depwire

# Depwire

<div align="center">

[![npm version](https://img.shields.io/npm/v/depwire-cli?color=00d4aa&label=npm)](https://www.npmjs.com/package/depwire-cli)
[![npm downloads](https://img.shields.io/npm/dm/depwire-cli?color=00d4aa&label=downloads%2Fmonth)](https://www.npmjs.com/package/depwire-cli)
[![GitHub stars](https://img.shields.io/github/stars/depwire/depwire?color=00d4aa&style=flat)](https://github.com/depwire/depwire/stargazers)
[![License](https://img.shields.io/badge/license-BUSL--1.1-00d4aa)](https://github.com/depwire/depwire/blob/main/LICENSE)
[![MCP Compatible](https://img.shields.io/badge/MCP-24%20tools-00d4aa)](https://github.com/depwire/depwire)

[![Languages](https://img.shields.io/badge/languages-17-0a1a14?style=flat)](https://github.com/depwire/depwire)
[![TypeScript](https://img.shields.io/badge/TypeScript-✓-3178c6?style=flat)](https://github.com/depwire/depwire)
[![Python](https://img.shields.io/badge/Python-✓-3776ab?style=flat)](https://github.com/depwire/depwire)
[![Go](https://img.shields.io/badge/Go-✓-00add8?style=flat)](https://github.com/depwire/depwire)
[![Rust](https://img.shields.io/badge/Rust-✓-ce422b?style=flat)](https://github.com/depwire/depwire)
[![Java](https://img.shields.io/badge/Java-✓-f89820?style=flat)](https://github.com/depwire/depwire)
[![PHP](https://img.shields.io/badge/PHP-✓-777bb4?style=flat)](https://github.com/depwire/depwire)
[![Ruby](https://img.shields.io/badge/Ruby-✓-cc342d?style=flat)](https://github.com/depwire/depwire)
[![Dart](https://img.shields.io/badge/Dart-✓-0175c2?style=flat)](https://github.com/depwire/depwire)
[![R](https://img.shields.io/badge/R-✓-276dc3?style=flat)](https://github.com/depwire/depwire)
[![+7 more](https://img.shields.io/badge/+7_more-C%2B%2B%20%7C%20C%23%20%7C%20Kotlin%20%7C%20Swift%20%7C%20Mojo%20%7C%20C%20%7C%20JS-555?style=flat)](https://github.com/depwire/depwire)
[![HTML/Angular](https://img.shields.io/badge/HTML%2FAngular-✓-e34c26?style=flat)](https://github.com/depwire/depwire)

[![YouTube CLI Tutorial](https://img.shields.io/badge/YouTube-CLI%20Tutorial-ff0000?logo=youtube)](https://www.youtube.com/watch?v=ujBg0H3eqpE)
[![YouTube Cloud Tutorial](https://img.shields.io/badge/YouTube-Cloud%20Tutorial-ff0000?logo=youtube)](https://www.youtube.com/watch?v=wdTJfSRTQu8)
[![Cloud](https://img.shields.io/badge/cloud-app.depwire.dev-00d4aa)](https://app.depwire.dev)
[![VS Code](https://img.shields.io/visual-studio-marketplace/v/depwire.depwire-vscode?label=VSCode&logo=visualstudiocode&color=00d4aa)](https://marketplace.visualstudio.com/items?itemName=depwire.depwire-vscode)

</div>

**Your AI doesn't know your architecture. Depwire does.**

## What makes Depwire different

<p align="center">
  <img src="./assets/deterministic_vs_rag_diagram.svg" alt="Depwire deterministic graph vs RAG probabilistic approach" width="680" />
</p>

Depwire builds a **DETERMINISTIC, NOT PROBABILISTIC** dependency graph of your codebase. This is not RAG. There are no embeddings, no similarity scores, no vector databases, no guesses. Depwire uses tree-sitter — the same parser powering GitHub's code intelligence — to extract exact symbol-level facts from every file: every function, every class, every interface, every import and export relationship, across 17 programming languages. When you ask "what breaks if I delete `encodeToken` in `auth/token.ts`?", Depwire does not search for similar-looking code and estimate an answer. It traverses the exact dependency graph and returns the precise list of 14 files that import that symbol, which import chains break, and what your health score drops by. This is compiler-level precision applied to AI-assisted development — not a language model's best guess about your code.

**Not a build graph either.** Tools like Nx, Turborepo, and Grapher track package-level dependencies for build caching. Depwire tracks symbol-level dependencies — every function, class, and import relationship — which is what makes What If simulation, graph-aware security scanning, and exact blast radius analysis possible.

## Contents

- [What makes Depwire different](#what-makes-depwire-different)
- [Start here](#start-here)
- [The infrastructure layer](#the-infrastructure-layer)
- [What If simulation](#what-if-simulation)
- [Security scanner](#security-scanner)
- [Pre-action verification](#pre-action-verification)
- [Structural diff between commits](#structural-diff-between-commits)
- [MCP server — AI integration](#mcp-server--ai-integration)
- [Cross-language edge detection](#cross-language-edge-detection)
- [Architecture health score](#architecture-health-score)
- [Language support](#language-support)
- [SDK](#sdk)
- [Telemetry](#telemetry)
- [Cloud dashboard](#cloud-dashboard)
- [GitHub Action — PR Impact Analysis](#github-action--pr-impact-analysis)
- [pre-commit / prek hook](#pre-commit--prek-hook)
- [Depwire Action Token (DAT)](#depwire-action-token-dat)
- [Roadmap](#roadmap)

---

Depwire is the infrastructure layer between your AI coding assistant and your codebase. Before your AI touches a single file, Depwire has already mapped every connection, scored every risk, and simulated every change.

