codegraph-brain 0.7.0__tar.gz → 0.7.1__tar.gz

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/.github/workflows/autodoc.yml

@@ -26,7 +26,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Install CGIS
         run: uv sync

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/.github/workflows/ci.yml

@@ -18,7 +18,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Install Dependencies
         run: uv sync --group dev

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/.github/workflows/release-please.yml

@@ -51,7 +51,6 @@ jobs:
         uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39  # v3
         with:
           enable-cache: true
-          python-version: "3.12"
 
       - name: Build sdist and wheel
         run: uv build

codegraph_brain-0.7.1/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.7.1"
+}

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## [0.7.1](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.7.0...codegraph-brain-v0.7.1) (2026-07-31)
+
+
+### Documentation
+
+* add privacy policy ([#293](https://github.com/zaebee/codegraph-brain/issues/293)) ([33e45c2](https://github.com/zaebee/codegraph-brain/commit/33e45c2623d6d4a4c05106631fe2815ce1acf62e))
+* add the architecture audit offering ([#296](https://github.com/zaebee/codegraph-brain/issues/296)) ([086396d](https://github.com/zaebee/codegraph-brain/commit/086396dbfa569a5091439811d6ec00e1b094386f))
+
 ## [0.7.0](https://github.com/zaebee/codegraph-brain/compare/codegraph-brain-v0.6.0...codegraph-brain-v0.7.0) (2026-07-31)
 
 

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codegraph-brain
-Version: 0.7.0
+Version: 0.7.1
 Summary: Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP.
 Project-URL: Homepage, https://github.com/zaebee/codegraph-brain
 Project-URL: Repository, https://github.com/zaebee/codegraph-brain
@@ -133,7 +133,7 @@ The fastest path — no config files, no paths to wire up:
 /plugin install cgis@codegraph-brain
 ```
 
-That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis:ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
 
 ---
 
@@ -235,6 +235,20 @@ classDef externalNode fill:#fff3e0,stroke:#e65100,stroke-width:1px,stroke-dashar
 
 ---
 
+## 💼 Architecture Audit
+
+CGIS is free and you can run it yourself. If you would rather have the analysis than the tool, I run a fixed-price audit of your codebase's structure — authorisation coverage, blast radius, coupling, architectural drift — delivered in five working days.
+
+**[Read what's included →](docs/AUDIT.md)** — $2,400 fixed, with an explicit list of what the analysis cannot see.
+
+---
+
+## 🔒 Privacy
+
+CGIS collects nothing: no telemetry, no analytics, no account. Your code and the graph built from it stay on your machine. See [PRIVACY.md](PRIVACY.md).
+
+---
+
 ## 🛠️ Development
 
 ### Requirements

codegraph_brain-0.7.1/PRIVACY.md

@@ -0,0 +1,45 @@
+# Privacy Policy
+
+**Last updated:** 31 July 2026
+
+This policy covers the **CGIS Claude Code plugin** and the **`codegraph-brain`** package it installs.
+
+## The short version
+
+CGIS collects nothing. There is no telemetry, no analytics, no usage reporting, no crash reporting, and no account. Your source code and the graph built from it stay on your machine. Nothing is sent to the author of this software, and there is no server to send it to.
+
+## What runs where
+
+**On your machine.** CGIS parses your source files with Tree-sitter and writes the resulting graph to a SQLite file (`graph.db` by default) in your project directory. Parsing, storage and every query happen locally. The graph contains structural information derived from your code — file paths, symbol names, line numbers and the call relationships between them — and it never leaves your disk.
+
+**Over the network, once.** On first use the plugin fetches the `codegraph-brain` package from the Python Package Index using `uvx`. This is an ordinary package download. PyPI is operated by the Python Software Foundation and applies its own logging and privacy practices to that request; see the [PSF Privacy Notice](https://www.python.org/privacy/). After the download is cached, the plugin makes no further network requests.
+
+## Data we collect
+
+None.
+
+We do not collect, transmit, store or have access to: your source code, the graphs built from it, file or repository names, prompts, tool calls, IP addresses, machine identifiers, usage counts, error reports, or anything else. This is not a matter of policy but of architecture — the software has no code that sends data anywhere, and no infrastructure to receive it.
+
+## Guardian, and when data does leave your machine
+
+The `codegraph-brain` package also contains **Guardian**, a code reviewer that sends diffs and graph context to a large language model. **Guardian is not part of the Claude Code plugin**: the plugin neither ships nor invokes it, and it does nothing unless you configure it and run it deliberately, normally in CI.
+
+If you choose to use Guardian, you select the model provider yourself — Google Gemini, Mistral, Cohere, or a local Ollama instance — and supply your own credentials. In that case the code being reviewed is sent to whichever provider you chose, under **that provider's** privacy policy and terms, not this one. Choosing Ollama keeps it local. We never see that traffic and never receive a copy.
+
+Credentials for those providers are read from your environment and used only to call the provider they belong to. They are not logged, stored or transmitted anywhere else.
+
+## What CGIS never touches
+
+CGIS reads source files under the path you point it at. It does not read your SSH keys, cloud credentials, browser data, keychain, clipboard, shell history, or files outside the directory you ingest. The plugin registers no Claude Code hooks, so it observes nothing about sessions, prompts or tool calls beyond its own tool invocations.
+
+## Children
+
+This is a developer tool and is not directed at children.
+
+## Changes
+
+Material changes to this policy will be recorded in this file, and its history is public in the repository's git log.
+
+## Contact
+
+Questions about privacy: open an issue at [github.com/zaebee/codegraph-brain/issues](https://github.com/zaebee/codegraph-brain/issues), or email zaebuntu@gmail.com.

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/README.md

@@ -83,7 +83,7 @@ The fastest path — no config files, no paths to wire up:
 /plugin install cgis@codegraph-brain
 ```
 
