depwire
OfficialThis server gives an AI assistant deterministic, symbol-level dependency-graph intelligence over a codebase — exploring structure, tracing dependencies and blast radius, simulating refactors, scanning security, scoring architecture health, and coordinating multiple agents.
Connect & explore the project —
connect_repo(local path or auto-cloned GitHub repo),get_architecture_summary,list_files,search_symbols,get_symbol_info,get_file_context(imports, exports, dependents, cross-language links; optional line-range slices)Trace dependencies & impact —
get_dependencies(what a symbol uses),get_dependents(what uses it),impact_analysis(direct + transitive blast radius of changing/renaming/removing a symbol),affected_files(affected files and covering tests)Simulate changes before touching code —
simulate_changefor delete/move/rename/split/merge, returning health delta, broken imports, and affected nodes;verify_changefor a pre-apply safety report on edited content or a unified diffScan for security vulnerabilities —
security_scanwith deterministic checks (CVEs, secrets, injection, path traversal, auth, crypto, XSS, etc.) and graph-aware severity elevation for reachable findingsAssess code quality —
get_health_score(0–100 across coupling, cohesion, cycles, god files, orphans, depth) andfind_dead_codewith confidence levelsVisualize & document —
visualize_graph(inline interactive arc diagram),get_temporal_graph(architecture evolution over git history),get_project_docsandupdate_project_docsCoordinate multiple agents —
claim_files,release_files,get_active_claimsfor file-locking, andrecord_decision/get_decisionsfor a shared decision log
Enables the MCP server to connect to and analyze repositories hosted on GitHub to build a cross-reference graph of symbols and imports.
Depwire
Your AI doesn't know your architecture. Depwire does.
What makes Depwire different
16 programming languages, plus Angular templates. Depwire parses symbols and builds dependency relationships across the constructs it supports. It records relationships it cannot resolve instead of inventing an edge.
Depwire builds a deterministic dependency graph from source parsing, without embeddings or similarity search. For a proposed change, it traverses the relationships present in that graph to show known dependents, import chains, and health movement. Results depend on the language constructs and files the parser can analyze.
Not a build graph either. Depwire tracks symbol-level relationships for What If simulation, graph-aware security scanning, and blast radius analysis.
Related MCP server: Graft
Contents
Depwire provides graph context to AI coding assistants. Parse a project to inspect recorded relationships, assess health, and simulate a proposed change.

⭐ If Depwire saves you from a broken build, star the repo — it helps this project grow.
Performance evidence
The previously published agent benchmark has been withdrawn after an audit found that the task prompt exposed its answer key, the scored file set was narrower than the change required by the monorepo, and one arm started in a different working directory. Three corrected exploratory sessions have since been run; they do not establish a performance or correctness advantage. No conclusion from the withdrawn runs should be cited.
The problem
AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.
For example, you ask an AI assistant to delete a utility file. It deletes it without warnings.
Then the build reveals downstream consumers that still import it.
The assistant saw one file without inspecting those consumers.
This isn't a model problem. It's a context problem. The AI is flying blind.
The infrastructure layer
Depwire is the context and safety layer for AI-generated code.
Depwire builds a dependency graph from supported source constructs using tree-sitter and serves it to AI assistants through 24 MCP tools.
How it works:
Local — the CLI analyzes source code on your machine and collects no usage telemetry. It does not upload source code, file names, graph data or analysis. Applicable
securityscans run dependency vulnerability and supply-chain checks by default; these may contact package registries and public advisory databases.connect_repoaccesses GitHub when given a GitHub URL. The What If browser page loads D3 from a CDN. Cloud is a separate service.Security scanner — runs local code checks and applicable dependency audits by default; no Depwire API key is required.
Token-efficient — Depwire serves pre-computed graph data so agents can request focused dependency context instead of broad file dumps.
Deterministic — tree-sitter provides consistent structural parsing without relying on model inference.
Start here
npm install -g depwire-cliThree commands for a supported codebase:
depwire whatif # simulate a proposed change
depwire security # scan for supported finding patterns
depwire viz # view the recorded dependency graphTested on real-world projects
Project | Language | Files | Symbols | Edges | Health |
Java (multi-module, 13 modules) | 647 | 30,592 | 10,081 | 31/100 | |
TypeScript | 352 | 6,462 | 2,194 | 41/100 | |
Java (single-module) | 624 | 29,723 | 9,037 | — | |
Python | 79 | 2,005 | 851 | — | |
Dart | 108 | 1,639 | 219 | — | |
R | 197 | 1,194 | 219 | — | |
TypeScript | 645 | 9,292 | 3,511 | — |
Historical
depwire parseruns on public repositories, last validated with v1.8.2 (June 2026).Pre-1.9.0 measurement. v1.9.0 fixed parser bugs (double-emitted symbols in the TypeScript/Python/C#/C++/Java parsers, dropped type-only-import edges, false orphans) that directly affect symbol counts, edge counts, and health scores. Later releases changed graph contents and health methodology again. These numbers have not been re-measured and are not current results.
What If simulation
Know the blast radius before you touch anything.
depwire whatif . --simulate delete --target src/utils/encode.tsReal output on honojs/hono — 352 files, 6,245 symbols:
Health Score: 41 → 41 (+0 → unchanged)
Affected Nodes: 29
Broken Imports: 30
• src/utils/jwt/jwt.ts imports decodeBase64Url
• src/adapter/aws-lambda/handler.ts imports encodeBase64
• src/utils/basic-auth.ts imports decodeBase64
[27 more...]
Removed Edges: 32Pre-1.9.0 measurement — captured before the v1.9.0 parser fixes; not re-measured.
The simulation operates on a loaded graph without changing source files; loading or parsing the graph requires file I/O.
Five operations:
depwire whatif . --simulate delete --target src/utils/encode.ts
depwire whatif . --simulate move --target src/utils/encode.ts --destination src/core/encode.ts
depwire whatif . --simulate rename --target src/utils/encode.ts --destination src/utils/encoder.ts
depwire whatif . --simulate split --target src/services/auth.ts --symbols "validateToken,refreshToken"
depwire whatif . --simulate merge --target src/utils/helpers.ts --merge-target src/utils/formatters.tsRun without --simulate to open the browser UI — side-by-side arc diagrams showing current vs simulated state.
Cross-module dependency intelligence
For multi-module Maven and Gradle projects, Depwire resolves imports across module boundaries — not just within a single module.
Example: simulating deletion of Injector.java in google/guice (a 13-module Java DI framework):
$ depwire whatif . --simulate delete --target core/src/com/google/inject/Injector.java
Action: DELETE core/src/com/google/inject/Injector.java
Affected Nodes: 128
Broken Imports: 124 (cross-module: 106 across 10 extension modules)Pre-1.9.0 measurement — google/guice is a Java project; the Java parser's double-emission bug (fixed in v1.9.0) affects this figure. Not re-measured.
Cross-module resolution lets impact analysis report supported relationships across module boundaries.
Supported build systems:
Maven (
pom.xmlwith<modules>declarations, recursive nested modules)Gradle (
settings.gradle/settings.gradle.ktswithinclude()declarations)
Both standard (src/main/java) and non-standard (src/) source layouts are supported.
Security scanner
Depwire's security scanner reports findings locally and can fail a configured CI gate.
depwire security . # full repo scan
depwire security . --target src/auth.ts # single file
depwire security . --format sarif # GitHub Security tab integration
depwire security . --fail-on high # CI gate — exit 1 if HIGH or above
depwire security . --class secrets # specific check only
depwire security . --no-dependency-audit # skip dependency checks and their network requests10 check categories — dependency CVEs, process safety, credential management, path safety, authentication safety, input validation, information disclosure, cryptography weaknesses, output encoding safety, and architecture-level risks.
Applicable security scans run dependency vulnerability and supply-chain checks by default; these may contact package registries and public advisory databases. To skip those checks and their network requests, use --no-dependency-audit; the other checks still run. The security_scan MCP tool and SDK accept dependencyAudit: false for the same behavior. Selecting classes that exclude dependency checks, such as --class secrets, also skips the audit request.
Graph-aware severity uses recorded reachability from MCP tools and HTTP routes when classifying findings.
Available as MCP tool security_scan and via depwire-cli/sdk.
Pre-action verification
Analyze a proposed change before applying it. Reports broken imports, cyclic-group changes when a resolved after-graph is available, health movement, and security findings. Export-only comparisons of edited content or unified diffs cannot establish cyclic-group safety: they return cyclicGroupChanges.status: not_comparable and do not certify the change as safe.
depwire verify-change --file src/auth.ts --content-from new-auth.ts
depwire verify-change --diff changes.patch
depwire verify-change --file src/auth.ts --content-from new-auth.ts --json
cat new-auth.ts | depwire verify-change --file src/auth.tsCI integration:
depwire verify-change --diff pr.patch --fail-on-warnings --quiet
# exits 1 for medium risk, 2 for high riskAvailable as MCP tool verify_change and CLI command depwire verify-change.
Structural diff between commits
Compare the dependency graph between any two git refs — branches, tags, commit hashes, HEAD~N.
depwire diff main feature/auth-refactor
depwire diff HEAD~5 HEAD --verbose
depwire diff v1.5.0 v1.6.0 --json | jqThe diff uses graph comparisons without an LLM. It temporarily stashes uncommitted changes and attempts to restore them after analysis; a failed restore is reported for manual recovery.
