
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@sylphx/repomap
Advanced tools
A map of your codebase for AI agents: code graph, search, call paths and change impact, with an interactive graph UI. Rust MCP server + CLI. Local, no API key.
A map of your codebase for you and your AI agent.
Code graph · hybrid search · call paths · change impact · an interactive graph UI.
One Rust binary. Local. No API key. MIT.
Live demo · Docs · Quickstart · Tools · Graph UI · Benchmarks · Compare
The real UI on excalidraw (687 files, indexed in under half a second): search, a symbol's code and callers, then the blast radius of a change. Try it in your browser, no install needed.
npx -y @sylphx/repomap setup # add repomap to Claude Code, Codex, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI
npx -y @sylphx/repomap serve # open the graph UI for the current repo
That's it. Add --claude-hooks to also enrich Claude Code's Grep and Glob. setup detects the clients you have, writes their MCP config, and prints every change it made. Run it again and nothing changes. Then ask your agent: "Use repomap to map this repo."
{
"mcpServers": {
"repomap": { "command": "npx", "args": ["-y", "@sylphx/repomap", "mcp"] }
}
}
Claude Code: claude mcp add repomap -- npx -y @sylphx/repomap mcp
Codex (~/.codex/config.toml):
[mcp_servers.repomap]
command = "npx"
args = ["-y", "@sylphx/repomap", "mcp"]
The server indexes the client's workspace root (or its working directory, or REPOMAP_ROOT). Every tool also takes root.
Agents burn most of their context on grep, ls and reading whole files just to work out where things are. repomap gives them the map up front:
file:line.git diff before you commit.All of it comes from a local index: tree-sitter parsing, a resolved import and call graph, PageRank, Louvain communities and BM25 over AST chunks. Nothing leaves your machine, and no model or embedding API is called.
Five tools, each with an obvious job:
| Tool | Ask it | Returns |
|---|---|---|
map | "Give me the lay of the land" / focus: "src/server" | Modules, central files, key symbols, entry points; an outline with line numbers when focused |
search | "refresh token expiry", "parseConfig" | Ranked file:line ranges (functions, methods, classes) with the matching lines |
context | SessionStore.refresh, src/auth/token.ts, token.ts:42 | Code, callers (with call sites), callees, subtypes, members, imports, importers, tests |
trace | from: handleRequest, to: db.query | Shortest call path, or the call tree above/below a symbol |
impact | target: verifyToken or changed: true | Risk level, callers by depth, importing files, modules, tests to run |
Answers are compact text that cites file:line, so they cost few tokens. Pass format: "json" for structured output.
> impact target=decode
# Impact (LOW risk)
Changing: function decode (src/auth/token.ts:14)
1 direct caller, 3 symbols affected in total across 3 files and 2 modules; 1 file importing the changed files; no tests reach this.
## Direct callers (will break if the contract changes)
- function verifyToken — src/auth/token.ts:8
## Indirect (depth 2)
- method SessionStore.refresh — src/auth/session.ts:5
## Indirect (depth 3)
- function handleRefresh — src/api/router.ts:6
## Importing files
- src/auth/session.ts
The same five commands work in your terminal: repomap map, repomap search "…", repomap context X, repomap trace A B, repomap impact --changed.
npx -y @sylphx/repomap serve # live, with code preview
npx -y @sylphx/repomap export # repomap.html: one self-contained file you can publish
![]() | ![]() |
| Impact. Select a file and press i: everything that depends on it lights up by depth, with a list you can click through. | Code. Click a symbol to see its source, callers and callees. Open ↗ jumps to your editor or to GitHub. |
export writes one HTML file with deep links (#path/to/file) and GitHub links pinned to your commit. It's a good fit for a README, a wiki or a design review.npx -y @sylphx/repomap setup --claude-hooks
This is opt-in and safe to run again; setup --remove takes it out. It installs a PreToolUse hook: whenever Claude Code runs Grep or Glob, repomap adds where the symbol is defined, who calls it and which module it belongs to. It answers in tens of milliseconds and never blocks the search.
repomap (code map) for this search:
- function `compose` defined at src/compose.ts:15 (module router); 3 callers: Hono.route (src/hono-base.ts:228), Hono.#dispatch (src/hono-base.ts:452), every (src/middleware/combine/index.ts:102)
Parsed with tree-sitter for symbols, calls, imports and inheritance: TypeScript, TSX, JavaScript, Python, Go, Rust, Java, Kotlin, Swift, C, C++, C#, Ruby, PHP. Search also covers Markdown, YAML, TOML, JSON, SQL, shell, Protobuf, GraphQL, HTML/CSS, Vue, Svelte, Scala and more.
