arbor

Question

Arbor answer

If I change this symbol, what breaks?

Blast radius with depth, confidence, and risk level

Who calls this — directly and transitively?

Caller/callee traversal on the call graph

What's the shortest path between A and B?

A* path through real dependencies

Is this PR too risky to merge?

CI gate on blast-radius thresholds

Fix

What was wrong

Jest, Vitest and Mocha tests are callers

Calls inside describe/it/test callbacks belonged to no symbol, so arbor callers missed every test and diff/check reported that nothing tested a change. Each test and hook is now a function named after it, such as it: accepts two, that owns the calls in its callback. On the repro in #235, arbor callers decide went from 2 callers to 4.

Project-relative MCP paths

Tool output could include absolute paths from your machine. Every file path is now relative to the project, and the namespaced io.modelcontextprotocol/protocolVersion request key is read first.

Fix

What was wrong

Rust calls resolve

crate::jobs::enqueue(), Type::new(), self.helper() and calls inside assert!/format! produced no edge, so heavily used Rust functions reported no callers. Paths now resolve through the module tree, and macro arguments are read as code.

Per-symbol arbor diff

Every symbol in a touched file counted as changed, so adding a function to a busy file reported that file's whole blast radius. New symbols now carry none; only modified ones do. Tests that call the change are listed as worth running, not counted as impact.

--base and --staged

arbor diff, check and summary saw only uncommitted edits unless ARBOR_DIFF_BASE was set. --base origin/main compares against the merge base, which is what a pull request shows; --staged checks just what is staged.

Languages stay apart

A TypeScript enqueue could be reported as a caller of a Rust enqueue. Resolution stays within a language family, and callers/callees list each same-named definition separately.

No stale graphs

After a branch switch, answers came from the old branch's graph when no remaining file was newer than it. The graph now records the commit it was built from and refreshes when HEAD moves.

Inheritance edges

class Middle(Base) produced no edge, so changing a base class showed zero blast radius. extends/implements edges are emitted and inherited methods stay reachable.

Call cycles rank as one

A closed ring of functions filled the top of every centrality ranking. Cycles are condensed before PageRank.

HTTP bridge hardening

arbor bridge --http accepted cross-origin and DNS-rebinding requests. It now checks Origin/Host and requires JSON bodies.

Quieter bridge

The bridge re-indexed ignored build directories in a busy loop.

True downstream

v2.6.0

v3.0.0

179

0

163

178

0

161

161

0

133

143

22

133

122

22

119

36

22

61

16

22

46

Fix

Why it mattered

Colliding symbols are kept

SymbolTable used HashMap::insert, so a second handler, new, or process replaced the first. The loser had zero callers and was invisible to blast radius.

Resolution is deterministic

Same-directory locality was decided by iterating a HashMap. Rust seeds RandomState per process, so the same binary on the same input could build different edges between runs. Now asserted across eight fresh processes.

Edges carry confidence

A proven same-file call and a same-directory guess were identical evidence. Each edge now scores [0,1] by how it resolved.

Exported TS symbols indexed once

export_statement recursed into its children, then the generic loop recursed again — every exported symbol became two vertices sharing one node id. 133 phantom nodes on a 149-file app, 25% of the graph.

Method calls on untyped receivers resolve

obj.method() was dropped outright, leaving the graph nearly edgeless on TS/JS — and an empty graph reports a blast radius of zero, which reads as "safe" rather than "unknown".

Centrality is a percentile rank

Scores were divided by the graph maximum, so the top node was 1.0 by construction and a 0.6 threshold meant nothing consistent between repos. Adding one hub rescaled every other node.

Resolution is O(1), not O(refs × nodes × files)

Unresolvable references — stdlib and third-party calls, most call sites in real code — paid the worst case. Suffixes are now indexed.

Codebase

Before

After

TypeScript (149 files)

172 edges

196 (+14%)

Rust (arbor-graph)

116 edges

167 (+44%)

Change

Measured

PageRank rewrite — flat call-graph adjacency replaces per-iteration traversal

149.8ms → 6.6ms on a 10k-node graph (23x), verified side-by-side vs the old implementation

Parallel indexing — parse fans out across all cores, deterministic assembly

Arbor: 253ms → 95ms · tokio (178k LOC): 2.7s → 1.6s

Warm-start centrality — watcher recomputes seed from previous scores

Converges in ~2 rounds after a one-file patch instead of the full 20-iteration budget

Convergence early-exit

Iteration stops at 1e-9 max delta — the budget is a ceiling, not a sentence

Feature

What it does

MCP 2026-07-28

Stateless server/discover, response caching (ttlMs/cacheScope), dual-version fallback for 2025-03-26 clients

Tasks extension

tasks/get · tasks/update · tasks/cancel — cold-start indexing returns task handles, not errors

MCP Apps

Interactive blast-radius graph (ui://arbor/blast-radius) and architecture map (ui://arbor/architecture-map) inside agent hosts

HTTP transport

arbor bridge --http --port 3333 — stateless MCP behind load balancers

Real get_blast_radius

Git-diff-aware impact analysis via shared arbor-graph::compute_blast_radius

Pagination

offset / limit / hasMore on search_symbols and get_map

Benchmarks

Criterion suite + CI regression gate — see BENCHMARKS.md

Tier

Tools

Use when

Orientation

get_map

First call — token-budgeted project skeleton ranked by PageRank

Surgical

list_entry_points · get_callers · get_callees · search_symbols · get_file_graph · get_node_detail

Navigate to a specific symbol or file

Broad

get_logic_path · analyze_impact · find_path · get_knowledge_path

Trace dependencies, blast radius, paths

Agent-native

get_blast_radius · explain_symbol · audit_security · get_architecture_overview · batch_query

PR impact, onboarding, security audit, bulk lookup

Command

Description

arbor setup

One-shot init + index

arbor map

Ranked, token-budgeted project skeleton

arbor query <term>

Fuzzy symbol search (supports | OR)

arbor callers / callees <sym>

One-hop graph traversal. Same-named symbols are listed per definition; narrow with jobs::enqueue, Type.method or src/jobs.rs:enqueue

arbor entry-points

HTTP handlers, main, jobs, webhooks

arbor file-graph <path>

Symbols + edges in one file

arbor inspect <sym>

Full symbol detail

arbor path <a> <b>

Shortest call-graph path

arbor refactor <sym>

Blast radius before refactoring

arbor diff

Git-change impact report, per symbol: new symbols carry no blast radius. --base <ref> compares against the merge base (what a PR shows), --staged only staged changes

arbor check

CI safety gate (--max-blast-radius N, --base <ref>)

arbor summary

Auto-generate PR description (--base <ref>)

arbor agent review

Autonomous PR architecture review

arbor agent onboard

Codebase onboarding guide

arbor agent guard

Real-time architectural safety gate

arbor bridge

MCP server (add --http for HTTP transport)

arbor watch

Live re-index on file changes

arbor receipt list / show / undo

Plain-English receipts of what each agent turn changed, and undo for a turn (guide)

arbor hook claude

Wire Arbor into Claude Code: directives, receipts after every turn

arbor gui

Native desktop UI