Options: --json (machine-readable), --verbose (every symbol/edge by name), --no-security / --no-health (faster runs).
Visualization

depwire vizInteractive arc diagram of files and relationships present in the graph. Hover to inspect, click to filter, and export as PNG or SVG.
Temporal graph

depwire temporalWatch recorded architecture change over git history. A timeline slider moves through commits and updates the arc diagram.
All commands
Command | Description |
| Interactive arc diagram in browser |
| Simulate changes before touching code |
| Analyze a proposed change — broken imports, health delta, security, and comparison limits |
| Scan for vulnerabilities — graph-aware severity |
| 0-100 architecture health score across 6 dimensions |
| Find dead-code candidates with confidence; JSON output includes |
| Generate 13 architecture documents |
| Visualize architecture evolution over git history |
| Parse and export dependency graph as JSON |
| Get a graph-first workflow prompt for your AI agent |
| Structural diff between two git commits — symbols, edges, health, security |
| Start MCP server for AI coding assistants |
Commands accept a project path; depwire parse uses the supplied directory or the current directory when omitted.
depwire prompt — graph-first workflow for AI agents
# Get the graph-first workflow prompt for your agent
depwire prompt # generic
depwire prompt --tool claude # Claude Code optimized
depwire prompt --tool cline # Cline optimized
depwire prompt --tool codex # Codex optimizedPaste the output as your agent's system context before starting a complex task.
MCP server — AI integration
Connect Depwire to any MCP-compatible AI tool. Your AI gets 24 tools it can call autonomously.
Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"depwire": {
"command": "npx",
"args": ["-y", "depwire-cli", "mcp"]
}
}
}Using a saved graph for MCP startup:
# Parse once (writes depwire-output.json)
depwire parse .
# Output defaults to the parsed project directory; --output takes precedence
depwire parse ./services/api --output ./artifacts
# MCP starts from the saved graph
depwire mcp .
# Flags:
depwire mcp . --from-cache # error if no cache found
depwire mcp . --no-cache # force full re-parsedepwire parse [directory] reads the specified directory, or cwd when omitted
(without walking up to an ancestor project). It writes depwire-output.json to
--output <dir> when provided, otherwise to [directory], otherwise cwd.
Relative paths are resolved from cwd; --output is a directory.
Parse outcome | Exit code | Result |
One or more files parsed successfully | 0 | Graph exported |
Some files parsed, some failed | 0 | Partial graph exported; non-fatal warning on stderr |
No files parsed (empty, unsupported, excluded, oversized, or all failed) | 2 | Clear stderr message; no graph exported |
Directory traversal, graph construction, or output write failed | 1 | Error on stderr |
SDK callers receive per-file failures in parseProject(...).errorFiles and must
check both length and errorFiles. The exported graph format is unchanged;
partial-parse diagnostics are not embedded in the JSON graph. An unsuccessful
parse does not replace or delete a previous output file: CI must check the exit
code before consuming that file.
Cursor — Settings → Features → Experimental → Enable MCP → Add Server:
Command:
npxArgs:
-y depwire-cli mcp
Auto-generated project context
After running depwire parse ., Depwire generates .depwire/AGENTS.md — a project-specific context file containing module structure, key files, health summary, and MCP quick-start commands.
To direct Claude Code to the generated context, reference it from your CLAUDE.md:
# In your project root CLAUDE.md:
echo "## Depwire Context" >> CLAUDE.md
echo "Read .depwire/AGENTS.md for codebase architecture." >> CLAUDE.mdThe reference makes the generated project context available without an MCP tool call.

24 MCP tools
Tool | Description |
| Connect to any local project or GitHub repo |
| High-level project overview |
| Full context — imports, exports, dependents. Includes cross-language connections. |
| What does a symbol depend on? |
| What depends on this symbol? |
| Look up any symbol's details |
| Find symbols by name across the codebase |
| List all files with stats |
| What breaks if you change a symbol? Cross-language edges included. |
| Generate interactive arc diagram |
| 0-100 health score with recommendations |
| Dead-code candidates with confidence and |
| Retrieve auto-generated codebase documentation |
| Regenerate documentation on demand |
| Architecture evolution over git history |
| Simulate move/delete/rename/split/merge before touching code. Returns health delta, broken imports, affected nodes. Cross-language edges included. |
| Scan for vulnerabilities with graph-aware severity elevation. No API key required. |
| Safety report before applying code changes. Returns broken imports, cyclic-group changes (or an explicit unavailable reason), health delta, affected files. Also available as |
| Multi-agent coordination: declare intent to modify files so other clients avoid conflicts. |
| Release a previously made file claim. |
| Query who is currently working on what. |
| Save a structured decision for future sessions to reference. |
| Retrieve past decisions by query, session, file, or tag. |
| Find files and tests affected by changing a file or symbol. |
.depwire/ runtime state
The coordination tools (claim_files, release_files, get_active_claims, record_decision, get_decisions) write runtime state to .depwire/claims.jsonl and .depwire/decisions.jsonl. Add these to your project's .gitignore:
.depwire/claims.jsonl
.depwire/decisions.jsonlCross-language edge detection
Depwire detects connections between files written in different languages.
For example, a supported TypeScript fetch('/api/users') call can match a Python @app.get('/api/users') route definition by path. That recorded edge can inform impact analysis if the route changes.
Supported patterns:
REST API edges — fetch/axios calls matched to Express, FastAPI, Flask, Gin route definitions
Subprocess edges — execSync/subprocess.run calls matched to target files in the graph
Recorded cross-language edges are used by What If simulation, impact analysis, security scanning, and visualization.
Architecture health score
The cyclicGroups dimension measures the proportion of graph-bearing files in
mutually dependent groups, plus the size of the largest group. It reports group
count, cyclic-file count, coverage, and largest-group size separately; group count
does not affect the score. Groups use the existing health edge policy: ordinary
type references are excluded, while legacy type-only import normalization is
retained. Witness paths illustrate each group without enumerating all cycles.
The previous cycle count was incomplete and depended on traversal order. It has
been removed, not redefined. Health results carry
dimensions_v methodology marker; trends across methodology boundaries
suppress improvement/regression deltas and explain the
change. Graph format remains 2. This correction does not imply every old
figure was wrong: acyclic graphs correctly had zero, and some counts coincided.
Simulation reports newly cyclic files, freed files, added/deleted cyclic files, group merges/splits and internal edge changes separately. Merging two existing groups is not a resolution; deleting a cyclic file is not freeing a surviving file.
depwire health .The report scores six dimensions: coupling, cohesion, cyclic dependency groups, god files, orphans and dead code, and dependency depth. It includes letter grades, recommendations, and trends across comparable runs.
Note on v1.6.1 scoring change: The dead code scoring methodology was corrected in v1.6.1 to only count exported symbols with zero dependents as candidates for dead code. Previously, local variables and class internals were incorrectly included, inflating dead code ratios for codebases with internally-complex modules. Health scores from v1.6.1+ are not directly comparable to scores from earlier versions.
SDK
Depwire exposes a stable public API for programmatic use and CI pipelines:
npm install depwire-cliimport {
parseProject,
buildGraph,
calculateHealthScore,
analyzeDeadCode,
generateDocs,
scanSecurity,
SimulationEngine,
detectCrossLanguageEdges,
searchSymbols,
getImpact,
getArchitectureSummary,
DepwireSDKVersion
} from 'depwire-cli/sdk';The SDK is the stable public API surface. All integrations should import from depwire-cli/sdk — never from internal paths.
Why Depwire
Depwire | RAG-based tools | LLM scanning | |
Approach | AST-derived dependency graph | Vector similarity | Direct file inspection |
Refactor context | Call and import relationships | Semantically retrieved chunks | Model-selected files |
Context shape | Focused graph queries | Retrieved text chunks | Variable |
Cross-language | REST + subprocess edges | Implementation-dependent | Model-dependent |
Security scanner | Graph-aware severity | Implementation-dependent | Model-dependent |
What If simulation | Available | Implementation-dependent | Model-dependent |
Multi-module JVM support | Cross-module resolution | Implementation-dependent | Model-dependent |
Local operation | Supported | Implementation-dependent | Implementation-dependent |
Language support
TypeScript, JavaScript, Python, Go, Rust, C, C#, Java, C++, Kotlin, PHP, Swift, Mojo, Ruby, Dart, R — 16 programming languages, plus Angular templates. Cross-language detection covers supported REST API and subprocess patterns. The parser descriptions below name supported constructs; they are not a guarantee that every relationship in an arbitrary repository is captured. The coverage boundary records checked and unchecked import forms for TypeScript, JavaScript, and Python. An independent source-AST CI ledger checks pinned import and re-export constructs in those three languages; it does not certify capture in arbitrary repositories or other languages.
Java / JVM — classes, interfaces, enums, records, annotations, inner classes, anonymous classes, lambda expressions, Maven pom.xml and Gradle build file dependency edges, Spring Boot cross-language edges (@GetMapping, @PostMapping, @RequestMapping), JAX-RS / Jakarta EE route detection, Spring WebFlux RouterFunction support.
C# / .NET — classes, interfaces, records, structs, enums, delegates, file-scoped namespaces, primary constructors, global usings, .csproj ProjectReference and PackageReference edges, ASP.NET Core cross-language edges (attribute routing + Minimal API).
