Depwire

Your AI doesn't know your architecture. Depwire does.

What makes Depwire different

16 programming languages, plus Angular templates. Depwire parses symbols and builds dependency relationships across the constructs it supports. It records relationships it cannot resolve instead of inventing an edge.

Depwire builds a deterministic dependency graph from source parsing, without embeddings or similarity search. For a proposed change, it traverses the relationships present in that graph to show known dependents, import chains, and health movement. Results depend on the language constructs and files the parser can analyze.

Not a build graph either. Depwire tracks symbol-level relationships for What If simulation, graph-aware security scanning, and blast radius analysis.

Contents

• What makes Depwire different
• Performance evidence
• The problem
• Start here
• The infrastructure layer
• Tested on real-world projects
• What If simulation
• Security scanner
• Pre-action verification
• Structural diff between commits
• Visualization
• Temporal graph
• All commands
• MCP server — AI integration
• Cross-language edge detection
• Architecture health score
• Language support
• SDK
• Cloud dashboard
• VSCode Extension
• GitHub Action — PR Impact Analysis
• pre-commit / prek hook
• Depwire Action Token (DAT)
• Roadmap
• Security posture
• Paths and file counts

---

Depwire provides graph context to AI coding assistants. Parse a project to inspect recorded relationships, assess health, and simulate a proposed change.

⭐ If Depwire saves you from a broken build, star the repo — it helps this project grow.

---

Performance evidence

The previously published agent benchmark has been withdrawn after an audit found that the task prompt exposed its answer key, the scored file set was narrower than the change required by the monorepo, and one arm started in a different working directory. Three corrected exploratory sessions have since been run; they do not establish a performance or correctness advantage. No conclusion from the withdrawn runs should be cited.

Audit and corrected harness →

---

The problem

AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.

For example, you ask an AI assistant to delete a utility file. It deletes it without warnings.

Then the build reveals downstream consumers that still import it.

The assistant saw one file without inspecting those consumers.

This isn't a model problem. It's a context problem. The AI is flying blind.

---

The infrastructure layer

Depwire is the context and safety layer for AI-generated code.

Depwire builds a dependency graph from supported source constructs using tree-sitter and serves it to AI assistants through 24 MCP tools.

How it works:

• Local — the CLI analyzes source code on your machine and collects no usage telemetry. It does not upload source code, file names, graph data or analysis. Applicable security scans run dependency vulnerability and supply-chain checks by default; these may contact package registries and public advisory databases. connect_repo accesses GitHub when given a GitHub URL. The What If browser page loads D3 from a CDN. Cloud is a separate service.
• Security scanner — runs local code checks and applicable dependency audits by default; no Depwire API key is required.
• Token-efficient — Depwire serves pre-computed graph data so agents can request focused dependency context instead of broad file dumps.
• Deterministic — tree-sitter provides consistent structural parsing without relying on model inference.

---

Start here

npm install -g depwire-cli

Three commands for a supported codebase:

depwire whatif     # simulate a proposed change
depwire security   # scan for supported finding patterns
depwire viz        # view the recorded dependency graph

---

Tested on real-world projects

Project	Language	Files	Symbols	Edges	Health
google/guice	Java (multi-module, 13 modules)	647	30,592	10,081	31/100
honojs/hono	TypeScript	352	6,462	2,194	41/100
apache/commons-lang	Java (single-module)	624	29,723	9,037	—
pallets/flask	Python	79	2,005	851	—
dart-lang/shelf	Dart	108	1,639	219	—
rstudio/plumber	R	197	1,194	219	—
payloadcms/payload	TypeScript	645	9,292	3,511	—

Historical depwire parse runs on public repositories, last validated with v1.8.2 (June 2026).

Pre-1.9.0 measurement. v1.9.0 fixed parser bugs (double-emitted symbols in the TypeScript/Python/C#/C++/Java parsers, dropped type-only-import edges, false orphans) that directly affect symbol counts, edge counts, and health scores. Later releases changed graph contents and health methodology again. These numbers have not been re-measured and are not current results.

