WEAVATRIX 1.1.2

Give your AI agent a reusable map of the application.

Weavatrix builds one native local evidence graph, then reuses it for impact, APIs, Health, dead code, duplicates, Git history, search, semantic links, memory and architecture safeguards. Core stays read-only; writes live in Refactor and networking lives in Online.

Get started Compare products ↓
# native, offline, zero runtime dependencies
$ claude mcp add -s user weavatrix -- npx -y weavatrix mcp <repoRoot>
# same for Codex:
$ codex mcp add weavatrix -- npx -y weavatrix mcp <repoRoot>
# or install the same MCP product from crates.io:
$ cargo install weavatrix
$ weavatrix mcp <repoRoot> --profile=code

# then, inside Claude Code:
 what breaks if I change the auth middleware?
→ change_impact: 3 changed files map to 9 symbols; 41 dependents in blast radius,
   7 untested hotspots called out — ranked by proximity × connectivity.

One family. Three explicit trust boundaries.

The native Core is the network-free, source-read-only foundation. Refactor adds reviewed local writes. Online adds an explicitly authorized network connection. All three public packages are MIT.

NATIVE · FREE · OPEN SOURCE

Weavatrix Core 1.1.2

MIT

The native MCP product for coding agents: 39 read-only tools for application maps, exact context, Health, dependencies, duplicates, blast radius, APIs, Git, search, semantic links, memory and architecture ratchets.

  • No network path, source-write path, install script, runtime download or external executable.
  • The same native adapter ships through Cargo and npm for Windows, macOS and glibc Linux on x64 and arm64.
  • Backed by weavatrix-rust 2.0.2 and weavatrix-graph 0.6.3, with 24 code and repository surfaces.
$ npx -y weavatrix mcp <repoRoot>
$ cargo install weavatrix
WRITE LAYER · OPEN SOURCE

Weavatrix Refactor 0.1.5

MIT

A separately installed layer that composes Core and adds 11 MCP tools: nine read-only plan producers plus write-gated apply and rollback.

  • Plan producers — rename, move file/symbol, delete-readiness, change-signature, edit-symbol, bulk-replace, organize-imports — emit hash-bound edit plans with honest provenance.
  • Applying a plan requires the refactor profile, an edit-enable environment flag and a single-use plan token; rollback needs none, and every apply is reversible.
  • Preview → confirm → apply → rollback, all proven against the read-only Core.
AvailabilityFull refactoring layer · write-gated apply, always reversible
NETWORK LAYER · OPEN SOURCE

Weavatrix Online 0.3.1

MIT

A public connector with 52 MCP tools: 34 local analysis tools, all 11 Refactor tools, and seven Online tools for endpoint status, advisory refresh, malware review, architecture contracts and preview-confirmed graph sync.

  • Connects to Weavatrix Cloud or a compatible customer-controlled endpoint.
  • Sync is explicit and source-free: no source bodies, snippets, absolute paths, credentials or Git remotes.
  • preview_sync returns the exact bounded payload and a short-lived token before sync_graph can send anything.
AvailabilityPublic MIT client · Cloud access controlled by endpoint authorization

Clear boundary: Core, Refactor, and the public Online connector are MIT. Their safety boundaries come from separate packages, capabilities, preview tokens, and explicit runtime configuration.

The protocol-independent Rust engine beneath Core.

weavatrix-rust@2.0.2 is the reusable repository-intelligence engine and library. It does not implement an MCP server; weavatrix@1.1.2 owns the MCP adapter and ships the same native product through Cargo and npm.

EMBEDDABLE · PURE RUST · READ ONLY

weavatrix-rust 2.0.2

MIT

Build repository-aware Rust systems from typed analyzers, deterministic snapshots, evidence graphs and 39 bounded operations—without importing a transport into the engine.

  • Lossless parsing across 24 code, API, infrastructure, configuration, document and UI-source surfaces.
  • Optional Git, search, clone, vector, semantic and temporal-memory capabilities layer evidence over weavatrix-graph 0.6.3.
  • Duplicate results keep families, members and pair IDs coherent after filtering; the standalone binary identifies itself as weavatrix-rust.
  • Use the Rust facade as a library or the standalone engine CLI; choose weavatrix when the application needs MCP.
[dependencies]
weavatrix-rust = { version = "2.0.2", default-features = false }
73.21 msmedian full graph build, three basic release runs
7.436 msunchanged repository refresh
0.661 msmean hot graph-stats call across a 1,000-call load run
87.71%Rust line coverage release gate

The basic 2.0.2 verification uses the native engine against its committed 192-file repository: 1,531 nodes and 7,287 edges. Coverage also records 80.57% of functions and 85.30% of regions. The short load run is intentionally bounded rather than presented as an exhaustive performance study. Reproducible methodology and component evidence remain published with the Rust repository.