Modules are found among your core code only. Tests, examples, docs and benchmarks are grouped separately, so they never name or blur a module.
Import resolution understands relative paths, @/ aliases, npm workspace packages, Python packages and relative imports, Go modules, Rust mod/use/workspace crates, Java/PHP namespaces, C/C++ includes and Ruby require. .gitignore is respected, and so is .repomapignore.
The index is built in parallel and cached per file, so after the first run only changed files are parsed again. The MCP server keeps the graph in memory and refreshes it when files change.
Measured on a 4 vCPU GitHub-hosted runner (method and full table):
| Repository | Code files | Cold index | Warm index | search p50 | impact p50 |
|---|---|---|---|---|---|
| kubernetes | 11,710 | 11.2 s | 1.9 s | 57 ms | 5 ms |
| vscode | 6,125 | 8.0 s | 1.3 s | 7 ms | 6 ms |
| django | 2,271 | 2.2 s | 0.4 s | 21 ms | 1 ms |
| rust-analyzer | 1,512 | 1.8 s | 0.3 s | 4 ms | 2 ms |
| repomap | GitNexus | Serena | claude-context | Aider repo map | |
|---|---|---|---|---|---|
| Licence | MIT | PolyForm Noncommercial | MIT | MIT | Apache-2.0 (inside Aider) |
| Setup | npx … setup, one binary | npx, Node | Python + language servers | Vector DB + embedding API key | Part of Aider |
| API key / network | None | None for the graph | None | Required (embeddings) | None |
| Code graph (calls, imports, inheritance) | ✅ | ✅ | Via LSP references | — | Ranking only |
| Change impact / blast radius | ✅ incl. git diff | ✅ | — | — | — |
| Call path between two symbols | ✅ | ✅ | — | — | — |
| Keyword + symbol search | ✅ BM25 + names | ✅ | ✅ symbols | Semantic (vectors) | — |
| Interactive graph UI | ✅ local + static export | ✅ | — | — | — |
| Claude Code Grep/Glob hook | ✅ opt-in | ✅ | — | — | — |
| Module detection | ✅ Louvain | ✅ | — | — | — |
| Edits code | — (read-only) | — | ✅ | — | ✅ |
| Engine | Rust | TypeScript | Python | TypeScript | Python |
Pick Serena if you want LSP-precise refactoring edits, and claude-context if you want embedding-based semantic search. repomap is for understanding and navigating a codebase with zero setup, and a licence you can use at work.
repomap setup [--client cursor,codex] [--claude-hooks] [--dry-run] [--remove]
repomap serve [dir] [--port 7878] [--no-open]
repomap export [dir] [--out repomap.html] [--json]
repomap map [dir-to-focus] [-C root] [--json]
repomap search <query> [--path src/] [--kind function] [--limit 10]
repomap context <target> [--code-lines 60]
repomap trace <from> [to] [--callers] [--depth 3]
repomap impact [targets…] [--changed] [--base main]
repomap index [dir] [--no-cache] [--json]
repomap mcp [--root dir]
Binaries for macOS (arm64, x64), Linux glibc (x64, arm64) and Windows x64 ship as npm optional dependencies. They're also attached to each GitHub release. From source: cargo install --git https://github.com/SylphxAI/repomap repomap.
repomap merges Spine (architecture graph) and Locus (BM25 code search, formerly CodeRAG) into one tool. @sylphx/spine, @sylphx/locus and @sylphx/coderag still install and run repomap. The old tool names (architecture_*, codebase_search) are still accepted until 2.0, but new setups should use @sylphx/repomap.
cargo test --workspace # engine + CLI tests
bun install && bun run build:ui # rebuild the UI bundle (ui/ -> crates/repomap/assets/)
cargo run -p repomap -- serve .
Issues and PRs are welcome, and new language support is especially useful: add a grammar and a query in crates/repomap-core/src/lang.rs.
MIT © Sylphx
FAQs
A map of your codebase for AI agents: code graph, search, call paths and change impact. No API key.
We found that @sylphx/repomap demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.