Codeweb

Free & MIT-licensed. Runs entirely on your machine — no account, no server, no telemetry. Reads your code; never executes it.

Website · Gate every PR · See it in action · Install · Use · For agents (MCP: Model Context Protocol) · How it works · Free forever · Changelog

See what your AI edits affect.

npx -y @ghostlygawd/codeweb .

_{The large number is the latest seven completed days; the line shows daily downloads. Package downloads are retrievals, not a count of users. Select the chart for the live data and reporting cutoff.}

Structural checks for AI code changes. codeweb's gate builds the call graph before and after a change, then fails the pull request on three regressions: a new dependency cycle, a new body-confirmed duplication, or an existing non-exported symbol that becomes an orphan with no mapped callers. Gate conditions and limits.

No LLM is in the checks. The gate uses zero model tokens for its static analysis. A passing check does not prove the program works. Analysis can miss dynamic relationships; inspect unresolved results and run the relevant tests. Pure removals pass the structural rules.

The verdict uses the mapped graph, not a model, and costs zero LLM tokens. Exported symbols are exempt from the diff’s orphan check. Inspect analysis.checks: skipped checks are not passes, and refresh drops the evidence needed to evaluate duplication.

A green result does not establish complete dependency coverage or behavioral correctness. Pure removals do not count as structural regressions. Put it on your PRs →

The gate needs a map to compare, and that map is worth reading on its own.

codeweb reads your code. It maps supported functions and the calls it can resolve between them. It maps 3,000 symbols in approximately 3 seconds. Static analysis produces the same map from the same code. No LLM is in the mapping loop.

Static extraction can omit unsupported layouts, ambiguous calls, and runtime dispatch; the map is not a completeness guarantee.

Your coding agents query the map instead of using grep. In measured tests, agents that used grep missed more than half of a function's real callers (see the measurements). An incomplete caller list can cause an agent to break code that it did not inspect.

• Give agents structural data: The Model Context Protocol (MCP) server provides 28 tools, including codeweb_impact, codeweb_callers, and codeweb_find_similar.
• Keep answers small: Each query returns a bounded structural answer. Your agents can use their remaining context for implementation work.
• Inspect the same data: The interactive report shows the extracted codebase map.

The map also shows relationships that are not visible in one file. These relationships include duplicated logic, dead code, hotspots, and tangled domains.

_{Measured against fixed tasks and independent oracles. Select the proof strip for the methodology and receipts.}

Try it on your repo

cd your-project
npx -y @ghostlygawd/codeweb .

For a repository with 3,000 symbols, the first map takes approximately 3 seconds. Open .codeweb/report.html to inspect the map.

_{Real run against Zod at commit 912f0f5, captured 2026-07-29. The replay shortens the absolute local path to .codeweb; the displayed values are unchanged.}

Gate every pull request

From a Codeweb source checkout, run the verdict locally; the GitHub Action can run it on every pull request:

node scripts/ci-gate.mjs --base origin/main --target src   # exit 1 on a structural regression

The gate builds the graph from the pull request base and from its head, then diffs them. It posts a sticky structural review comment either way, so reviewers see the blast radius without installing anything.

Pin the Action to a release tag, not a moving branch: a floating ref can change your gate's verdict semantics under you. Pin codeweb-ref to the same tag so the engine is fixed too. The workflow YAML, the monorepo matrix form, and every input live in docs/ci-gate.md.

Want the gate hosted — no workflow YAML, cached base graphs, and history across every repo in the org? That is the planned scope of codeweb Teams, the paid half of the boundary. Running it yourself stays free forever.

See it in action

Each screenshot below shows a generated report for axios (278 symbols, 7 domains). The screenshots are not mockups.

codeweb found 3 real duplications in axios and rejected 12 false positives. Read the case study, or inspect the live map.

Know what an edit breaks — before you write

Select a function in the live map. The map highlights the function's blast radius and shows the symbols that the change can affect.

Your agents can get the same answer from the codeweb_impact MCP tool before they edit the code.

_{Selecting AxiosError in axios lights up its 31 callers across the domains that depend on it — try it yourself in the living map.}

Navigate the whole system

The force-directed map shows the extracted symbols. You can collapse symbols into domains. Search, drag, zoom, or select a node to trace its callers and dependencies.

Findings — stop guessing what to refactor

The Findings tab ranks duplication, highly connected hotspots, and likely dead code. Select a row to inspect the symbol's callers and dependencies.

See duplication density, and where domains tangle

Treemap — The size of each block shows the file's lines of code. A brighter block contains more duplicated code. Use the bright blocks to identify possible consolidation targets.

Matrix — The matrix shows coupling between domains. A large off-diagonal cell shows strong coupling. You can merge the domains or add a clear interface between them.

_{The deterministic pipeline, looping: extract → cluster → overlap → render.}