C++ / Systems — classes, structs, unions, enums, namespaces, concepts, coroutines, C++20 modules, template support with parameter stripping. CMakeLists.txt, Conan, and vcpkg dependency edge parsing. Crow, Drogon, Pistache, and cpp-httplib cross-language route detection. Dead code detection with vtable and template exclusions. Health score checks: circular includes, missing header guards, god classes, raw pointer fields, missing virtual destructors. Security scanner: memory safety patterns, format string issues, memory management patterns, process execution safety patterns.
Kotlin / JVM — classes, data classes, sealed classes, objects, companion objects, value classes, type aliases, extension functions, enum classes, annotation classes. Coroutine awareness: suspend functions, GlobalScope detection, structured concurrency checks. build.gradle.kts, build.gradle, and settings.gradle.kts dependency parsing. Spring Boot, Ktor, Http4k, and Ktor Resources cross-language route detection. Android Retrofit outgoing edge detection. Dead code detection with Android lifecycle and Spring annotation exclusions. Security scanner: query safety patterns, credential management patterns, random number generation safety, not-null assertion abuse, Ktor missing auth blocks.
PHP / Web — functions, classes, methods, interfaces, traits, enums, namespaces, use statements, require/include dependency edges. Both procedural and OOP styles. Laravel (Route::get/post/put/delete/patch, middleware), Symfony (#[Route(...)]), Slim Framework, and WordPress REST API (register_rest_route) cross-language route detection. Guzzle and file_get_contents HTTP client edge detection. Dead code detection with WordPress hooks, Laravel service providers, Symfony controllers, and magic method exclusions (__construct, __get, __set, __call). Security scanner: query safety patterns, runtime evaluation safety patterns, process execution safety patterns, regex modifier vulnerabilities, serialization safety patterns, variable handling safety patterns, password hashing safety patterns, deprecated crypto libraries, weak PRNG in security contexts, credential management patterns.
Swift / Apple — functions, methods, initializers (init), deinitializers (deinit), classes, structs, enums, protocols, extensions, actors (Swift concurrency), properties (var, let), computed properties, type aliases, associated types. Package.swift (SPM) dependency parsing. Vapor, Hummingbird, and Perfect cross-language route detection. URLSession and Alamofire HTTP client edge detection. Dead code detection with AppDelegate/SceneDelegate lifecycle, SwiftUI View body, @IBAction/@IBOutlet, @objc, protocol conformance, Codable synthesis, XCTestCase, and @main entry point exclusions. Security scanner: query string safety via string interpolation, Process() execution safety, memory pointer safety patterns, UserDefaults storing sensitive data, CC_MD5/CC_SHA1 weak hashing, Insecure.MD5/SHA1 from CryptoKit, arc4random in crypto contexts, App Transport Security patterns, credential management patterns, hardcoded HTTP URLs.
Mojo / AI-native (strategic support) — fn (typed functions), def (Python-compatible functions), structs (value types), classes, traits (interfaces), alias (type aliases and compile-time constants), var/let declarations, import and from...import statements. Pattern-based parser (no tree-sitter-mojo available). Supports @value, @register_passable, @staticmethod decorators, inout/owned/borrowed parameter modifiers, SIMD/Tensor/DType type references. mojoproject.toml dependency parsing. Python interop detection (from python import). Cross-language route detection via Python framework interop (FastAPI/Starlette). Dead code detection with init/copyinit/moveinit lifecycle, trait implementations, MLIR dialect operations, and @export exclusions. Security scanner: Pointer[T] and DTypePointer memory safety, Python interop evaluation safety, uninitialized memory patterns, SIMD bounds safety, weak random via Python random module, hardcoded keys in alias declarations, hashlib via Python interop in crypto contexts.
Ruby / Web — method definitions (def, def self.), classes, modules, instance variables (@var), class variables (@@var), constants, attr_accessor/attr_reader/attr_writer, require/require_relative dependency edges, include/extend/prepend mixin edges, blocks, procs, lambdas, Struct and OpenStruct definitions, ActiveSupport::Concern support. Gemfile dependency parsing. Rails (get/post/put/patch/delete/resources/namespace in routes.rb), Sinatra (route + do blocks), Rack (map/run/use in config.ru), and Grape API cross-language route detection. Faraday, Net::HTTP, and HTTParty HTTP client edge detection. Dead code detection with Rails controller callbacks, ActiveRecord lifecycle callbacks, rake tasks, RSpec/Minitest methods, concerns (included/class_methods blocks), initialize, method_missing/respond_to_missing?, Pundit policy methods, and Devise strategy exclusions. Security scanner: string interpolation in database query methods, command execution safety patterns, runtime evaluation safety patterns, dynamic dispatch safety patterns, file operation safety patterns, YAML deserialization safety, Marshal deserialization safety, template rendering safety patterns, weak hash algorithms (Digest::MD5/SHA1), weak random (rand vs SecureRandom), credential management patterns, SSL verification patterns, weak cipher algorithms.
Dart / Flutter — classes, abstract classes, sealed classes (Dart 3.0+), mixins, extensions, enhanced enums, typedefs, records, top-level functions and variables, constructors (named and factory), methods, getters/setters, fields. import/export/part/part of/library directives with relative path resolution. pubspec.yaml dependency parsing. Flutter widget tree awareness: StatelessWidget, StatefulWidget, State subclass detection, build() method composition tracking. Shelf router, Aqueduct/Conduit, Angel framework, and Serverpod endpoint cross-language route detection. Dio, http package, Chopper (@Get/@Post), and Retrofit Dart (@GET/@POST) HTTP client edge detection. Dead code detection with Flutter widget lifecycle (initState, dispose, build, didChangeDependencies, didUpdateWidget), framework override methods, serialization methods (fromJson/toJson/copyWith), Riverpod providers, Bloc/Cubit event handlers, GetX controller lifecycle, test methods, and mock class exclusions. Security scanner: string interpolation in database queries, process execution safety, runtime reflection patterns, file path safety, JSON decoding validation, WebView JavaScript channel safety, platform channel validation, unencrypted local storage patterns, weak hashing for credentials, insecure random generation, credential management patterns, SSL certificate validation, insecure HTTP connections, and SharedPreferences vs FlutterSecureStorage patterns. Pattern-based parser (no tree-sitter-dart WASM available).
R / Statistics & Data Science — functions (including anonymous functions and closures), S3/S4/R5/R6 class definitions, methods, variable assignments (both <- and = forms), library/require/source dependency edges, NAMESPACE import/export directives, DESCRIPTION file dependency parsing. Pattern-based parser (tree-sitter-r unavailable on npm). Cross-language edge detection: plumber HTTP API route definitions (@get, @post, @put, @delete, @patch decorators) matched to client callers; Shiny reactive graph edges (server/UI function wiring, observe, reactive, eventReactive, renderXxx output bindings); outgoing HTTP client edges via httr (GET, POST, PUT, DELETE) and httr2 (request + req_perform); DBI database connection edges (dbConnect, dbGetQuery, dbExecute); reticulate Python interop edges (import_from_path, source_python, py_run_file). Dead code detection with S3/S4 generic registration exclusions, Shiny module server/UI functions, and testthat/RUnit test block exclusions. Security scanner: string interpolation in database query calls, system/system2/shell execution safety patterns, eval/parse runtime evaluation safety, file path handling safety, credential management patterns, weak PRNG in statistical-security contexts (sample/runif vs openssl for key material), and unvalidated input in plumber route handlers.
HTML / Angular templates — Angular component template parsing (*.component.html). Pairs each template with its sibling *.component.ts component automatically. Extracts component selectors (custom element tags), structural directives, attribute directives, event bindings, and pipe references from Angular template syntax. Emits uses edges from the template to the components and pipes it references. External/library components (Angular built-ins, PrimeNG, ngx-translate etc.) resolve to external:: markers and are excluded from the graph to avoid phantom nodes. Pattern-based parser (regex extraction of Angular template syntax).
GitHub Action — PR Impact Analysis
Depwire integrates into your CI/CD pipeline via the depwire-action GitHub Action.
When configured for pull requests, the Action posts a dependency impact report with recorded changes and health scores. It uses its configured CLI version, which may differ from the latest release.
Add to .github/workflows/depwire.yml:
name: Depwire PR Impact
on:
pull_request:
branches: [main]
permissions:
contents: read
pull-requests: write
jobs:
depwire:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: actions/setup-node@v4
with:
node-version: '20'
- uses: depwire/depwire-action@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}Block PRs that hurt your architecture:
- uses: depwire/depwire-action@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
fail-on-score-drop: 5GitHub Marketplace — depwire-action repo
pre-commit / prek hook
This repository ships a .pre-commit-hooks.yaml, so Depwire can be used as a remote hook with pre-commit and compatible runners such as prek — no repo: local wrapper around depwire-cli needed. Add to .pre-commit-config.yaml:
repos:
- repo: https://github.com/depwire/depwire
rev: v1.21.2
hooks:
- id: depwire
args: ["parse", ".", "--stats"]rev is a release tag that includes .pre-commit-hooks.yaml. The hook runs repository-level analysis (pass_filenames: false); parse . --stats is the default, so args is only needed to pass other CLI options or run another command, e.g. args: ["health", "."]. The runner installs the CLI from the tag on first use; subsequent parses can reuse .depwire/cache.db.
The hook only runs when a staged file is in a language or build manifest Depwire parses; commits that touch nothing parseable are reported as Skipped instead of failing with No parseable files found. Add depwire-output.json and .depwire/ to your .gitignore.
