Depwire

Depwire

Your AI doesn't know your architecture. Depwire does.

What makes Depwire different

16 programming languages, plus Angular templates. Depwire parses symbols and builds dependency relationships across the constructs it supports. It records relationships it cannot resolve instead of inventing an edge.

Depwire builds a deterministic dependency graph from source parsing, without embeddings or similarity search. For a proposed change, it traverses the relationships present in that graph to show known dependents, import chains, and health movement. Results depend on the language constructs and files the parser can analyze.

Not a build graph either. Depwire tracks symbol-level relationships for What If simulation, graph-aware security scanning, and blast radius analysis.

Contents

• What makes Depwire different
• Performance evidence
• The problem
• Start here
• The infrastructure layer
• Tested on real-world projects
• What If simulation
• Security scanner
• Pre-action verification
• Structural diff between commits
• Visualization
• Temporal graph
• All commands
• MCP server — AI integration
• Cross-language edge detection
• Architecture health score
• Language support
• SDK
• Cloud dashboard
• VSCode Extension
• GitHub Action — PR Impact Analysis
• pre-commit / prek hook
• Depwire Action Token (DAT)
• Roadmap
• Security posture
• Paths and file counts

---

Depwire provides graph context to AI coding assistants. Parse a project to inspect recorded relationships, assess health, and simulate a proposed change.

⭐ If Depwire saves you from a broken build, star the repo — it helps this project grow.

---

Performance evidence

The previously published agent benchmark has been withdrawn after an audit found that the task prompt exposed its answer key, the scored file set was narrower than the change required by the monorepo, and one arm started in a different working directory. Three corrected exploratory sessions have since been run; they do not establish a performance or correctness advantage. No conclusion from the withdrawn runs should be cited.

Audit and corrected harness →

---

The problem

AI coding tools are getting smarter. But they still have a fundamental blind spot: they don't know your architecture before they touch it.

For example, you ask an AI assistant to delete a utility file. It deletes it without warnings.

Then the build reveals downstream consumers that still import it.

The assistant saw one file without inspecting those consumers.

This isn't a model problem. It's a context problem. The AI is flying blind.

---

The infrastructure layer

Depwire is the context and safety layer for AI-generated code.

Depwire builds a dependency graph from supported source constructs using tree-sitter and serves it to AI assistants through 24 MCP tools.

How it works:

• Local — the CLI analyzes source code on your machine and collects no usage telemetry. It does not upload source code, file names, graph data or analysis. Applicable security scans run dependency vulnerability and supply-chain checks by default; these may contact package registries and public advisory databases. connect_repo accesses GitHub when given a GitHub URL. The What If browser page loads D3 from a CDN. Cloud is a separate service.
• Security scanner — runs local code checks and applicable dependency audits by default; no Depwire API key is required.
• Token-efficient — Depwire serves pre-computed graph data so agents can request focused dependency context instead of broad file dumps.
• Deterministic — tree-sitter provides consistent structural parsing without relying on model inference.

---

Start here

npm install -g depwire-cli

Three commands for a supported codebase:

depwire whatif     # simulate a proposed change

depwire security # scan for supported finding patterns depwire viz # view the recorded dependency graph

---

Tested on real-world projects

Historical depwire parse runs on public repositories, last validated with v1.8.2 (June 2026).

Pre-1.9.0 measurement. v1.9.0 fixed parser bugs (double-emitted symbols in the TypeScript/Python/C#/C++/Java parsers, dropped type-only-import edges, false orphans) that directly affect symbol counts, edge counts, and health scores. Later releases changed graph contents and health methodology again. These numbers have not been re-measured and are not current results.

---

What If simulation

Know the blast radius before you touch anything.

depwire whatif . --simulate delete --target src/utils/encode.ts

Real output on honojs/hono — 352 files, 6,245 symbols:

Health Score: 41 → 41 (+0 → unchanged) Affected Nodes: 29 Broken Imports: 30 • src/utils/jwt/jwt.ts imports decodeBase64Url • src/adapter/aws-lambda/handler.ts imports encodeBase64 • src/utils/basic-auth.ts imports decodeBase64 [27 more...] Removed Edges: 32

Pre-1.9.0 measurement — captured before the v1.9.0 parser fixes; not re-measured.

The simulation operates on a loaded graph without changing source files; loading or parsing the graph requires file I/O.

Five operations:

depwire whatif . --simulate delete --target src/utils/encode.ts

depwire whatif . --simulate move --target src/utils/encode.ts --destination src/core/encode.ts depwire whatif . --simulate rename --target src/utils/encode.ts --destination src/utils/encoder.ts depwire whatif . --simulate split --target src/services/auth.ts --symbols "validateToken,refreshToken" depwire whatif . --simulate merge --target src/utils/helpers.ts --merge-target src/utils/formatters.ts

Run without --simulate to open the browser UI — side-by-side arc diagrams showing current vs simulated state.

---

Cross-module dependency intelligence

For multi-module Maven and Gradle projects, Depwire resolves imports across module boundaries — not just within a single module.

Example: simulating deletion of Injector.java in google/guice (a 13-module Java DI framework):

$ depwire whatif . --simulate delete --target core/src/com/google/inject/Injector.java

Action: DELETE core/src/com/google/inject/Injector.java Affected Nodes: 128 Broken Imports: 124 (cross-module: 106 across 10 extension modules)

Pre-1.9.0 measurement — google/guice is a Java project; the Java parser's double-emission bug (fixed in v1.9.0) affects this figure. Not re-measured.

Cross-module resolution lets impact analysis report supported relationships across module boundaries.

Supported build systems:

• Maven (pom.xml with declarations, recursive nested modules)
• Gradle (settings.gradle / settings.gradle.kts with include() declarations)

Both standard (src/main/java) and non-standard (src/) source layouts are supported.

---

Security scanner

Depwire's security scanner reports findings locally and can fail a configured CI gate.

depwire security .                        # full repo scan

depwire security . --target src/auth.ts # single file depwire security . --format sarif # GitHub Security tab integration depwire security . --fail-on high # CI gate — exit 1 if HIGH or above depwire security . --class secrets # specific check only depwire security . --no-dependency-audit # skip dependency checks and their network requests

10 check categories — depende