---

What If simulation

Know the blast radius before you touch anything.

depwire whatif . --simulate delete --target src/utils/encode.ts

Real output on honojs/hono — 352 files, 6,245 symbols:

Health Score:    41 → 41  (+0 → unchanged)
Affected Nodes:  29
Broken Imports:  30
• src/utils/jwt/jwt.ts imports decodeBase64Url
• src/adapter/aws-lambda/handler.ts imports encodeBase64
• src/utils/basic-auth.ts imports decodeBase64
[27 more...]
Removed Edges:   32

Pre-1.9.0 measurement — captured before the v1.9.0 parser fixes; not re-measured.

The simulation operates on a loaded graph without changing source files; loading or parsing the graph requires file I/O.

Five operations:

depwire whatif . --simulate delete --target src/utils/encode.ts
depwire whatif . --simulate move --target src/utils/encode.ts --destination src/core/encode.ts
depwire whatif . --simulate rename --target src/utils/encode.ts --destination src/utils/encoder.ts
depwire whatif . --simulate split --target src/services/auth.ts --symbols "validateToken,refreshToken"
depwire whatif . --simulate merge --target src/utils/helpers.ts --merge-target src/utils/formatters.ts

Run without --simulate to open the browser UI — side-by-side arc diagrams showing current vs simulated state.

---

Cross-module dependency intelligence

For multi-module Maven and Gradle projects, Depwire resolves imports across module boundaries — not just within a single module.

Example: simulating deletion of Injector.java in google/guice (a 13-module Java DI framework):

$ depwire whatif . --simulate delete --target core/src/com/google/inject/Injector.java

Action:          DELETE core/src/com/google/inject/Injector.java
Affected Nodes:  128
Broken Imports:  124  (cross-module: 106 across 10 extension modules)

Pre-1.9.0 measurement — google/guice is a Java project; the Java parser's double-emission bug (fixed in v1.9.0) affects this figure. Not re-measured.

Cross-module resolution lets impact analysis report supported relationships across module boundaries.

Supported build systems:

• Maven (pom.xml with <modules> declarations, recursive nested modules)
• Gradle (settings.gradle / settings.gradle.kts with include() declarations)

Both standard (src/main/java) and non-standard (src/) source layouts are supported.

---

Security scanner

Depwire's security scanner reports findings locally and can fail a configured CI gate.

depwire security .                        # full repo scan
depwire security . --target src/auth.ts   # single file
depwire security . --format sarif         # GitHub Security tab integration
depwire security . --fail-on high         # CI gate — exit 1 if HIGH or above
depwire security . --class secrets         # specific check only
depwire security . --no-dependency-audit   # skip dependency checks and their network requests

10 check categories — dependency CVEs, process safety, credential management, path safety, authentication safety, input validation, information disclosure, cryptography weaknesses, output encoding safety, and architecture-level risks.

Applicable security scans run dependency vulnerability and supply-chain checks by default; these may contact package registries and public advisory databases. To skip those checks and their network requests, use --no-dependency-audit; the other checks still run. The security_scan MCP tool and SDK accept dependencyAudit: false for the same behavior. Selecting classes that exclude dependency checks, such as --class secrets, also skips the audit request.

Graph-aware severity uses recorded reachability from MCP tools and HTTP routes when classifying findings.

Available as MCP tool security_scan and via depwire-cli/sdk.

---

Pre-action verification

Analyze a proposed change before applying it. Reports broken imports, cyclic-group changes when a resolved after-graph is available, health movement, and security findings. Export-only comparisons of edited content or unified diffs cannot establish cyclic-group safety: they return cyclicGroupChanges.status: not_comparable and do not certify the change as safe.

depwire verify-change --file src/auth.ts --content-from new-auth.ts
depwire verify-change --diff changes.patch
depwire verify-change --file src/auth.ts --content-from new-auth.ts --json
cat new-auth.ts | depwire verify-change --file src/auth.ts

CI integration:

depwire verify-change --diff pr.patch --fail-on-warnings --quiet
# exits 1 for medium risk, 2 for high risk

Available as MCP tool verify_change and CLI command depwire verify-change.