Cloud dashboard
app.depwire.dev — full dependency graph, health score, dead code report, and AI codebase chat in the browser. No local setup required.
Free for public repos
Pro ($9.99/month) — unlimited repos, private repo support, AI codebase chat
VSCode Extension
Search Depwire in the VSCode Extensions panel or:
ext install depwire.depwire-vscodeWorking on Mac and Windows. Free to install.
Free features:
Interactive dependency arc diagram
File and symbol counts
Architecture health score
Pro features ($9.99/month):
Health dimension breakdown (6 metrics)
Security scanner with graph-aware severity
Dead code detection
What If simulation
Verify Change — safety checks before committing
Structural diff between git commits
File context and dependency mapping
Temporal graph
Multi-agent coordination
Decision log
Subscribe at app.depwire.dev/subscribe.
Roadmap
Shipped
Arc diagram visualization
24 MCP tools
Multi-language support (TypeScript, JavaScript, Python, Go, Rust, C, C#, Java, C++, Kotlin, PHP, Swift, Mojo, Ruby, Dart, R, HTML/Angular)
Architecture health score
Dead code detection
Temporal graph
What If simulation — CLI + browser UI
Security scanner — graph-aware severity elevation
Cross-language edge detection — REST API + subprocess
Structural diff between commits —
depwire diffPublic SDK —
depwire-cli/sdkCloud dashboard — app.depwire.dev
PR Impact GitHub Action
VSCode extension — Mac + Windows, marketplace
HTML/Angular template parsing
Constructor/field dependency injection parsing (Angular services,
injectsedge kind)Windows path normalization for all MCP tools
verify_changewith explicit comparison limits for edited content and diffsSQLite graph cache for faster warm parses
Fast MCP startup from persisted
depwire-output.jsondepwire prompt— workflow prompt for AI agentsAuto-generated
.depwire/AGENTS.mdproject context afterdepwire parse
Coming next
AI-suggested refactors
Natural language architecture queries
Security posture
The parser reads source files without modifying or executing them. CLI commands can write derived artifacts such as graph output, the parse cache, and .depwire/AGENTS.md; coordination tools write their own runtime state.
Parses supported grammars with tree-sitter; some languages and Angular templates use pattern-based parsers
Visualization server binds to localhost only
The CLI does not upload source code, file names, graph data or analysis, and collects no usage telemetry. Applicable security scans perform dependency checks by default and may contact external vulnerability services.
connect_repoaccesses GitHub when given its URL; the What If browser page loads D3 from a CDN. Cloud is a separate serviceBlocks access to sensitive system directories
See SECURITY.md for full details.
Contributing
Fork the repository
Create a feature branch
Add tests for new functionality
Submit a pull request
Sign the CLA (handled automatically on your first PR)
Author
Atef Ataya — AI architect, author, and creator of Depwire.
YouTube — videos covering AI agents, MCP, and LLMs
Depwire Action Token (DAT)
The Depwire Action Token (DAT) is a draft specification for signing AI agent actions. A CLI reference implementation is in progress; current Depwire releases do not issue DAT audit trails for every tool call, file change, or delegation.
License
Business Source License 1.1 — free for personal and internal company use. Converts to Apache 2.0 on February 25, 2029.
Commercial licensing: atef@depwire.dev
Built with tree-sitter, graphology, D3.js, and the Model Context Protocol.
Paths and file counts
Graph file paths, symbol-ID path prefixes, and file paths emitted by impact,
affected, verify-change, whatif, dead-code, security, and MCP tools use
POSIX / separators on every platform, relative to the analyzed project root.
Native absolute paths remain appropriate for filesystem IO, the projectRoot
metadata field, and output-directory arguments. Backslashes and leading ./ in
file queries are accepted. Absolute queries require the matching graph project
root. Filename case is preserved; distinct POSIX filenames are not case-folded.
The shared graph ingress boundary canonicalizes parsed records (including cache
records and resolver hints) before inter-file resolution, graph construction,
and JSON restoration. Watcher updates use that boundary too. SDK consumers that
construct graphology graphs directly must use canonical keys or load through
deserializeGraph; existing JSON graphs are normalized when loaded.
affected_files returns an error when a file cannot be found in the graph
(including excluded files or files with no graph nodes). A successfully resolved
file with no dependents returns an empty result. Check errors before interpreting
an empty result as a clean analysis. verify-change counts unique canonical
paths, including the changed file itself, in its blast radius.
Graph files /
fileCount/totalFiles: unique files represented by graph nodes, including structural file nodes. Architecture summaries, documentation, graph JSON, and MCP use this definition. Filtered file listings count their returned subset.Parsed files /
parsedFileCount(JSON metadata) /parsedFiles(MCP architecture overview): files successfully parsed, including those with no graph nodes. Failures remain in SDKerrorFilesand do not count as parsed. Older JSON may lack this count; it is omitted rather than inferred. Incremental watcher mutations invalidate this count until the next full parse.
For example, 58 successful parses with three comment-only files produce
Parsed files: 58 and Graph files: 55. Architecture and MCP report 55 graph
files. This repository's architecture CLI entry is
depwire docs <path> --include architecture --stats; there is no standalone
architecture command. depwire parse <path> --stats prints graph statistics.
Graph format version is 2. The resolution cache is versioned independently; resolution changes invalidate older cached parse records without changing the graph format.
Available Tools
24 toolsaffected_filesA
Find all files affected by a change to a specific file or symbol. Includes test files that cover the affected code. Use this before running tests to know which test files to execute.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Relative path of the changed file (e.g., 'src/auth/token.ts') | |
| max_depth | No | Maximum traversal depth (default: 5) | |
| tests_only | No | Return only test files (default: false) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does disclose useful behavior: it includes test files and is intended for pre-test execution. However, it does not state that the operation is read-only, what the return structure looks like, or whether it traverses the full dependency graph (despite max_depth being an input). This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: the first states the core function, the second adds the test-file detail, and the third gives the operational context. There is no wasted text, and the most identifying information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-style query tool with fully documented parameters, the description is nearly complete: it explains the tool's purpose, a key behavioral feature (test files), and the practical context. The only missing context is an explicit statement about the return value format and exclusions vs alternatives, but the tool is simple enough that this does not block correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented. The description adds no extra parameter-level meaning beyond implying the main input is a changed file path, which aligns with the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Find'), a specific resource ('all files affected by a change to a specific file or symbol'), and a notable inclusion ('test files'). It clearly distinguishes this tool from sibling search tools like get_dependents or get_file_context by emphasizing test-file coverage and its purpose for test execution.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit when-to-use context: 'Use this before running tests to know which test files to execute.' This is clear context, though it does not explicitly name alternatives or state when not to use this tool versus impact_analysis or simulate_change.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
claim_filesA
Multi-agent coordination: declare intent to modify files so other MCP clients see the claim and avoid conflicts. Claims expire after a configurable TTL.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Optional human-readable reason for the claim | |
| file_paths | Yes | Files to claim | |
| session_id | Yes | Identifies the calling agent/session | |
| ttl_minutes | No | Time-to-live in minutes (default 30, max 240) | |
| depwire_action_token | No | Optional, reserved for future DAT integration |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that claims are visible to other MCP clients and expire after a configurable TTL, which is useful. It omits details about overlapping claims, idempotency, failure behavior, or any permissions needed, leaving some behavioral ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core purpose front-loaded and the TTL lifecycle detail included without filler. Every sentence adds meaningful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is enough for an agent to understand the tool's role and select it, but it lacks details about return values, claim conflicts, and the lifecycle interaction with release_files/get_active_claims. Given the absence of an output schema and annotations, some gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters. The description adds no parameter-level detail, but it also does not need to since the schema handles it adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action and object: 'declare intent to modify files,' and explains the coordination goal so other MCP clients see the claim and avoid conflicts. This clearly distinguishes claim_files from siblings like release_files or get_active_claims.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: before modifying files in a multi-agent environment. However, it does not explicitly name alternatives like release_files or get_active_claims, nor does it state when not to use it, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
connect_repoB
Connect Depwire to a codebase for analysis. Accepts a local directory path or a GitHub repository URL. If a GitHub URL is provided, the repo will be cloned automatically. This replaces the currently loaded project.
| Name | Required | Description | Default |
|---|---|---|---|
| source | Yes | Local directory path (e.g., '/Users/me/project') or GitHub URL (e.g., 'https://github.com/vercel/next.js') | |
| subdirectory | No | Subdirectory within the repo to analyze (optional, e.g., 'packages/core/src') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden. It does disclose two consequential behaviors—automatic cloning for GitHub URLs and replacement of the currently loaded project—which are genuinely important for an agent to know before invoking it. However, it stays silent on failure modes, private-repo/auth requirements, the time cost of cloning, and what 'replaces' implies for any existing analysis state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each carrying distinct information: the tool's purpose, the accepted input forms, and the cloning plus replacement behaviors. There is no filler or redundancy, though the critical replacement side effect is tail-positioned rather than flagged up front.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter tool with no annotations and no output schema, the description fully covers how to invoke it and names the key side effect. But it omits any indication of what the tool returns on success or failure, and with no output schema and no annotations that information is not available elsewhere.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: both 'source' (with examples of local path and GitHub URL) and 'subdirectory' (with example) are already well documented in the schema. The description adds no new parameter-level meaning beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening phrase 'Connect Depwire to a codebase for analysis' pairs a specific verb with a clear resource and purpose, and the rest of the description pins down the two accepted input forms (local path or GitHub URL). It reads clearly as the project-loading/setup tool among siblings that all operate on an already-loaded project, though it never explicitly contrasts itself with those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys the core usage context: this is the tool to load the codebase under analysis, accepting either a local directory or a GitHub URL. However, it never explicitly states when not to use it, names an alternative, or explains prerequisites such as prior project state, leaving routing decisions largely to the agent's inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_dead_codeA
Find potentially dead code — symbols that are defined but never referenced anywhere in the codebase. Returns symbols categorized by confidence level (high, medium, low). High confidence means strong evidence the symbol is unused; low confidence means the symbol is in a category the graph models weakly (types, constructors, framework-invoked code). Use this to identify cleanup opportunities.