![Depwire CLI demo on honojs/hono](./assets/depwire-demo-cli.gif)

⭐ If Depwire saves you from a broken build, [star the repo](https://github.com/depwire/depwire) — it helps this project grow.

---

## Performance evidence

The previously published agent benchmark has been withdrawn after an audit found
that the task prompt exposed its answer key, the scored file set was narrower
than the change required by the monorepo, and one arm started in a different
working directory. A corrected three-arm experiment is being prepared. No
performance or correctness conclusion from the earlier runs should be cited.

[Audit and corrected harness →](https://github.com/depwire/depwire-benchmark)

---

## The problem

AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.

You ask Claude to delete a utility file. It deletes it cleanly. Confident. No warnings.

Then you run the build. 30 files broken.

Claude had no idea. It saw one file. It didn't see the 30 downstream consumers.

This isn't a model problem. It's a context problem. The AI is flying blind.

---

## The infrastructure layer

![Depwire infrastructure layer](https://raw.githubusercontent.com/depwire/depwire/main/website/assets/depwire_infrastructure_layer.svg)

![Powered by DAT — open standard for AI agent action audit](https://raw.githubusercontent.com/depwire/depwire/main/website/assets/depwire_dat_governance_band.svg)

Depwire is the context and safety layer for AI-generated code.

Depwire sits between your AI and your codebase. It builds a complete dependency graph using tree-sitter — deterministic, not probabilistic — and serves it to your AI through 24 MCP tools.

Four guarantees:

- **Local** — everything runs on your machine. No cloud parsing. No data sent anywhere.
- **Secure** — your code never leaves your machine. The security scanner requires no API key.
- **Token-efficient** — Depwire serves pre-computed graph data so agents can request focused dependency context instead of broad file dumps.
- **Deterministic** — tree-sitter provides consistent structural parsing without relying on model inference.

---

## Start here

```bash
npm install -g depwire-cli
```

Three commands to understand any codebase:

```bash
depwire whatif     # know what breaks before you change anything
depwire security   # catch vulnerabilities before AI ships them
depwire viz        # see your entire architecture instantly
```

---

## Tested on real-world projects

| Project | Language | Files | Symbols | Edges | Health |
|---------|----------|-------|---------|-------|--------|
| [google/guice](https://github.com/google/guice) | Java (multi-module, 13 modules) | 647 | 30,592 | 10,081 | 31/100 |
| [honojs/hono](https://github.com/honojs/hono) | TypeScript | 352 | 6,462 | 2,194 | 41/100 |
| [apache/commons-lang](https://github.com/apache/commons-lang) | Java (single-module) | 624 | 29,723 | 9,037 | — |
| [pallets/flask](https://github.com/pallets/flask) | Python | 79 | 2,005 | 851 | — |
| [dart-lang/shelf](https://github.com/dart-lang/shelf) | Dart | 108 | 1,639 | 219 | — |
| [rstudio/plumber](https://github.com/rstudio/plumber) | R | 197 | 1,194 | 219 | — |
| [payloadcms/payload](https://github.com/payloadcms/payload) | TypeScript | 645 | 9,292 | 3,511 | — |

> Numbers from real `depwire parse` runs on public repositories. Last validated: v1.8.2 (June 2026).
>
> **Pre-1.9.0 measurement.** v1.9.0 fixed parser bugs (double-emitted symbols in the TypeScript/Python/C#/C++/Java parsers, dropped type-only-import edges, false orphans) that directly affect symbol counts, edge counts, and health scores. These numbers were captured before that fix and have not been re-measured — they are directionally useful but not exact under v1.9.0+.

---

## What If simulation

Know the blast radius before you touch anything.

```bash
depwire whatif . --simulate delete --target src/utils/encode.ts
```

Real output on [honojs/hono](https://github.com/honojs/hono) — 352 files, 6,245 symbols:

    Health Score:    41 → 41  (+0 → unchanged)
    Affected Nodes:  29
    Broken Imports:  30
    • src/utils/jwt/jwt.ts imports decodeBase64Url
    • src/adapter/aws-lambda/handler.ts imports encodeBase64
    • src/utils/basic-auth.ts imports decodeBase64
    [27 more...]
    Removed Edges:   32

> Pre-1.9.0 measurement — captured before the v1.9.0 parser fixes; not re-measured.

Before touching a single file. Zero file I/O. Pure in-memory simulation.

Five operations:

```bash
depwire whatif . --simulate delete --target src/utils/encode.ts
depwire whatif . --simulate move --target src/utils/encode.ts --destination src/core/encode.ts
depwire whatif . --simulate rename --target src/utils/encode.ts --destination src/utils/encoder.ts
depwire whatif . --simulate spl