
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Scriptable interface to a powerful, multi-lingual language server built on top of Tree-sitter
Codegen is a python library for manipulating codebases.
from codegen import Codebase
# Codegen builds a complete graph connecting
# functions, classes, imports and their relationships
codebase = Codebase("./")
# Work with code without dealing with syntax trees or parsing
for function in codebase.functions:
# Comprehensive static analysis for references, dependencies, etc.
if not function.usages:
# Auto-handles references and imports to maintain correctness
function.move_to_file("deprecated.py")
Write code that transforms code. Codegen combines the parsing power of Tree-sitter with the graph algorithms of rustworkx to enable scriptable, multi-language code manipulation at scale.
We support
# Install inside existing project
uv pip install codegen
# Install global CLI
uv tool install codegen
# Create a codemod for a given repo
cd path/to/repo
codegen init
codegen create test-function
# Run the codemod
codegen run test-function
# Create an isolated venv with codegen => open jupyter
codegen notebook
See Getting Started for a full tutorial.
from codegen import Codebase
Having issues? Here are some common problems and their solutions:
[[ packages ]]
: This means you're likely using an outdated version of UV. Try updating to the latest version with: uv self update
.No module named 'codegen.sdk.extensions.utils'
: The compiled cython extensions are out of sync. Update them with uv sync --reinstall-package codegen
.RecursionError: maximum recursion depth exceeded
error while parsing my codebase: If you are using python 3.12, try upgrading to 3.13. If you are already on 3.13, try upping the recursion limit with sys.setrecursionlimit(10000)
.If you run into additional issues not listed here, please join our slack community and we'll help you out!
Software development is fundamentally programmatic. Refactoring a codebase, enforcing patterns, or analyzing control flow - these are all operations that can (and should) be expressed as programs themselves.
We built Codegen backwards from real-world refactors performed on enterprise codebases. Instead of starting with theoretical abstractions, we focused on creating APIs that match how developers actually think about code changes:
Natural mental model: Write transforms that read like your thought process - "move this function", "rename this variable", "add this parameter". No more wrestling with ASTs or manual import management.
Battle-tested on complex codebases: Handle Python, TypeScript, and React codebases with millions of lines of code.
Built for advanced intelligences: As AI developers become more sophisticated, they need expressive yet precise tools to manipulate code. Codegen provides a programmatic interface that both humans and AI can use to express complex transformations through code itself.
Please see our Contributing Guide for instructions on how to set up the development environment and submit contributions.
For more information on enterprise engagements, please contact us or request a demo.
FAQs
Scriptable interface to a powerful, multi-lingual language server built on top of Tree-sitter
We found that codegen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.