| Name | Required | Description | Default |
|---|---|---|---|
| confidence | No | Minimum confidence level to return (default: medium) | medium |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does a good job disclosing output semantics: it explains why 'low' confidence exists (the graph models types, constructors, and framework-invoked code weakly). That caveat is genuinely useful for interpreting results, though it says nothing about read-vs-write nature or performance characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with zero filler, front-loaded with the core definition followed by return-value framing and the interpretation caveat. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must describe returns, and it does (symbols categorized by confidence). It stops short of describing the symbol payload fields or result format, but is otherwise sufficient for a single optional-parameter read query.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (baseline 3), but the description meaningfully expands on the single 'confidence' parameter by defining what high/medium/low evidence actually signify. This adds real semantic value beyond the schema's terse 'Minimum confidence level to return'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Find ... dead code — symbols that are defined but never referenced anywhere in the codebase') with a precise definition of what dead code means. This resource is unique among the siblings (get_symbol_info, search_symbols, impact_analysis), so an agent can distinguish it without sibling naming.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It offers a single usage pointer, 'Use this to identify cleanup opportunities,' which gives context but no exclusions or explicit alternatives. It never says when NOT to use it (e.g., for correctness vs. cleanup analysis) or which sibling to prefer. Implied usage only.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_active_claimsA
Query who is currently working on what. Returns active file claims, useful for orchestrator agents deciding what to delegate.
| Name | Required | Description | Default |
|---|---|---|---|
| filter_by_file | No | Only return claims affecting this file | |
| include_expired | No | Include expired claims (default false) | |
| filter_by_session | No | Only return claims from this session |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It clearly signals a read-only operation through 'Query' and states the return type ('active file claims'). It does not detail expired-claim behavior or output structure, but it is not misleading and covers the core behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences with no filler. It front-loads the core query action and immediately states the result type and use case, making every sentence valuable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with three optional parameters, the description covers purpose, return concept, and usage context. The schema fully documents parameters. It does not describe edge cases like expiration or result ordering, but those are not essential for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for all three optional parameters, so the schema already documents parameter meaning. The tool description adds no additional parameter-level detail, placing it at the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Query') and names the resource ('active file claims'), while explaining the intended use for orchestrator delegation. It is distinguishable from sibling mutation tools like claim_files and release_files because it is explicitly a read-only lookup, though it does not name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use it: 'useful for orchestrator agents deciding what to delegate.' It does not explicitly state when not to use it or name alternative tools, but the context is sufficient for a simple read query.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_architecture_summaryA
Get a high-level overview of the project's architecture — file count, symbol count, most connected files, dependency hotspots, and orphan files.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It clearly discloses what the tool returns (file count, symbol count, connectivity metrics, hotspots, orphans), which is the core behavioral expectation. It does not discuss cost or performance, but for a simple read-only overview tool this is a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one carefully constructed sentence that leads with the main purpose and then efficiently enumerates the specific summary elements. Every phrase adds value and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description provides a solid list of what the agent will receive, which is enough to set expectations. It does not define the exact return format, but the itemization is sufficiently complete for an overview tool and no additional context seems essential.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema coverage is 100%, so there is no parameter information for the description to add. The description appropriately says nothing about parameters, matching the baseline of 4 for parameterless tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the action ('Get') and resource ('project's architecture'), then lists concrete outputs: file count, symbol count, most connected files, dependency hotspots, and orphan files. This distinguishes it from sibling tools like list_files, get_dependencies, and find_dead_code, whose scopes are narrower or differently focused.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'high-level overview' implies the tool is for architecture-level understanding rather than detailed file-level queries, but the description does not explicitly state when to prefer it over alternatives or mention any prerequisites or exclusions. Usage context is only implied, not stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_decisionsA
Retrieve past decisions matching a query. Lets agents see what previous agents (or itself in a previous session) decided about similar problems.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results to return (default 20, max 100) | |
| query | No | Free-text search across context, decision, reasoning fields | |
| since | No | ISO-8601 timestamp, only decisions after this time | |
| filter_by_tag | No | Only decisions with this tag | |
| filter_by_file | No | Only decisions affecting this file | |
| filter_by_session | No | Only decisions from this session |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. 'Retrieve' and 'see what previous agents decided' clearly signal a non-mutating read operation and add cross-session context. It does not discuss auth, rate limits, or output format, but for a simple getter those omissions are minor.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states exactly what the tool does, and the second explains why it matters. Information is front-loaded and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only query tool with six optional, fully documented parameters, this description is nearly sufficient. It would be slightly more complete with an explicit note about the returned decision records, since there is no output schema, but 'Retrieve past decisions' adequately covers the core expectation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already fully documented. The description adds no additional meaning beyond naming the query concept, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Retrieve past decisions matching a query') and clarifies the intent: seeing what previous agents or earlier sessions decided. This clearly distinguishes it from sibling tools like record_decision, which writes decisions rather than reading them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence implies when to use the tool: when an agent wants to learn from similar past decisions. However, it does not explicitly state when not to use it or name alternatives such as record_decision, so usage guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dependenciesA
Get all symbols that a given symbol depends on (what does this symbol use/import/call?). Pass a symbol name (e.g., 'Router') or a fully qualified ID (e.g., 'src/router.ts::Router') for exact matching. If multiple symbols share the same name, returns all matches for disambiguation.
| Name | Required | Description | Default |
|---|---|---|---|
| symbol | Yes | Symbol name (e.g., 'Router') or full ID (e.g., 'src/router.ts::Router') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. Describes disambiguation for duplicate names, but omits output format, safety, or auth requirements. Adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with purpose, no redundancy. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of output schema, the description should hint at the return format (e.g., list of symbol IDs). It is adequate for a simple query tool but could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with description. The tool description adds concrete examples ('Router', 'src/router.ts::Router') and explains matching behavior, adding value beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool retrieves symbols that a given symbol depends on, with a parenthetical clarifying imports/calls. Distinguishes from sibling 'get_dependents' which would be the inverse.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear input format (name or full ID) and disambiguation behavior. Lacks explicit when-not or alternatives, but context makes usage clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_dependentsA
Get all symbols that depend on a given symbol (what uses this symbol?). Pass a symbol name (e.g., 'Router') or a fully qualified ID (e.g., 'src/router.ts::Router') for exact matching. If multiple symbols share the same name, returns all matches for disambiguation.
| Name | Required | Description | Default |
|---|---|---|---|
| symbol | Yes | Symbol name (e.g., 'Router') or full ID (e.g., 'src/router.ts::Router') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It does disclose an important behavior: if multiple symbols share a name, all matches are returned for disambiguation. It also mentions exact-matching behavior for fully qualified IDs. However, it does not describe what happens when a symbol is not found, whether the result is grouped, or how matches are structured.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences with no filler. The core purpose is front-loaded, followed by parameter usage guidance, and then the disambiguation behavior. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no annotations and no output schema, the description provides the key input semantics, matching behavior, and disambiguation policy. It does not describe the exact return format or error behavior, but the tool's purpose is simple enough that the description is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents the single 'symbol' parameter. The description adds examples and clarifies the difference between a simple name and a fully qualified ID, which adds some value. Still, it mostly restates the schema meaning, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action and resource: 'Get all symbols that depend on a given symbol.' The parenthetical 'what uses this symbol?' reinforces the direction of the relationship. It does not explicitly differentiate from sibling tools like get_dependencies, though the direction is clear enough to avoid major confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: whenever you need to find dependents of a symbol. It explains how to pass either a simple symbol name or a fully qualified ID for exact matching, which is useful context. However, it does not explicitly contrast this with similar sibling tools such as get_dependencies or search_symbols, nor does it state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_file_contextA
Get complete context about a file — all symbols defined in it, all imports, all exports, and all files that import from it. Includes cross-language connections (REST API calls, subprocess invocations). Supports startLine/endLine for reading large files in chunks.
