depwire

# Depwire

<div align="center">

[![npm version](https://img.shields.io/npm/v/depwire-cli?color=00d4aa&label=npm)](https://www.npmjs.com/package/depwire-cli)
[![npm downloads](https://img.shields.io/npm/dm/depwire-cli?color=00d4aa&label=downloads%2Fmonth)](https://www.npmjs.com/package/depwire-cli)
[![GitHub stars](https://img.shields.io/github/stars/depwire/depwire?color=00d4aa&style=flat)](https://github.com/depwire/depwire/stargazers)
[![License](https://img.shields.io/badge/license-BUSL--1.1-00d4aa)](https://github.com/depwire/depwire/blob/main/LICENSE)
[![MCP Compatible](https://img.shields.io/badge/MCP-23%20tools-00d4aa)](https://github.com/depwire/depwire)

[![Languages](https://img.shields.io/badge/languages-17-0a1a14?style=flat)](https://github.com/depwire/depwire)
[![TypeScript](https://img.shields.io/badge/TypeScript-✓-3178c6?style=flat)](https://github.com/depwire/depwire)
[![Python](https://img.shields.io/badge/Python-✓-3776ab?style=flat)](https://github.com/depwire/depwire)
[![Go](https://img.shields.io/badge/Go-✓-00add8?style=flat)](https://github.com/depwire/depwire)
[![Rust](https://img.shields.io/badge/Rust-✓-ce422b?style=flat)](https://github.com/depwire/depwire)
[![Java](https://img.shields.io/badge/Java-✓-f89820?style=flat)](https://github.com/depwire/depwire)
[![PHP](https://img.shields.io/badge/PHP-✓-777bb4?style=flat)](https://github.com/depwire/depwire)
[![Ruby](https://img.shields.io/badge/Ruby-✓-cc342d?style=flat)](https://github.com/depwire/depwire)
[![Dart](https://img.shields.io/badge/Dart-✓-0175c2?style=flat)](https://github.com/depwire/depwire)
[![R](https://img.shields.io/badge/R-✓-276dc3?style=flat)](https://github.com/depwire/depwire)
[![+7 more](https://img.shields.io/badge/+7_more-C%2B%2B%20%7C%20C%23%20%7C%20Kotlin%20%7C%20Swift%20%7C%20Mojo%20%7C%20C%20%7C%20JS-555?style=flat)](https://github.com/depwire/depwire)
[![HTML/Angular](https://img.shields.io/badge/HTML%2FAngular-✓-e34c26?style=flat)](https://github.com/depwire/depwire)

[![YouTube CLI Tutorial](https://img.shields.io/badge/YouTube-CLI%20Tutorial-ff0000?logo=youtube)](https://www.youtube.com/watch?v=ujBg0H3eqpE)
[![YouTube Cloud Tutorial](https://img.shields.io/badge/YouTube-Cloud%20Tutorial-ff0000?logo=youtube)](https://www.youtube.com/watch?v=wdTJfSRTQu8)
[![Cloud](https://img.shields.io/badge/cloud-app.depwire.dev-00d4aa)](https://app.depwire.dev)
[![VS Code](https://img.shields.io/visual-studio-marketplace/v/depwire.depwire-vscode?label=VSCode&logo=visualstudiocode&color=00d4aa)](https://marketplace.visualstudio.com/items?itemName=depwire.depwire-vscode)

</div>

**Your AI doesn't know your architecture. Depwire does.**

## What makes Depwire different

<p align="center">
  <img src="./assets/deterministic_vs_rag_diagram.svg" alt="Depwire deterministic graph vs RAG probabilistic approach" width="680" />
</p>

Depwire builds a **DETERMINISTIC, NOT PROBABILISTIC** dependency graph of your codebase. This is not RAG. There are no embeddings, no similarity scores, no vector databases, no guesses. Depwire uses tree-sitter — the same parser powering GitHub's code intelligence — to extract exact symbol-level facts from every file: every function, every class, every interface, every import and export relationship, across 17 programming languages. When you ask "what breaks if I delete `encodeToken` in `auth/token.ts`?", Depwire does not search for similar-looking code and estimate an answer. It traverses the exact dependency graph and returns the precise list of 14 files that import that symbol, which import chains break, and what your health score drops by. This is compiler-level precision applied to AI-assisted development — not a language model's best guess about your code.

**Not a build graph either.** Tools like Nx, Turborepo, and Grapher track package-level dependencies for build caching. Depwire tracks symbol-level dependencies — every function, class, and import relationship — which is what makes What If simulation, graph-aware security scanning, and exact blast radius analysis possible.

## Contents

- [What makes Depwire different](#what-makes-depwire-different)
- [Start here](#start-here)
- [The infrastructure layer](#the-infrastructure-layer)
- [What If simulation](#what-if-simulation)
- [Security scanner](#security-scanner)
- [Pre-action verification](#pre-action-verification)
- [Structural diff between commits](#structural-diff-between-commits)
- [MCP server — AI integration](#mcp-server--ai-integration)
- [Cross-language edge detection](#cross-language-edge-detection)
- [Architecture health score](#architecture-health-score)
- [Language support](#language-support)
- [SDK](#sdk)
- [Cloud dashboard](#cloud-dashboard)
- [GitHub Action — PR Impact Analysis](#github-action--pr-impact-analysis)
- [Depwire Action Token (DAT)](#depwire-action-token-dat)
- [Roadmap](#roadmap)

---

Depwire is the infrastructure layer between your AI coding assistant and your codebase. Before your AI touches a single file, Depwire has already mapped every connection, scored every risk, and simulated every change.