---

Structural diff between commits

Compare the dependency graph between any two git refs — branches, tags, commit hashes, HEAD~N.

depwire diff main feature/auth-refactor
depwire diff HEAD~5 HEAD --verbose
depwire diff v1.5.0 v1.6.0 --json | jq

The diff uses graph comparisons without an LLM. It temporarily stashes uncommitted changes and attempts to restore them after analysis; a failed restore is reported for manual recovery.

Options: --json (machine-readable), --verbose (every symbol/edge by name), --no-security / --no-health (faster runs).

---

Visualization

depwire viz

Interactive arc diagram of files and relationships present in the graph. Hover to inspect, click to filter, and export as PNG or SVG.

---

Temporal graph

depwire temporal

Watch recorded architecture change over git history. A timeline slider moves through commits and updates the arc diagram.

---

All commands

Command	Description
depwire viz	Interactive arc diagram in browser
depwire whatif	Simulate changes before touching code
depwire verify-change	Analyze a proposed change — broken imports, health delta, security, and comparison limits
depwire security	Scan for vulnerabilities — graph-aware severity
depwire health	0-100 architecture health score across 6 dimensions
depwire dead-code	Find dead-code candidates with confidence; JSON output includes reasonCode
depwire docs	Generate 13 architecture documents
depwire temporal	Visualize architecture evolution over git history
depwire parse	Parse and export dependency graph as JSON
depwire prompt	Get a graph-first workflow prompt for your AI agent
depwire diff	Structural diff between two git commits — symbols, edges, health, security
depwire mcp	Start MCP server for AI coding assistants

Commands accept a project path; depwire parse uses the supplied directory or the current directory when omitted.

depwire prompt — graph-first workflow for AI agents

# Get the graph-first workflow prompt for your agent
depwire prompt                    # generic
depwire prompt --tool claude      # Claude Code optimized
depwire prompt --tool cline       # Cline optimized
depwire prompt --tool codex       # Codex optimized

Paste the output as your agent's system context before starting a complex task.

---

MCP server — AI integration

Connect Depwire to any MCP-compatible AI tool. Your AI gets 24 tools it can call autonomously.

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "depwire": {
      "command": "npx",
      "args": ["-y", "depwire-cli", "mcp"]
    }
  }
}

Using a saved graph for MCP startup:

# Parse once (writes depwire-output.json)
depwire parse .

# Output defaults to the parsed project directory; --output takes precedence
depwire parse ./services/api --output ./artifacts

# MCP starts from the saved graph
depwire mcp .

# Flags:
depwire mcp . --from-cache   # error if no cache found
depwire mcp . --no-cache     # force full re-parse

depwire parse [directory] reads the specified directory, or cwd when omitted (without walking up to an ancestor project). It writes depwire-output.json to --output <dir> when provided, otherwise to [directory], otherwise cwd. Relative paths are resolved from cwd; --output is a directory.

Parse outcome	Exit code	Result
One or more files parsed successfully	0	Graph exported
Some files parsed, some failed	0	Partial graph exported; non-fatal warning on stderr
No files parsed (empty, unsupported, excluded, oversized, or all failed)	2	Clear stderr message; no graph exported
Directory traversal, graph construction, or output write failed	1	Error on stderr

SDK callers receive per-file failures in parseProject(...).errorFiles and must check both length and errorFiles. The exported graph format is unchanged; partial-parse diagnostics are not embedded in the JSON graph. An unsuccessful parse does not replace or delete a previous output file: CI must check the exit code before consuming that file.

Cursor — Settings → Features → Experimental → Enable MCP → Add Server:

• Command: npx
• Args: -y depwire-cli mcp

Auto-generated project context

After running depwire parse ., Depwire generates .depwire/AGENTS.md — a project-specific context file containing module structure, key files, health summary, and MCP quick-start commands.

To direct Claude Code to the generated context, reference it from your CLAUDE.md:

# In your project root CLAUDE.md:
echo "## Depwire Context" >> CLAUDE.md
echo "Read .depwire/AGENTS.md for codebase architecture." >> CLAUDE.md

The reference makes the generated project context available without an MCP tool call.