| Name | Required | Description | Default |
|---|---|---|---|
| endLine | No | Optional: end line number (1-based, inclusive) to return only a slice of file content | |
| filePath | Yes | Relative file path (e.g., 'services/UserService.ts') | |
| startLine | No | Optional: start line number (1-based) to return only a slice of file content |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It clearly explains what the tool returns and also discloses the line-range slicing behavior for large files. It does not mention read-only status explicitly, but the verb 'Get' and the content described strongly signal a non-mutating analysis operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The main purpose is front-loaded, and the subsequent details are organized by scope of returned context, followed by parameter use-case. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only context retrieval tool with no output schema, the description is complete: it specifies input file path and optional line slicing, enumerates the returned content categories, and even mentions cross-language connections. An agent has enough information to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameters are already well-documented. The description adds value by explaining that startLine/endLine exist for chunked reading of large files, which gives practical context beyond the schema's 'return only a slice' wording.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') with a clear resource ('complete context about a file') and enumerates distinctive components: symbols, imports, exports, dependents, and cross-language connections. This allows an agent to distinguish it from narrower siblings like get_symbol_info, get_dependencies, and get_dependents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—when complete file context is needed—but it does not explicitly state when to prefer alternatives or when not to use it. There are no exclusion criteria or named sibling comparisons, so the guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_health_scoreA
Get a 0-100 health score for the project's dependency architecture. Scores coupling, cohesion, circular dependencies, god files, orphan files, and dependency depth. Returns overall score, per-dimension breakdown, and actionable recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It clearly explains what the tool computes, the output format (overall score, per-dimension breakdown, recommendations), and the dimensions analyzed. It does not explicitly state whether the operation is read-only or has side effects, but the verb 'Get' and the tool name strongly imply a non-mutating analysis.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The first sentence front-loads the core purpose (0-100 health score for dependency architecture), and the second efficiently enumerates the scoring dimensions and the return format. Every sentence contributes valuable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description fully explains the return value (overall score, dimensions, recommendations) given that no output schema exists. It clearly scopes the analysis to dependency architecture, which is sufficient for tool selection. It could slightly improve by hinting at what not to use it for or naming a sibling, but nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and the input schema is an empty object, so there are no parameter descriptions to supplement. With 0 params, a baseline of 4 is appropriate; the description confirms that the tool operates on 'the project' without needing further input specification.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('health score for the project's dependency architecture'), clearly distinguishing it from siblings by emphasizing a numeric 0-100 score and actionable recommendations. The listed evaluation dimensions (coupling, cohesion, circular dependencies, etc.) further make the tool's purpose concrete and distinct from other analysis tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when you need a health score of dependency architecture) but gives no explicit exclusions or alternative tools. Sibling tools like get_architecture_summary or get_dependencies serve different purposes, but the description doesn't state when NOT to use this tool or point to an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_project_docsA
Retrieve auto-generated codebase documentation. Returns architecture overview, code conventions, dependency maps, and onboarding guides. Documentation must be generated first with depwire docs command.
| Name | Required | Description | Default |
|---|---|---|---|
| doc_type | No | Document type to retrieve: 'architecture', 'conventions', 'dependencies', 'onboarding', or 'all' (default: 'all') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It does add useful context by stating the tool only retrieves pre-generated docs and listing the returned categories, but it does not disclose failure behavior when docs are missing, authentication needs, or response shape. Useful but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences deliver the core action, output contents, and the prerequisite without filler. The most important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-style tool with one optional parameter and no output schema, the description covers what is returned and the precondition. It is slightly incomplete in not stating behavior when docs have not been generated and in not routing among overlapping siblings, but it is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter doc_type is fully documented in the input schema (100% coverage), so the description doesn't need to add much. It aligns with the listed content types but provides no additional meaning beyond the schema's enum values and default.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource ('Retrieve auto-generated codebase documentation') and enumerates the content types returned. It doesn't explicitly differentiate from get_architecture_summary, a sibling that overlaps on 'architecture overview', so it falls just short of full sibling separation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a concrete prerequisite ('Documentation must be generated first with `depwire docs` command'), which helps an agent know when calling is valid. However, it provides no guidance on when to prefer this over siblings like get_architecture_summary or get_dependencies, so selection guidance is incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_symbol_infoA
Look up detailed information about a symbol (function, class, variable, type, etc.) by name. Pass a symbol name (e.g., 'Router') or a fully qualified ID (e.g., 'src/router.ts::Router') for exact matching. If multiple symbols share the same name, returns all matches for disambiguation.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | The symbol name to look up (e.g., 'UserService') or full ID (e.g., 'src/services/UserService.ts::UserService') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It discloses two meaningful behaviors: exact matching via name or fully qualified ID, and returning all matches when names collide. It does not state what happens when no symbol is found, whether the operation is read-only, or what fields of 'detailed information' will be returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no filler: purpose, input format, and collision behavior. The most important information is front-loaded, and every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter lookup with no output schema and no annotations, the description covers the main selection and invocation needs but leaves gaps: no return shape, no not-found behavior, and no explicit side-effect declaration. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the name parameter fully (100% coverage), setting a baseline of 3. The description adds value by clarifying that the parameter can be a simple name or a qualified ID, that matching is exact, and that ambiguity triggers multiple results — semantics beyond the schema's examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Look up') and a resource ('detailed information about a symbol') with examples of both simple names and fully qualified IDs. It differentiates from sibling search_symbols by emphasizing exact matching and disambiguation for multiple matches, though it doesn't explicitly name the sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it is for retrieving detailed info about a known symbol and specifies how to format the input for exact matching. It does not explicitly state when alternatives like search_symbols or get_file_context should be used, so it lacks explicit when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_temporal_graphA
Show how the dependency graph evolved over git history. Returns snapshots at sampled commits showing file counts, symbol counts, edge counts, and structural changes over time.
| Name | Required | Description | Default |
|---|---|---|---|
| commits | No | Number of commits to sample (default: 10) | |
| strategy | No | Sampling strategy (default: even) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It explicitly states the tool 'Returns snapshots at sampled commits showing file counts, symbol counts, edge counts, and structural changes over time,' which discloses the read-only, sampling-based nature and gives a concrete picture of the output. This is sufficient for a read-style analytical tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with the primary purpose front-loaded and no filler. The second sentence efficiently summarizes the return content without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Without an output schema, the description does explain what is returned (snapshots with file/symbol/edge counts and structural changes). It lacks an explicit output shape or detail on how sampling strategies affect results, but for a tool with two optional parameters this is largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully describes both parameters with defaults and an enum, so the description adds no additional meaning beyond what is in the schema. With 100% schema coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Show how...evolved') and names a precise resource ('dependency graph over git history'), clearly distinguishing this from static-analysis siblings like visualize_graph or get_architecture_summary. The temporal evolution focus is unique among the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for historical evolution of the dependency graph but never explicitly states when to prefer it over alternatives or mentions any exclusions. Context makes the use case clear, but no explicit routing or contrast with siblings is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
impact_analysisA
Analyze what would break if a symbol is changed, renamed, or removed. Shows direct dependents, transitive dependents (chain reaction), and all affected files. Cross-language edges included — a TypeScript fetch call to a Python route will show the Python file as affected. Pass a symbol name (e.g., 'Router') or a fully qualified ID (e.g., 'src/router.ts::Router') for exact matching. If multiple symbols share the same name, returns all matches for disambiguation. Use this before making changes to understand the blast radius.
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | Optional: File path to disambiguate when multiple symbols have the same name (e.g., 'src/router.ts') | |
| symbol | Yes | Symbol name (e.g., 'Router') or full ID (e.g., 'src/router.ts::Router') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavioral disclosure. It clarifies matching semantics ('fully qualified ID ... for exact matching'), disambiguation behavior ('returns all matches'), and cross-language span, while 'Analyze' signals a non-mutating operation. It does not explicitly state read-only behavior, but the analysis framing plus the 'before making changes' context make it reasonably clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose and packs six sentences of relevant detail: output scope, cross-language reach, input syntax, disambiguation, and usage timing. It is slightly longer than necessary, but every sentence adds information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description summarizes what will be returned (dependents, transitive dependents, affected files) and how to request it. It could be more explicit about the exact return shape or any side effects/limits, but it provides enough context for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented. The description adds value by detailing the symbol input format ('src/router.ts::Router') and the behavior when names collide ('returns all matches for disambiguation'), which goes beyond the schema field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and target: 'Analyze what would break if a symbol is changed, renamed, or removed.' It enumerates the outputs (direct dependents, transitive dependents, affected files) and highlights cross-language edges, distinguishing it from sibling tools like get_dependents or affected_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The final sentence explicitly tells an agent when to use the tool: 'Use this before making changes to understand the blast radius.' It does not name alternatives or list when not to use it, so it stops short of full exclusion guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesA
List all files in the project with basic stats.
