
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Git history analysis for AI workflows - discover risk, ownership, and evolution patterns in your codebase
Git history analysis that reveals what your commit messages won't tell you.
Where you struggled. What keeps breaking. Who owns what. Why your project feels slow.
Your repository remembers everything. Gitspect tells you what matters.
Gitspect transforms commit data into actionable insights about:
Privacy-first: 100% offline analysis. No APIs, no cloud, no data leaving your machine.
Built for AI workflows: Auto-generates SKILL.md files that help AI assistants understand your repository.
npm install -g gitspect
Or run directly with npx:
npx gitspect <command>
# First-time setup (creates config and AI skills)
gitspect init
# Personal retrospective - what did I work on?
gitspect reflect
# Find risky files
gitspect scars
# Comprehensive overview for AI assistants
gitspect context --json
| Command | Description |
|---|---|
gitspect init | Initialize .gitspectrc config and auto-generate skills/gitspect/SKILL.md for AI agents |
Example:
gitspect init
# ✓ Created .gitspectrc
# ✓ Created skills/gitspect/SKILL.md
For vibe coders who need context recovery and personal insights.
| Command | Description |
|---|---|
gitspect reflect | Personal retrospective with activity summary, file churn, and insights |
gitspect churn | File churn detection - identify frequently modified files |
gitspect heatmap | Activity heatmap - visualize when you code most |
Example:
gitspect reflect --days 30
For understanding codebase ownership and risk areas.
| Command | Description |
|---|---|
gitspect blame-map | File ownership mapping - who owns which files |
gitspect scars | Riskiest files to modify - high-churn, bug-prone areas |
gitspect couples | Files changed together - discover hidden dependencies |
Examples:
# Show top 10 riskiest files
gitspect scars --limit 10
# Check risk level of a specific file (great for AI context)
gitspect scars --file src/components/Button.tsx --json
For understanding project health and blockers.
| Command | Description |
|---|---|
gitspect report | Project health report - metrics, concerns, and positive signals |
gitspect blockers | What's slowing progress - hotspots, instability, complexity |
gitspect evolution | Codebase evolution over time - trends and growth patterns |
Example:
gitspect blockers --days 90
Comprehensive repo overview designed for AI assistants.
| Command | Description |
|---|---|
gitspect context | AI context - comprehensive repo overview with risk assessment |
Example:
gitspect context --json > repo_context.json
All commands support these options:
| Option | Description |
|---|---|
--days <n> | Time period in days (default: all time, all branches) |
--current-branch | Only analyze the current branch (default: all branches) |
--json | Output as JSON (recommended for AI consumption) |
--no-ignore | Include files that would normally be filtered (lock files, build artifacts, etc.) |
--limit <n> | Limit output to top N results (churn, scars, couples) |
--file <path> | Filter analysis to a specific file (scars command) |
--granularity <week|month> | Time granularity for evolution command |
Tip for AI workflows: Use the
--jsonflag to get clean, machine-readable output. Without it, the output includes colors, tables, and formatting that AI tools may not parse correctly.
Create .gitspectrc in your repository root to customize behavior:
{
"exclude": [
"tests/fixtures/",
"*.mock.ts",
"docs/"
],
"include": [],
"skillPrompt": "auto"
}
| Setting | Description |
|---|---|
exclude | File patterns to ignore during analysis (lock files, build artifacts, etc.) |
include | File patterns to explicitly include (overrides exclude) |
skillPrompt | Control AI skill file behavior: auto (prompt if needed), always (auto-update), never (don't create) |
Gitspect automatically filters out common noise files:
package-lock.json, yarn.lock, pnpm-lock.yaml, etc.dist/, build/, *.min.js, etc.*.generated.*, *.gql.ts, swagger files, etc.Use --no-ignore to include all files if needed.
Gitspect is designed to work with AI assistants (Claude, Cursor, ChatGPT, etc.).
When you run gitspect init, it creates skills/gitspect/SKILL.md - a context file that AI agents automatically use to understand your repository.
The SKILL.md includes:
Auto-update behavior:
skillPrompt: "auto" - Prompts to update SKILL.md when Gitspect version changesskillPrompt: "always" - Automatically keeps SKILL.md updatedskillPrompt: "never" - Disables SKILL.md managementImportant: Always use the
--jsonflag when providing output to AI assistants. Without it, the output contains ANSI colors, table formatting, and text wrapping that AI tools cannot parse correctly.
Run gitspect context --json to get a comprehensive repo overview:
{
"overview": {
"health": "moderate",
"totalCommits": 147,
"activeContributors": 3,
"primaryLanguage": "ts",
"developmentVelocity": "high"
},
"criticalAreas": {
"highRiskFiles": [{
"path": "src/payment.ts",
"riskScore": 73,
"why": "3x higher churn than average; 28% bugfix rate",
"recommendation": "proceed with caution, add tests"
}]
},
"ownership": {
"busFactor": 2,
"keyOwners": [...]
},
"warnings": [
"Low bus factor: project depends on 2 or fewer contributors"
]
}
AI can use this context to:
# Install dependencies
npm install
# Build
npm run build
# Run locally
npm run dev reflect
npm run dev context --json
# Link for global testing
npm link
MIT © tscburak
FAQs
Git history analysis for AI workflows - discover risk, ownership, and evolution patterns in your codebase
The npm package gitspect receives a total of 6 weekly downloads. As such, gitspect popularity was classified as not popular.
We found that gitspect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.