24 MCP tools

Tool	Description
connect_repo	Connect to any local project or GitHub repo
get_architecture_summary	High-level project overview
get_file_context	Full context — imports, exports, dependents. Includes cross-language connections.
get_dependencies	What does a symbol depend on?
get_dependents	What depends on this symbol?
get_symbol_info	Look up any symbol's details
search_symbols	Find symbols by name across the codebase
list_files	List all files with stats
impact_analysis	What breaks if you change a symbol? Cross-language edges included.
visualize_graph	Generate interactive arc diagram
get_health_score	0-100 health score with recommendations
find_dead_code	Dead-code candidates with confidence and reasonCode evidence
get_project_docs	Retrieve auto-generated codebase documentation
update_project_docs	Regenerate documentation on demand
get_temporal_graph	Architecture evolution over git history
simulate_change	Simulate move/delete/rename/split/merge before touching code. Returns health delta, broken imports, affected nodes. Cross-language edges included.
security_scan	Scan for vulnerabilities with graph-aware severity elevation. No API key required.
verify_change	Safety report before applying code changes. Returns broken imports, cyclic-group changes (or an explicit unavailable reason), health delta, affected files. Also available as depwire verify-change CLI.
claim_files	Multi-agent coordination: declare intent to modify files so other clients avoid conflicts.
release_files	Release a previously made file claim.
get_active_claims	Query who is currently working on what.
record_decision	Save a structured decision for future sessions to reference.
get_decisions	Retrieve past decisions by query, session, file, or tag.
affected_files	Find files and tests affected by changing a file or symbol.

.depwire/ runtime state

The coordination tools (claim_files, release_files, get_active_claims, record_decision, get_decisions) write runtime state to .depwire/claims.jsonl and .depwire/decisions.jsonl. Add these to your project's .gitignore:

.depwire/claims.jsonl
.depwire/decisions.jsonl

---

Cross-language edge detection

Depwire detects connections between files written in different languages.

For example, a supported TypeScript fetch('/api/users') call can match a Python @app.get('/api/users') route definition by path. That recorded edge can inform impact analysis if the route changes.

Supported patterns:

• REST API edges — fetch/axios calls matched to Express, FastAPI, Flask, Gin route definitions
• Subprocess edges — execSync/subprocess.run calls matched to target files in the graph

Recorded cross-language edges are used by What If simulation, impact analysis, security scanning, and visualization.

---

Architecture health score

The cyclicGroups dimension measures the proportion of graph-bearing files in mutually dependent groups, plus the size of the largest group. It reports group count, cyclic-file count, coverage, and largest-group size separately; group count does not affect the score. Groups use the existing health edge policy: ordinary type references are excluded, while legacy type-only import normalization is retained. Witness paths illustrate each group without enumerating all cycles.

The previous cycle count was incomplete and depended on traversal order. It has been removed, not redefined. Health results carry dimensions_v methodology marker; trends across methodology boundaries suppress improvement/regression deltas and explain the change. Graph format remains 2. This correction does not imply every old figure was wrong: acyclic graphs correctly had zero, and some counts coincided.

Simulation reports newly cyclic files, freed files, added/deleted cyclic files, group merges/splits and internal edge changes separately. Merging two existing groups is not a resolution; deleting a cyclic file is not freeing a surviving file.

depwire health .

The report scores six dimensions: coupling, cohesion, cyclic dependency groups, god files, orphans and dead code, and dependency depth. It includes letter grades, recommendations, and trends across comparable runs.

Note on v1.6.1 scoring change: The dead code scoring methodology was corrected in v1.6.1 to only count exported symbols with zero dependents as candidates for dead code. Previously, local variables and class internals were incorrectly included, inflating dead code ratios for codebases with internally-complex modules. Health scores from v1.6.1+ are not directly comparable to scores from earlier versions.

---

SDK

Depwire exposes a stable public API for programmatic use and CI pipelines:

npm install depwire-cli