| Name | Required | Description | Default |
|---|---|---|---|
| directory | No | Filter to a specific subdirectory (optional) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing behavior. It conveys that this is a read-only listing operation and allows optional subdirectory filtering, but it does not explain traversal behavior (recursive or not), what 'basic stats' actually includes, or whether hidden files are included.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the core purpose without any filler. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a simple listing tool with one optional parameter and no output schema, but it leaves important context unspecified, such as the exact nature of 'basic stats' and whether the listing is recursive. An agent could invoke it correctly but might misinterpret the response shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, 'directory', is fully described in the schema as an optional subdirectory filter. The tool description adds no additional semantic detail beyond the schema, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List'), the resource ('all files in the project'), and the output scope ('with basic stats'). It is distinguishable from siblings like get_file_context or impact_analysis by its broad, project-wide listing scope, though it does not explicitly name any alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied by the name and description: to enumerate files in the project with basic statistics. However, there is no explicit guidance about when to choose this over alternatives, when not to use it, or what scenarios warrant the optional directory filter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
record_decisionA
Save a structured decision so future clients (or the same client in a future session) can see what was decided and why. Stored in .depwire/decisions.jsonl.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Optional tags for categorization | |
| context | Yes | What problem was being solved | |
| decision | Yes | What was chosen | |
| reasoning | Yes | Why this option was chosen | |
| session_id | Yes | Identifies the calling agent/session | |
| files_affected | No | Optional list of files this decision touches | |
| options_considered | Yes | Alternatives the client weighed | |
| depwire_action_token | No | Optional, reserved for future DAT integration |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states that the tool persists data to .depwire/decisions.jsonl and that the record will be visible to future clients, which goes beyond the basic 'save' semantics. It does not mention append vs. overwrite behavior or return values, but the storage location is a meaningful disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, both earning their place. The first states the action and purpose; the second gives the concrete storage location. No filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema richly documents all eight parameters, and the description explains the core persistence behavior and location. It does not describe the return value or success/failure semantics, and there is no output schema to fill that gap, but an agent has enough to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents every parameter. The description adds only the general notion of a 'structured decision' and does not explain parameter relationships or provide usage examples, keeping this at the baseline for fully-covered schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Save') and clearly identifies the resource ('a structured decision') and the reason for existence (visibility for future clients/sessions). It is easily distinguished from the sibling get_decisions, which is for reading decisions, and from update_project_docs, which targets different content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: use this when a decision needs to be persisted for future clients or sessions. It does not explicitly name alternatives or state when not to use it, but the use case is unambiguous and naturally separated from retrieval-oriented siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
release_filesA
Release a previously made file claim. The release is recorded as an event (append-only).
| Name | Required | Description | Default |
|---|---|---|---|
| claim_id | Yes | The claim ID to release | |
| session_id | Yes | Must match the original claim's session_id |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses a meaningful side effect—the release is recorded as an append-only event—which signals non-destructive audit behavior. It does not state whether the claim becomes available again, idempotency, or error conditions, so transparency is partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The core action is front-loaded, and the append-only side effect earns its place as essential behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with fully documented schema and no output schema, the description plus schema cover the essential invocation context. Some behavioral outcomes, such as whether the claim becomes reclaimable, are left implicit, but nothing critical blocks a correct call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no additional parameter detail, but the schema already explains claim_id and the session_id matching requirement.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('release') and a concrete resource ('previously made file claim'), immediately distinguishing this from sibling tools like claim_files and get_active_claims. The inverse relationship to claiming is clear without needing to inspect other tool schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied through 'previously made file claim' and the schema's session_id constraint, suggesting this tool applies only to existing claims. However, there is no explicit when-to-use or when-not-to-use guidance, and sibling alternatives are not named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_symbolsA
Search for symbols by name across the entire codebase. Supports partial matching.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum results to return (default: 20) | |
| query | Yes | Search query (case-insensitive substring match) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does add useful semantics: searching across the whole codebase and supporting partial matches. However, it does not mention whether the operation is read-only, whether results are limited by the limit parameter, or what kind of result entries are returned, so some behavioral context is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short, purposeful sentences with no filler. The core operation, scope, and matching behavior are front-loaded, and the schema handles parameter details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple search tool with only two parameters and full schema coverage, the description is mostly adequate. However, with no output schema and no annotations, it would be stronger if it stated what the search results contain (e.g., symbol names, file locations) and that the operation is non-destructive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already explains both 'query' and 'limit' clearly, including the case-insensitive substring behavior and default limit. The description's 'partial matching' aligns with the schema but does not add additional parameter-level meaning beyond it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('Search') and resource ('symbols by name') with an explicit scope ('across the entire codebase') and matching behavior ('partial matching'). It is distinguishable from sibling tools like get_symbol_info because it is a discovery/search operation rather than a detail lookup, though it does not explicitly call out the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: searching for symbols by name across the codebase. However, it does not explicitly state when to use this tool instead of more specific siblings such as get_symbol_info, get_dependencies, or get_dependents, nor does it mention any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
security_scanA
Scan the codebase for security vulnerabilities using deterministic checks + graph-aware severity scoring. No API key required.
Checks: dependency CVEs, shell injection, hardcoded secrets, path traversal, auth bypass, input validation, information disclosure, cryptography weaknesses, frontend XSS, architecture-level risks.
Graph-aware severity: vulnerabilities reachable from MCP tools or HTTP routes are automatically elevated. A medium shell injection reachable from connect_repo becomes Critical.
Returns ranked findings (Critical → Low) with attack scenarios and suggested fixes. Use --target for single-file scan.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No | Relative file path to scan. Omit to scan entire repo. | |
| classes | No | Vulnerability classes to check. Omit for all. | |
| graphAware | No | Enable graph-aware severity elevation (recommended). Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and covers key behaviors: deterministic checks, graph-aware severity elevation with a concrete example, and a return format of ranked findings with attack scenarios and suggested fixes. It does not explicitly state whether the scan is read-only or mention limitations, but the language strongly implies a non-mutating analysis.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: lead purpose sentence, checks overview, graph-aware severity explanation, and return/usage guidance. It is slightly longer than necessary and slightly repeats the schema's target description, but each section earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-required-param scan tool with no output schema, the description provides enough to invoke it correctly: whole-repo vs single-file behavior, types of checks performed, severity elevation logic, and output shape. It does not specify the exact response format or performance constraints, but nothing essential is missing for basic use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds value by explaining --target usage, the effect of graph-aware severity elevation, and a human-readable list of vulnerability classes. It does not perfectly map to the classes enum—code-injection and supply-chain are not mentioned in the description—but it still enriches the schema's terse parameter docs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource—'Scan the codebase for security vulnerabilities'—and adds distinctive method details ('deterministic checks + graph-aware severity scoring'). It also states the output ('ranked findings (Critical → Low)'), which clearly separates it from sibling tools like get_health_score or find_dead_code.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: scan the whole repo by default, use --target for a single-file scan, no API key required. It does not explicitly name alternatives or exclusion conditions, but its use case is clear enough for an agent to select it appropriately among the listed tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
simulate_changeA
Simulate an architectural change before touching any code. Returns health score delta, broken imports, and affected nodes. Zero file I/O — pure in-memory simulation. Cross-language edges included — deleting a Python route file will show TypeScript callers as affected.
Operations:
delete: Simulate deleting a file. Shows every file that would break and the full blast radius.
move: Simulate moving a file to a new path. Shows broken imports and edge changes.
rename: Simulate renaming a file. Shows all affected imports and nodes.
split: Simulate splitting a file by moving specified symbols to a new file.
merge: Simulate merging two files into one. Fails fast on symbol name collision.
Always run this before any refactor that touches file structure.
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Relative file path of the primary target | |
| symbols | No | Required for split — symbol names to move to new file | |
| operation | Yes | Type of change to simulate | |
| destination | No | Required for move and rename — the new file path | |
| mergeTarget | No | Required for merge — the file to merge into target |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does so well. It discloses zero file I/O, pure in-memory simulation, cross-language edge handling, and even operation-specific behavior like failing fast on symbol name collisions in merge.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is structured with a front-loaded overview followed by a scannable operations list. Every sentence and bullet adds operational value; there is no filler or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity, five parameters, and no output schema, the description is remarkably complete. It explains what the tool returns, when to run it, what each operation does, and important constraints like in-memory execution and cross-language impact.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already has 100% description coverage, and the tool description adds significant meaning on top: which parameters are required for each operation (split, move, rename, merge) and the merge collision behavior. This is exactly the kind of operational parameter context that helps an agent invoke the tool correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: simulate an architectural change before code is touched, and names concrete outputs (health score delta, broken imports, affected nodes). It does not explicitly differentiate itself from the closely related sibling impact_analysis, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance: 'Always run this before any refactor that touches file structure.' This provides clear context for when to use the tool. However, it does not discuss when not to use it or name alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
update_project_docsA
Regenerate codebase documentation with the latest changes. If docs don't exist, generates them for the first time. Use this after significant code changes to keep documentation up-to-date.
| Name | Required | Description | Default |
|---|---|---|---|
| doc_type | No | Document type to update: 'architecture', 'conventions', 'dependencies', 'onboarding', or 'all' (default: 'all') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It clearly discloses the main effects (regenerating docs and creating docs on first run), but it does not mention whether existing docs are overwritten, whether a repo connection is required, or any other side effects. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: what it does, the first-time behavior, and when to use it. No fluff or redundant restating of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description covers action, first-run behavior, and usage timing. It is slightly incomplete only in that it does not describe post-call result or prerequisites, but those are not critical for selecting and invoking this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single optional doc_type parameter, so the schema already fully explains accepted values and the default. The description adds no parameter-specific meaning, matching the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (regenerate) on a clear resource (codebase documentation), including the first-time generation case. It does not explicitly name sibling tools, but the update-vs-get distinction against get_project_docs is implied by the verb and resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear trigger: use after significant code changes to keep docs current. It does not explicitly list exclusions or alternatives such as get_project_docs for read-only access, so it is clear context but not a full routing guide.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_changeA
Before applying a code change, return a deterministic safety report. Checks for broken imports, new circular dependencies, health score impact, and runs a targeted scan on changed files. Used by AI coding assistants and autonomous agents.