-That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis-ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
+That ships the MCP server, a skill that teaches the agent *when* to query the graph instead of reading files, and `/cgis:ingest` to build the graph on first use. The server is pulled from PyPI on demand via `uvx`, so there is nothing to clone or build.
 
 ---
 
@@ -185,6 +185,20 @@ classDef externalNode fill:#fff3e0,stroke:#e65100,stroke-width:1px,stroke-dashar
 
 ---
 
+## 💼 Architecture Audit
+
+CGIS is free and you can run it yourself. If you would rather have the analysis than the tool, I run a fixed-price audit of your codebase's structure — authorisation coverage, blast radius, coupling, architectural drift — delivered in five working days.
+
+**[Read what's included →](docs/AUDIT.md)** — $2,400 fixed, with an explicit list of what the analysis cannot see.
+
+---
+
+## 🔒 Privacy
+
+CGIS collects nothing: no telemetry, no analytics, no account. Your code and the graph built from it stay on your machine. See [PRIVACY.md](PRIVACY.md).
+
+---
+
 ## 🛠️ Development
 
 ### Requirements

codegraph_brain-0.7.1/docs/AUDIT.md

@@ -0,0 +1,88 @@
+# 🔎 Architecture Audit
+
+**A measured read of your codebase's structure, delivered in five working days. $2,400 fixed.**
+
+CGIS is free and you can run it yourself. This is for teams who want the analysis rather than the tool: someone who has read a lot of these graphs telling you what yours says.
+
+---
+
+## What you get
+
+A written report, the graph itself, and ninety minutes on a call to walk through it.
+
+| Section | Measured with | The question it answers |
+| :--- | :--- | :--- |
+| **Authorisation coverage** | `cgis_audit_reachability` | Does every route handler actually reach its authz guard? |
+| **Blast radius** | `cgis_analyze_impact` | What breaks if we make the three changes we are planning? |
+| **Coupling and god-classes** | `cgis_metrics` | Which parts will fight back hardest during a refactor? |
+| **Architectural drift** | `cgis_drift` | How far has each domain moved from the pattern we said we follow? |
+| **Graph integrity** | `cgis_validate` | How much of this codebase is even amenable to static analysis? |
+
+The first row is the one that usually pays for the engagement. *"Is there a route in our API that reaches the database without passing a permission check?"* is a question with money attached, and nobody checks it by hand because on a few hundred endpoints it is a week of tedium. On the graph it is a traversal.
+
+The report names specific handlers, files and line numbers. It is not a maturity score out of ten.
+
+**You keep the graph.** The `graph.db` is handed over with the report, so your team can keep asking it questions after the engagement ends — including from Claude Code, via the plugin.
+
+---
+
+## How it runs
+
+1. **Access.** A read-only clone or a tarball. No production access, no credentials, no environment.
+2. **Ingest.** Your repositories go into a graph. If resolution comes out unusually low, you hear about it on day one, not in the report.
+3. **Analysis.** The five sections above, plus whatever the graph turns up that I did not expect. That last part is usually the interesting one.
+4. **Report.** Written, specific, with file and line references throughout.
+5. **Walkthrough.** Ninety minutes with whoever needs to act on it. Recorded if you want it.
+
+Five working days from receiving the code.
+
+---
+
+## Price
+
+**$2,400** for up to **three repositories** and **150,000 lines** of Python and TypeScript.
+
+Larger estates are quoted after a look at the tree — the honest number depends on how many resolution edge cases the code has, not on line count alone. There is no hourly rate and no change-order mechanism: the scope above is the scope.
+
+**Included:** the report, the graph, the walkthrough, and one round of follow-up questions by email within thirty days.
+
+**Not included:** implementing the fixes. If you want the drift gates wired into CI or Guardian reviewing your pull requests, that is separate work and we can talk about it after you have read the report — not before.
+
+---
+
+## What this is not
+
+The graph is static structure. That boundary is real, and it is better stated here than discovered halfway through.
+
+- **Not a penetration test.** Authorisation *coverage* means every handler has a static path to a guard. It does not mean the guard is correct, that the logic behind it is sound, or that the endpoint is unexploitable.
+- **Not a runtime analysis.** Nothing is executed. Behaviour that only appears under load, concurrency or real data is out of scope.
+- **Not a business-logic review.** The report says how your code is wired, not whether the wiring implements the right rules.
+- **Not language-complete.** Extractors cover Python and TypeScript. Vue, Astro, Go, Rust and everything else are invisible to the graph, and the report will say which parts of your codebase it could not see.
+- **Not a substitute for judgement.** An empty impact result means *no static callers found*, not *safe to delete*. Dynamic dispatch, registries and framework decorators do not appear in any static graph. The report flags where this matters instead of asserting a safety it cannot see.
+
+Roughly a tenth of call edges in a typical Python codebase cannot be resolved statically at all — they are calls on objects typed at runtime. That number is in the report too, because it tells you how much of the analysis to trust.
+
+---
+
+## Who this is for
+
+**A good fit if:** you have a Python or TypeScript codebase large enough that no one holds it in their head, you are planning a migration or a significant refactor, you are onboarding AI agents onto the codebase and getting confident nonsense back, or someone has asked whether your authorisation is actually complete and nobody can answer.
+
+**A poor fit if:** the codebase is small enough to read, the languages are outside the extractors, or what you actually need is a security assessment — in which case hire a security firm, and this is at best a first pass that tells them where to look.
+
+---
+
+## Evidence
+
+Before commissioning anything, read the [case study](CASE_STUDY.md). It is CGIS run against a real twelve-repository estate — 8,146 commits, four languages — with every figure measured and a section on what the analysis could not cover.
+
+If that page reads as honest to you, this engagement will run the same way. If it does not, we should not work together.
+
+---
+
+## Get in touch
+
+- **Email:** zaebuntu@gmail.com
+- **GitHub:** [open an issue](https://github.com/zaebee/codegraph-brain/issues) — fine for questions about scope, though most people prefer email for anything involving their own codebase
+
+Tell me roughly how large the codebase is and what you are trying to decide. If the audit is not the right thing for your situation, I will say so.