![Depwire CLI demo on honojs/hono](./assets/depwire-demo-cli.gif)

⭐ If Depwire saves you from a broken build, [star the repo](https://github.com/depwire/depwire) — it helps this project grow.

---

## Benchmark Results

Tested on [payloadcms/payload](https://github.com/payloadcms/payload) using **Claude Code (claude-opus-4-8)** — 645 files, 9,292 symbols, 80-file cascading refactor (adding a required parameter to a core error class used across the entire codebase). 3 modes tested: without Depwire, Depwire with no guidance, and Depwire with guided workflow prompt.

| Mode | Duration | API Calls | Tokens | Cost | Correctness |
|------|----------|-----------|--------|------|-------------|
| Without Depwire | 16m 46s | 40 | 2,959,169 | $9.03 | 100% |
| Depwire (no guidance) | 11m 20s | 46 | 3,399,822 | $9.80 | 100% |
| Depwire + workflow | **10m 43s** | **26** | **2,165,356** | **$7.35** | 100% |

**Depwire + guided workflow vs no Depwire:**
- 36% faster
- 35% fewer API calls
- 27% fewer tokens
- 19% lower cost

> **Key finding:** Depwire without workflow guidance performed worse than no Depwire — agents had the tools but didn't use them unprompted, paying MCP overhead without getting any benefit. The `affected_files` command returned the complete 84-file blast radius in one call, but only when the agent was explicitly told to run it first. This is why we built `depwire prompt` — not as boilerplate, but because the benchmark showed agents need an explicit decision tree to use graph tools effectively.

[Full benchmark methodology and scripts →](https://github.com/depwire/depwire-benchmark)

> Agent: Claude Code (claude-opus-4-8) | Repo: payloadcms/payload @ commit 1545e87 | Benchmark scripts: [github.com/depwire/depwire-benchmark](https://github.com/depwire/depwire-benchmark)

---

## The problem

AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.

You ask Claude to delete a utility file. It deletes it cleanly. Confident. No warnings.

Then you run the build. 30 files broken.

Claude had no idea. It saw one file. It didn't see the 30 downstream consumers.

This isn't a model problem. It's a context problem. The AI is flying blind.

---

## The infrastructure layer

![Depwire infrastructure layer](https://raw.githubusercontent.com/depwire/depwire/main/website/assets/depwire_infrastructure_layer.svg)

![Powered by DAT — open standard for AI agent action audit](https://raw.githubusercontent.com/depwire/depwire/main/website/assets/depwire_dat_governance_band.svg)

Depwire is the context and safety layer for AI-generated code.

Depwire sits between your AI and your codebase. It builds a complete dependency graph using tree-sitter — deterministic, not probabilistic — and serves it to your AI through 23 MCP tools.

Four guarantees:

- **Local** — everything runs on your machine. No cloud parsing. No data sent anywhere.
- **Secure** — your code never leaves your machine. The security scanner requires no API key.
- **Token-efficient** — Depwire serves pre-computed graph data. Your AI gets surgical answers, not file dumps. 40% fewer tool calls. 56% fewer file reads.
- **Deterministic** — tree-sitter parses your code the same way every time. 100% accurate. Not a guess.

---

## Start here

```bash
npm install -g depwire-cli
```

Three commands to understand any codebase:

```bash
depwire whatif     # know what breaks before you change anything
depwire security   # catch vulnerabilities before AI ships them
depwire viz        # see your entire architecture instantly
```

---

## Tested on real-world projects

| Project | Language | Files | Symbols | Edges | Health |
|---------|----------|-------|---------|-------|--------|
| [google/guice](https://github.com/google/guice) | Java (multi-module, 13 modules) | 647 | 30,592 | 10,081 | 31/100 |
| [honojs/hono](https://github.com/honojs/hono) | TypeScript | 352 | 6,462 | 2,194 | 41/100 |
| [apache/commons-lang](https://github.com/apache/commons-lang) | Java (single-module) | 624 | 29,723 | 9,037 | — |
| [pallets/flask](https://github.com/pallets/flask) | Python | 79 | 2,005 | 851 | — |
| [dart-lang/shelf](https://github.com/dart-lang/shelf) | Dart | 108 | 1,639 | 219 | — |
| [rstudio/plumber](https://github.com/rstudio/plumber) | R | 197 | 1,194 | 219 | — |
| [payloadcms/payload](https://github.com/payloadcms/payload) | TypeScript | 645 | 9,292 | 3,511 | — |

> Numbers from real `depwire parse` runs on public repositories. Last validated: v1.8.2 (June 2026).

---

## What If simulation

Know the blast radius before you touch anything.

```bash
depwire whatif . --simulate delete --target src/utils/encode.ts
```

Real output on [honojs/hono](https://github.com/honojs/hono) — 352 files, 6,245 symbols:

    Health Score:    41 → 41  (+0 → unchanged)
    Affected Nodes:  29
    Broken Imports:  30
    • src/