
Security News
US Government Forces Anthropic to Pull Claude Fable Days After Launch
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.
@specd/code-graph
Advanced tools
Code graph indexing and analysis library for specd. Parses source files across multiple languages, extracts symbols and relationships, and stores the result in a persistent graph database for impact analysis, traversal, and full-text search.
Code graph indexing and analysis library for specd. Parses source files across multiple languages, extracts symbols and relationships, and stores the result in a persistent graph database for impact analysis, traversal, and full-text search.
GraphStore, with sqlite as the built-in default and ladybug still available by explicit backend idThe graph has three node types:
| Node | Key fields | Description |
|---|---|---|
FileNode | path, language, contentHash, workspace | A source file. path is workspace:relative/path. |
SymbolNode | id, name, kind, filePath, line, column | A declared symbol within a file. |
SpecNode | specId, path, title, description, contentHash, dependsOn | A specd spec document. |
Relations between nodes are typed by RelationType: IMPORTS, EXPORTS, CALLS, DEFINES, DEPENDS_ON, COVERS.
Symbol kinds are: function, class, method, variable, type, interface, enum.
createCodeGraphProvider(config)
└─ CodeGraphProvider ← public facade (index, query, traverse, analyze)
├─ IndexCodeGraph ← application use case (discover → diff → extract → store)
│ ├─ AdapterRegistry ← routes files to the right language adapter
│ │ ├─ TypeScriptLanguageAdapter
│ │ ├─ GoLanguageAdapter
│ │ ├─ PythonLanguageAdapter
│ │ └─ PhpLanguageAdapter
│ └─ GraphStore (port) ← implemented by SQLiteGraphStore or LadybugGraphStore
└─ domain services ← getUpstream, getDownstream, analyzeImpact, computeHotspots, …
Language adapters implement the LanguageAdapter interface and can be registered
externally for additional language support.
import { createCodeGraphProvider } from '@specd/code-graph'
const graph = createCodeGraphProvider(specdConfig)
await graph.open()
// Index a workspace
const result = await graph.index({
workspaces: [{ name: 'core', codeRoot: 'packages/core/src', specRoot: 'specs/core' }],
exclude: ['**/*.spec.ts'],
})
// Query
const symbols = await graph.findSymbols({ name: 'createChange', kind: 'function' })
// Impact analysis
const impact = await graph.analyzeImpact(symbols[0].id, 'downstream', 3)
// Hotspots
const hotspots = await graph.getHotspots({ limit: 10 })
await graph.close()
To force the legacy backend explicitly:
const legacyGraph = createCodeGraphProvider(specdConfig, {
graphStoreId: 'ladybug',
})
Pass a SpecdConfig (the standard specd configuration object) to
createCodeGraphProvider and it derives the storage path from config.configPath.
For the default project layout this means:
.specd/config/graph.specd/config/tmpBackends are selected internally by id at composition time:
sqliteladybuggraphStoreFactories@specd/code-graph is used by the MCP server and CLI to answer questions about
code structure and spec coverage. It indexes both source files and spec documents
so that tools can surface which specs cover which code, which symbols are at risk
when a file changes, and which parts of the codebase change most frequently.
The package depends on @specd/core for configuration types and is otherwise
self-contained. It does not depend on @specd/cli or @specd/mcp.
FAQs
Code graph indexing and analysis library for [specd](https://github.com/specd-sdd/SpecD). For more information, visit [getspecd.dev](https://getspecd.dev). Parses source files across multiple languages, extracts symbols and relationships, and stores the r
The npm package @specd/code-graph receives a total of 16 weekly downloads. As such, @specd/code-graph popularity was classified as not popular.
We found that @specd/code-graph demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Anthropic says the directive cited national security concerns over a narrow jailbreak, but offered no specific technical details.

Security News
A network of 152 Chrome live wallpaper extensions hid ad tracking and made extension-driven traffic look like Google search clicks.

Company News
Socket’s first CISO brings deep experience securing high-growth SaaS companies as open source supply chain threats accelerate.