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/plugin/README.md

@@ -7,7 +7,7 @@ Gives Claude a deterministic semantic graph of your codebase instead of flat tex
 /plugin install cgis@codegraph-brain
 ```
 
-Then, in any repository, run `/cgis-ingest` once to build the graph.
+Then, in any repository, run `/cgis:ingest` once to build the graph.
 
 ## What it ships
 
@@ -15,7 +15,7 @@ Then, in any repository, run `/cgis-ingest` once to build the graph.
 | :--- | :--- |
 | MCP server `cgis` | 13 tools: impact analysis, flow tracing, structure, symbol search, metrics, architectural drift, authz reachability |
 | Skill `cgis` | Teaches the agent *when* to query the graph instead of reading files |
-| Command `/cgis-ingest` | Builds the graph on first use and reports what it found |
+| Skill `/cgis:ingest`  | Builds the graph on first use and reports what it found |
 
 ## What it does on your machine
 
@@ -42,3 +42,4 @@ Extractors exist for **Python** and **TypeScript** (`.py`, `.ts`, `.tsx`). Other
 - Source: [github.com/zaebee/codegraph-brain](https://github.com/zaebee/codegraph-brain)
 - Package: [pypi.org/project/codegraph-brain](https://pypi.org/project/codegraph-brain/)
 - Licence: MIT
+- Privacy: [PRIVACY.md](https://github.com/zaebee/codegraph-brain/blob/main/PRIVACY.md) — nothing is collected

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/plugin/skills/cgis/SKILL.md

@@ -31,7 +31,7 @@ The graph lives in `graph.db` in the project root, and every tool resolves that
 cgis_ingest(project_path="./src")
 ```
 
-Point it at the source root, not the repository root — ingesting `node_modules` or a virtualenv wastes time and pollutes the graph. `/cgis-ingest` does this for you and picks the right path.
+Point it at the source root, not the repository root — ingesting `node_modules` or a virtualenv wastes time and pollutes the graph. `/cgis:ingest` does this for you and picks the right path.
 
 Re-run `cgis_ingest` after any substantial change; it is incremental by default and skips unchanged files. A stale graph is worse than no graph, because it answers confidently and wrongly.
 

codegraph_brain-0.7.0/plugin/commands/cgis-ingest.md → codegraph_brain-0.7.1/plugin/skills/ingest/SKILL.md

@@ -1,6 +1,8 @@
 ---
+name: ingest
 description: Build or refresh the CGIS code graph for this repository
 argument-hint: "[source path — defaults to autodetected]"
+disable-model-invocation: true
 ---
 
 Build the CGIS semantic graph for this repository so the `cgis_*` tools can answer structural questions.

{codegraph_brain-0.7.0 → codegraph_brain-0.7.1}/pyproject.toml

@@ -7,7 +7,7 @@ packages = ["src/cgis"]
 
 [project]
 name = "codegraph-brain"
-version = "0.7.0"
+version = "0.7.1"
 description = "Semantic code graph for AI agents — deterministic FQN resolution, impact analysis and architectural drift gates, exposed over MCP."
 readme = "README.md"
 requires-python = ">=3.12"

codegraph_brain-0.7.0/.release-please-manifest.json

@@ -1,3 +0,0 @@
-{
-  ".": "0.7.0"
-}