The graph your agent is missing

This is not one report or three fixed workflows: 39 methods project the same reusable graph into the smallest view needed for each task. Grep sees text; Weavatrix sees structure: files, symbols, runtime edges and compile-time coupling — including Rust module paths, Java OOP relationships and project-internal Java receiver call flow. Typed adapters build semantic evidence for code, contracts and infrastructure, while the lossless parser preserves every supported source surface without pretending that CSS and Rust have the same semantic depth. A bounded, package-pinned TypeScript/JavaScript LSP overlay verifies ambiguous references locally without a native compiler or network request.

Fast application understanding

module_map, communities, endpoints and focused graph/context views turn a large unfamiliar repository into a bounded workset before the agent starts reading files.

Proof-carrying change safeguard

verified_change plans and verifies one change through exact context, blast radius, graph drift, architecture, duplicate, API and optional test ratchets, returning PASS, BLOCKED or an explicitly incomplete evidence state.

Change impact

change_impact diffs your branch (staged, unstaged, untracked included) and lists everything that depends on what you touched — with test coverage attached and untested hotspots called out.

Blast radius per symbol

get_dependents walks reverse edges transitively: every caller, importer and subclass that can feel your refactor, ranked by proximity and connectivity.

Signal-aware health audit

run_audit finds dead code, dependency mistakes and orphans, separates runtime cycles from compile-only coupling, and reports a capability matrix so missing local JARs, dynamic build logic, runtime, concurrency or advisory evidence can never look clean.

Exact REST and symbol context

list_endpoints proves declared versus reachable routes, mount chains and conditional Spring controllers. trace_endpoint follows one route; context_bundle ranks production callers and preserves call-site provenance.

Cross-repo API contracts

trace_api_contract joins HTTP, GraphQL, gRPC and event contracts across registered local repositories. Fresh revision-bound runtime or OTLP evidence confirms dynamic identities; uncaptured paths remain explicitly unproven instead of being guessed.

Clone detection, three lenses

find_duplicates uses MOSS winnowing over method bodies and embedded strings. It ranks near-clones and same-name divergence as review evidence while suppressing homogeneous router boilerplate by default.

Structural diff

rebuild_graph + graph_diff report the architecture delta of your edits: runtime versus compile-time dependencies, changed cycle membership, and symbols that lost their last caller.

History-backed architecture

git_history combines bounded local churn with graph connectivity, hidden co-change coupling and expected test/source movement. It reads numstat evidence, not commit messages, authors or source bodies.

Intended architecture ratchet

get_architecture_contract previews an adaptive Maven/Gradle/monorepo target before an explicit one-time approval; prepare_change and verify_architecture enforce it without silently rewriting policy.

One-call multi-repo mode

open_repo switches the active local repository and builds missing graphs through an explicit offline tool call. It also upgrades legacy graphs to edge metadata v2; omit retarget to pin one repository.

Code and schemas

Symbols, imports, ownership, calls and domain evidence where the source can prove them.

RustJavaScript / JSXTypeScript / TSXPythonGoJavaC#CC++SQLBash / ZshSwiftSolidity

Contracts and configuration

Typed API, deployment and configuration facts with exact source spans.

GraphQLProtobuf / gRPCJSON / JSONC syntaxKubernetes YAMLTerraform / HCLXML

Documents and UI sources

Lossless structure and byte-for-byte source recovery for repository context.

HTML / Vue / SvelteCSS / SCSS / Sass / LessMarkdown / MDXreStructuredTextAsciiDoc

What the agent actually gets

Six real task shapes from local dogfooding. The output stays bounded, exposes uncertainty, and carries the same graph evidence from orientation through verification.

