [x] MCP server (17 tools)
|
|
754
|
-
- [x] Multi-language support (TypeScript, JavaScript, Python, Go, Rust, C)
|
|
755
|
-
- [x] File watching + live refresh
|
|
756
|
-
- [x] Auto-generated documentation (13 documents)
|
|
757
|
-
- [x] Dependency health score (0-100)
|
|
758
|
-
- [x] Dead code detection with confidence scoring
|
|
759
|
-
- [x] Temporal graph — watch your architecture evolve over git history
|
|
760
|
-
- [x] PR Impact GitHub Action (depwire-action v1.0.0)
|
|
761
|
-
- [x] Auto-detect project root (no path needed)
|
|
762
|
-
- [x] WASM migration (Windows support)
|
|
763
|
-
- [x] Cloud dashboard — [app.depwire.dev](https://app.depwire.dev)
|
|
764
|
-
- [x] What If simulation — simulate refactors before touching code
|
|
765
|
-
- [x] Security scanner — deterministic vulnerability detection with graph-aware severity
|
|
766
|
-
|
|
767
|
-
### Coming Next
|
|
768
|
-
- [ ] New language support (Java, C++, Ruby — community requested)
|
|
769
|
-
- [ ] Cross-language edge detection (API routes ↔ frontend calls)
|
|
770
|
-
- [ ] AI-suggested refactors
|
|
771
|
-
- [ ] Natural language architecture queries
|
|
772
|
-
- [ ] VSCode extension
|
|
773
|
-
|
|
774
|
-
## Cloud Dashboard
|
|
775
|
-
|
|
776
|
-
Prefer a browser interface? [app.depwire.dev](https://app.depwire.dev) gives you the full dependency graph, health score, dead code report, and AI codebase chat — without any local setup. Free tier available.
|
|
777
|
-
|
|
778
|
-
- **Free** for public repos
|
|
779
|
-
- **Pro** ($19/month) — unlimited repos + private repo support
|
|
392
|
+
---
|
|
780
393
|
|
|
781
394
|
## Contributing
|
|
782
395
|
|
|
783
|
-
Contributions welcome! Please note:
|
|
784
|
-
|
|
785
396
|
1. Fork the repository
|
|
786
397
|
2. Create a feature branch
|
|
787
398
|
3. Add tests for new functionality
|
|
788
399
|
4. Submit a pull request
|
|
789
400
|
5. Sign the CLA (handled automatically on your first PR)
|
|
790
401
|
|
|
791
|
-
|
|
402
|
+
---
|
|
792
403
|
|
|
793
404
|
## Author
|
|
794
405
|
|
|
795
406
|
**Atef Ataya** — AI architect, author, and creator of Depwire.
|
|
796
407
|
|
|
797
|
-
-
|
|
798
|
-
-
|
|
799
|
-
-
|
|
408
|
+
- [YouTube](https://www.youtube.com/@atefataya) — 600K+ subscribers covering AI agents, MCP, and LLMs
|
|
409
|
+
- [The Architect's Playbook: 5 Pillars](https://www.amazon.com/dp/B0GCHNW2W8)
|
|
410
|
+
- [LinkedIn](https://www.linkedin.com/in/atefataya/)
|
|
800
411
|
|
|
801
|
-
|
|
802
|
-
|
|
803
|
-
Depwire is licensed under the [Business Source License 1.1](LICENSE).
|
|
412
|
+
---
|
|
804
413
|
|
|
805
|
-
|
|
806
|
-
- **Cannot** be offered as a hosted/managed service to third parties
|
|
807
|
-
- **Converts** to Apache 2.0 on February 25, 2029
|
|
414
|
+
## License
|
|
808
415
|
|
|
809
|
-
|
|
416
|
+
[Business Source License 1.1](LICENSE) — free for personal and internal company use. Converts to Apache 2.0 on February 25, 2029.
|
|
810
417
|
|
|
811
|
-
|
|
418
|
+
Commercial licensing: atef@depwire.dev
|
|
812
419
|
|
|
813
|
-
|
|
420
|
+
---
|
|
814
421
|
|
|
815
|
-
|
|
816
|
-
- [tree-sitter](https://tree-sitter.github.io/tree-sitter/) — Fast, reliable parsing
|
|
817
|
-
- [graphology](https://graphology.github.io/) — Powerful graph data structure
|
|
818
|
-
- [D3.js](https://d3js.org/) — Data visualization
|
|
819
|
-
- [Model Context Protocol](https://modelcontextprotocol.io/) — AI tool integration
|
|
422
|
+
Built with [tree-sitter](https://tree-sitter.github.io/tree-sitter/), [graphology](https://graphology.github.io/), [D3.js](https://d3js.org/), and the [Model Context Protocol](https://modelcontextprotocol.io/).
|