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | No | File path being changed (use with new_content) | |
| new_content | No | The proposed new content of the file | |
| unified_diff | No | A unified diff string (alternative to file_path + new_content) | |
| depwire_action_token | No | Optional, reserved for future DAT integration |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the behavioral burden. It does disclose determinism, the categories of checks, and that it returns a report rather than applying the change. However, it does not explicitly state whether the tool is read-only or has side effects, nor does it describe the report's format or any prerequisites (e.g., connected repository).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with the core purpose front-loaded. The second sentence enumerates checks efficiently. The final audience sentence is minor extraneous context but does not bloat the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lists what the report checks but not what the report contains structurally or how a caller should interpret the result. With no output schema and no annotations, this is a notable gap. It also does not specify that a change must be supplied as either file_path+new_content or unified_diff, though the schema covers this.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter descriptions already define file_path, new_content, unified_diff, and depwire_action_token. The tool description adds no parameter-level detail, but that is acceptable because the schema is self-sufficient. It does not clarify the mutually exclusive input modes, but the schema comments already explain the alternatives.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: 'return a deterministic safety report' before applying a code change, and enumerates specific checks (broken imports, circular dependencies, health score impact, targeted scan). This differentiates it from siblings like impact_analysis or security_scan through the temporal qualifier 'Before applying' and the deterministic nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear trigger condition: 'Before applying a code change.' It does not explicitly name alternative tools or exclusions, so agents must infer when not to use it. The audience note ('Used by AI coding assistants and autonomous agents') is context, not a usage criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
visualize_graphA
Render an interactive arc diagram visualization of the current codebase's cross-reference graph. Shows files as bars along the bottom and dependency arcs connecting them, colored by distance. The visualization appears inline in the conversation.
| Name | Required | Description | Default |
|---|---|---|---|
| maxFiles | No | Limit to top N most connected files (optional, default: all) | |
| highlight | No | File or symbol name to highlight in the visualization (optional) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It explains that the tool renders an interactive diagram, shows files as bars, draws dependency arcs, colors them by distance, and outputs inline in the conversation. This clearly frames the operation as non-mutating and tells the agent where the output appears, which is meaningful beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The primary action and resource come first, followed by a compact explanation of the visual output and where it appears. Every sentence adds necessary context and the structure makes the tool's behavior immediately clear.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, has only optional parameters, and no output schema, so the description covers the essential call context: what is rendered, what it looks like, and that the result appears inline. It could add a note about whether the codebase needs to be connected first, and the 'interactive' behavior is not elaborated, but overall the description is sufficient for an agent to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage for parameters is 100%, so the schema already describes maxFiles and highlight. The description does not add extra semantic detail about either parameter, such as how highlighting works or what 'top N most connected' means in practice. Under the coverage baseline, a score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Render') and a specific resource ('interactive arc diagram visualization of the current codebase's cross-reference graph'). It also gives concrete visual details (bars, arcs, coloring by distance), which makes the tool's purpose unmistakable. The phrasing differentiates it from data-returning siblings like get_dependencies and get_temporal_graph by focusing on an inline visual artifact.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys that this tool is for producing a visual representation of cross-references, so an agent can infer when it is appropriate. However, it does not explicitly state when to prefer this over related tools like get_dependencies, get_dependents, or impact_analysis, nor does it mention any exclusions or prerequisites such as requiring a connected repository.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
23 tool updates
v1.19.0- Added
affected_files - Added
claim_files - Added
connect_repo - Added
find_dead_code - Added
get_active_claims - Added
get_architecture_summary - Added
get_decisions - Added
get_dependents - Added
get_file_context - Added
get_health_score - Added
get_project_docs - Added
get_symbol_info - Added
get_temporal_graph - Added
impact_analysis - Added
list_files - Added
record_decision - Added
release_files - Added
search_symbols - Added
security_scan - Added
simulate_change - Added
update_project_docs - Added
verify_change - Added
visualize_graph
22 tool updates
v1.8.4- Removed
claim_files - Removed
connect_repo - Removed
find_dead_code - Removed
get_active_claims - Removed
get_architecture_summary - Removed
get_decisions - Removed
get_dependents - Removed
get_file_context - Removed
get_health_score - Removed
get_project_docs - Removed
get_symbol_info - Removed
get_temporal_graph - Removed
impact_analysis - Removed
list_files - Removed
record_decision - Removed
release_files - Removed
search_symbols - Removed
security_scan - Removed
simulate_change - Removed
update_project_docs - Removed
verify_change - Removed
visualize_graph
3 tool updates
v1.5.0- Changed
claim_files2 fields changed- removed
Input schema / properties / agent_identity_tokenRemoved value: -{ - "description": "Optional, reserved for future AIT integration", - "type": "string" -} - added
Input schema / properties / depwire_action_tokenAdded value: +{ + "description": "Optional, reserved for future DAT integration", + "type": "string" +}
- Changed
record_decision2 fields changed- removed
Input schema / properties / agent_identity_tokenRemoved value: -{ - "description": "Optional, reserved for future AIT integration", - "type": "string" -} - added
Input schema / properties / depwire_action_tokenAdded value: +{ + "description": "Optional, reserved for future DAT integration", + "type": "string" +}
- Changed
verify_change2 fields changed- removed
Input schema / properties / agent_identity_tokenRemoved value: -{ - "description": "Optional, reserved for future AIT integration", - "type": "string" -} - added
Input schema / properties / depwire_action_tokenAdded value: +{ + "description": "Optional, reserved for future DAT integration", + "type": "string" +}
23 tool updates
v1.4.0- Added
claim_files - Added
connect_repo - Added
find_dead_code - Added
get_active_claims - Added
get_architecture_summary - Added
get_decisions - Added
get_dependencies - Added
get_dependents - Added
get_file_context - Added
get_health_score - Added
get_project_docs - Added
get_symbol_info - Added
get_temporal_graph - Added
impact_analysis - Added
list_files - Added
record_decision - Added
release_files - Added
search_symbols - Added
security_scan - Added
simulate_change - Added
update_project_docs - Added
verify_change - Added
visualize_graph
17 tool updates
v1.3.0- Removed
connect_repo - Removed
find_dead_code - Removed
get_architecture_summary - Removed
get_dependencies - Removed
get_dependents - Removed
get_file_context - Removed
get_health_score - Removed
get_project_docs - Removed
get_symbol_info - Removed
get_temporal_graph - Removed
impact_analysis - Removed
list_files - Removed
search_symbols - Removed
security_scan - Removed
simulate_change - Removed
update_project_docs - Removed
visualize_graph
3 tool updates
v1.1.2- Changed
impact_analysis1 field changed- added
Input schema / properties / fileAdded value: +{ + "description": "Optional: File path to disambiguate when multiple symbols have the same name (e.g., 'src/router.ts')", + "type": "string" +}
- Added
security_scan - Added
simulate_change
15 tool updates
v1.0.0- First observed
connect_repo - First observed
find_dead_code - First observed
get_architecture_summary - First observed
get_dependencies - First observed
get_dependents - First observed
get_file_context - First observed
get_health_score - First observed
get_project_docs - First observed
get_symbol_info - First observed
get_temporal_graph - First observed
impact_analysis - First observed
list_files - First observed
search_symbols - First observed
update_project_docs - First observed
visualize_graph
TDQS
Scored across 24 tools
Several tools have overlapping purposes: get_dependencies vs impact_analysis both explore dependents (upstream vs downstream, but the distinction is subtle), get_health_score vs get_architecture_summary both summarize project health, and simulate_change (delete/move/rename) overlaps with affected_files and impact_analysis. Descriptions help differentiate but an agent could easily misselect.
Mixed conventions: most tools use verb_noun (get_dependents, find_dead_code, search_symbols), but some are noun-only (affected_files, security_scan, impact_analysis) and others append '_project_docs' or use plural forms inconsistently (record_decision vs get_decisions). Still readable but not a predictable pattern.
24 tools is at the upper bound of reasonable (borderline heavy per rubric), and the domain (codebase analysis, multi-agent coordination, security) is broad, so the count is defensible but approaches the 25+ threshold where findability degrades.
Strong coverage of the code-analysis lifecycle: connect, query symbols/files/dependencies, impact analysis, health scoring, docs, security scanning, change verification, and multi-agent claims/decisions. Minor gap: no explicit update/delete for decisions, but otherwise CRUD-like operations are present.
Maintenance
Related MCP Connectors
Codebase graphs, caller impact analysis, and recorded project context for AI coding agents.
Hosted code graph over MCP: exact callers, dependencies, and cross-repo blast radius for AI agents.
Code intelligence platform for AI agents. 20 tools for architecture, security & impact analysis.
Deterministic context layer for your codebase: change impact, blast radius, answers with receipts.
Related MCP Servers
- AlicenseAqualityCmaintenanceCode graph context engine that parses codebases with tree-sitter (170+ languages), builds structural dependency graphs, and provides 24 MCP tools for code intelligence. One prepare_context call gives your AI agent the right files for any task. Includes focus, blast radius, hotspots, dead code detection, and hybrid search.241AGPL 3.0
- AlicenseBqualityDmaintenanceLocal-first codebase context engine that parses code into a ranked dependency graph and serves it to AI tools via MCP for deep structural understanding.518 npm1MIT
- AlicenseAqualityAmaintenanceAI-powered codebase health analysis — detects dead code, circular dependencies, coupling issues, and architectural drift. 6 MCP tools for Claude Desktop, Cursor, Windsurf, and Slack.677 npmMIT
- AlicenseAqualityBmaintenanceIndexes any TypeScript / React / Next.js repo into a queryable code graph and exposes 13 MCP tools — who-renders, who-calls, find-references, blast-radius, find-cycles, dead-code orphans, and local semantic search — so agents query structure instead of reading whole files. Built on ts-morph, so edges are resolved, not grepped.142MIT