
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
Graph-backed codebase intelligence for AI coding editors. Real dependency graphs, MCP server, and installable skills/agents/workflows across 10 AI IDEs.
GraphWard gives AI coding assistants a living blueprint of your codebase so they stop guessing, hallucinating, and breaking working code.
When you ask standard AI to write code, it often guesses how your project works. It might change a button and accidentally break your database, or delete code it didn't understand.
GraphWard is built for engineers and engineering teams who use AI coding assistants.
GraphWard acts like an automated lead architect and project manager:
Open your terminal in your project folder and run:
npx graphward initialize . --providers auto
This auto-detects your AI IDE (from project markers like .claude/, or from globally installed IDE configs such as ~/.claude), configures providers, maps dependencies, and bootstraps .graphward/.
If auto-detection misses your editor (or an older install fell back to the generic adapter), install the right adapter explicitly:
npx graphward install . --ide claude-code --yes
Then restart your AI IDE so it picks up the new slash commands, and run /graphward in the chat. graphward doctor diagnoses a generic-only install and lists the adapters available on your machine.
Open your project in any supported AI editor (Google Antigravity, Cursor, Claude Code, GitHub Copilot, etc.).
In your AI chat window, invoke the /graphward workflow shortcut followed by your request in plain English.
/graphward The checkout submit button isn't giving feedback./graphward Add an export-to-PDF button on the customer invoice page.You can target specific AI IDEs directly:
npx graphward install . --ide cursor --ide claude-code --yes
GraphWard includes staleness detection — it scores artifact freshness and warns when intelligence is stale. Install automatic sync hooks during setup:
npx graphward install . --ide <your-editor> --hooks --yes
This adds post-commit and post-merge hooks that incrementally sync affected intelligence artifacts.
Prune expired negative constraints and failed attempt records (default: 30 days):
npx graphward prune . --ttl-days 30
By default, .graphward/ content-derived artifacts are gitignored. Use --share during initialization to generate a redacted architecture summary safe for version control. A secrets scan runs before any file is written to .graphward/. See SECURITY.md for details.
flowchart TD
User["Your Prompt: /graphward <request>"] --> Orchestrator["engineering-orchestrator"]
Orchestrator --> Clarity{"Is the prompt clear?"}
Clarity -->|Vague / Missing Details| Gate["Socratic Gate: Asks 2-3 multiple-choice questions"]
Gate --> Freezing["Freezes decisions in requirements"]
Clarity -->|Clear| Blueprint["Reads Dependency Graph & Negative Constraints"]
Freezing --> Blueprint
Blueprint --> Impact["Writes Impact Report (IMP-XXX)"]
Impact --> Implement["Implements with Specialist Agents"]
Implement --> Verify["Runs Project Tests & Verification Records"]
Verify --> Verification{"Did all checks pass?"}
Verification -->|Yes| Sync["Updates living blueprint (.graphward/) & Change History"]
Verification -->|No| Revert["Reverts failed change for review"]
.graphward/ documentation, dependency graphs, and change records so project intelligence stays fresh.GraphWard's native parser currently supports TypeScript, JavaScript (including JSX/TSX, .mjs, .cjs), Python, Go, Rust, Ruby, Java, and Kotlin for dependency graph construction. Detection is based on import/export analysis via regex-based parsing. Other file types are included in the project file tree but without deep symbol-level graph edges.
Tree-sitter is available as an optional parser. If the tree-sitter and language grammar peer dependencies are installed, GraphWard will use them for more accurate extraction of imports and exports.
GraphWard operates entirely on your local machine:
| What GraphWard reads | What GraphWard writes | What GraphWard executes |
|---|---|---|
| Source files in your project | .graphward/ directory only | Your project's configured check commands (test, lint, typecheck) |
package.json, config files | IDE-specific config (e.g., .cursor/rules/) | Nothing else — no network calls, no telemetry |
| Git history (local) | — | — |
No telemetry. No cloud sync. No data leaves your machine. All intelligence artifacts are plain markdown and JSON files you can inspect, edit, or delete at any time.
By default, .graphward/ content-derived artifacts are gitignored. Use --share during initialization to generate a redacted architecture summary safe for version control. A secrets scan runs before any file is written to .graphward/.
For full details, see SECURITY.md.
Based on the benchmark/harness/tasks.mjs test suite against standard AI IDE usage:
Testing graph build (npx graphward map) on a synthesized large multi-package project (React + Express + 50 packages):
GraphWard's internal data formats are open and documented. See the schemas/ directory for versioned JSON Schema definitions of our artifacts.
Your intelligence is portable. GraphWard writes everything to .graphward/ — a plain directory of markdown and JSON that works across any AI IDE. Switch from Cursor to Claude Code to Copilot? Your architecture graph, memory, and project context follow you. No vendor lock-in.
Cost-aware by design. Every request gets a dynamic token budget based on task risk — trivial fixes use ~2,000 tokens of context, critical architecture changes scale up to 15,000. No uncapped context loading.
What the platforms won't do:
npm ci
npm test # Runs all automated tests
npm run test:integration
npm run build
Full technical architecture documentation is available in WORKFLOW_GUIDE.md and graphward-blueprint.md.
FAQs
Graph-backed codebase intelligence for AI coding editors. Real dependency graphs, MCP server, and installable skills/agents/workflows across 10 AI IDEs.
The npm package graphward receives a total of 0 weekly downloads. As such, graphward popularity was classified as not popular.
We found that graphward demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.