  1. Graphmodules, symbols, routes
  2. Contextexact source workset
  3. Impactruntime and type radius
  4. RatchetsHealth, clones, architecture
  5. VerdictPASS, BLOCKED or incomplete evidence
Unfamiliar backend

From 1,076 files to one request flow

› Where does attack mitigation start?

module_map       → product territories
list_endpoints   → 462 observed routes
trace_endpoint  → mount → controller
                  → service → task/messaging

Result: one bounded call path with
call-site excerpts, not a repository dump.
Cross-repository API

Prove backend use outside its own graph

› Can this handler be removed?

trace_api_contract
  3 registered repository graphs
  163 backend endpoints observed
  267 client callsites joined

NOT_DEAD_EXTERNAL_USE
dynamic URLs remain POSSIBLE / unproven
Branch review

Classify a method change before editing blind

› What breaks in this BranchPilot diff?

change_impact
  removed methods / signatures separated
  additive exports kept low-risk
  98 impacted nodes observed
  runtime vs type-only radius retained

Then: context_bundle → edit →
verified_change phase=verify
Health and repetition

Turn a large repository into a review queue

› Show actionable debt, not boilerplate.

run_audit
  missing direct dependency: mongodb
  runtime cycle evidence + lockfile drift
find_duplicates
  repeated nudge() family observed
  router boilerplate suppressed by default

Every item stays review-required;
no auto-delete or cosmetic green score.
Event-driven flow

Trace a listener without forcing it through REST

› Who produces and consumes this event?

query_graph
  seed_symbols=["handleAttackEvents"]
  relation_filter=["calls","references"]
  flow_direction="both"
context_bundle → production callers first

Exact seeds keep tests and fuzzy config
matches out of the bounded flow.
Architecture bootstrap

Review the target before making it policy

› Preserve this architecture from now on.

get_architecture_contract action=preview
  adaptive source roots + candidate rules
  observed directions: NOT ENFORCED
  exact content + hash + one-time token
action=approve confirm_token=…

Creates only a missing local contract;
never overwrites active policy.

Release proof at the boundary we can reproduce.

The 2.0.2 engine was exercised against its own repository: 192 files became 1,531 nodes and 7,287 typed edges. Three clean graph builds establish the basic latency range; an unchanged refresh, literal search, and 1,000 hot graph_stats calls cover the short-load path. The installed Core 1.1.2 package then passed the same bounded MCP check.

73.21 msmedian full graph build
7.436 msunchanged refresh
136.83 calls/sinstalled Core short-load rate, 0 failures
87.71%Rust line coverage release gate
Basic checkResultScope
Full graph build62.80 / 73.21 / 91.29 msminimum / median / maximum, 3 runs
Unchanged refresh7.436 mssame repository revision
Literal search5.504 msnative engine operation
graph_stats0.661 ms mean1,000 hot calls
Measured coverage87.71% lines / 80.57% functions / 85.30% regionsRust release gate
Installed Core initialize405.770 mspack, isolated install, native MCP
Installed Core tools/list0.790 ms39 read-only MCP tools
Installed Core first graph_stats54.880 msfirst bounded MCP call
Installed Core hot graph_stats136.83 calls/s · p50 7.610 / p95 10.180 / p99 12.230 / max 48.360 ms1,000 calls, 0 failures

Measured July 30, 2026 with the native 2.0.2 engine executable. This is deliberately a basic release verification plus short load, not a claim about every repository, machine, or workload. Methodology and reproducible evidence remain versioned with the engine; installed-package evidence remains with Core.

Products and roadmap

Core, Refactor, and the public Online connector stay free and MIT. Source edits and networking remain separate, explicitly enabled product boundaries.

NOW · NATIVE · MIT

Core 1.1.2

The native MCP product: 39 network-free, source-read-only tools spanning repository graphs, impact, APIs, architecture, Git, search, semantics and memory. Install the same adapter from Cargo or npm.

NOW · ENGINE · MIT

Rust engine 2.0.2

The protocol-independent library beneath Core: 39 bounded operations across 24 repository surfaces, with no MCP server hidden in the engine. Source · crates.io.

NOW · WRITE LAYER · MIT

Refactor 0.1.5

Eleven evidence-backed refactoring tools: nine plan producers plus write-gated atomic apply and durable rollback. Source · npm.

NOW · NETWORK LAYER · MIT

Online 0.3.1

Composes 52 tools and owns every outbound capability, including advisory refresh, malware review and preview-confirmed source-free sync. Source · npm.

NEXT

CI blast radius

change_impact as a PR comment: what a change can break, and which of it is untested.