code-graph

LLM tools and MCP primitives (#66): tools offered to a model (OpenAI / Anthropic schema literals, LangChain @tool / StructuredTool / BaseTool, Agents SDK @function_tool, LlamaIndex FunctionTool, dict registries and if / match branches of agent loops) and MCP server tools / resources / prompts (FastMCP / MCPServer, low-level call_tool) with their handler, the tables the handler reaches, the agents offering them and the code calling them (MCP client call_tool / read_resource / get_prompt). Checks: no_receiver, no_sender, name_collision; plus agents (model, tools, handoffs), dynamic_dispatch (an …

Use to inspect a symbol without reading its file. Details of one node: kind, FQN, file:line span, module, entry kinds, docblock (PHPDoc), and edge counts by kind (in/out) with a few neighbours. Specs: Class::method | file#name | table.column | table:<t> | route:<METHOD> <uri> | env:<KEY> | page:/path (more: resource cg://guide).

Use to answer "how does A reach B". Shortest forward evidence chain from source to target (e.g. page:/reports/:id -> SalesReportService::report), one hop per line with file:line and confidence. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #if, Platform.OS / Platform.isX, kIsWeb, .ios.ts / .android.ts files, Dart conditional imports) is left out; the reply's first line names the filter and how many conditions could not be evaluated (those stay in).

Fingerprint (sha1 of source lines) every modified target of a plan before implementing it, so plan_check(verify=true) can report changed/UNCHANGED. Writes plans/<name>.baseline.json (only file it writes).

Deterministic check of a plan against the real graph. Default reply: a compact summary (counts per section and per check, the top `max_items` missing items, failed requirements, middleware gaps, forbidden paths, open findings, verify counts); details=true gives the full report (every item with file:line evidence and call chains, up to max_items per list). plan mode: 1 RESOLVE (references, route middleware requirements, middleware differences between entry routes of the same modified code), 2 MISSING FROM PLAN (writers/readers of changed tables, Filament/API resources, $fillable, form requests,…

List planned-change files (plans/*.yaml): name, status, title, counts, schema errors.

Show one plan (name or path): planned nodes (+), modified targets with intent (~), planned edges, forbidden paths (x), requirements (!), covers/out_of_scope, precedents, linked issues, schema errors.

Schema check + does every referenced existing node resolve in the graph (unresolved / ambiguous specs with candidates); planned nodes that already exist are flagged.

Where per-platform implementations diverge: VARIANTS (a symbol implemented per platform, by platform files, conditional imports or #[cfg] / #if alternatives, with the declared targets no variant covers), API SURFACE (a variant lacks a public symbol its siblings define) and REFERENCED WHERE THE CALLEE IS NOT BUILT (a call or import that is live on a target where the callee does not exist: a build or runtime failure there). Each finding has file:line evidence. DEAD BRANCHES: code under nested conditions no target meets together (`#elseif os(macOS)` inside `#if os(iOS)`); its references are left …

Platform-specific code in this graph: the targets (declared in .cg.yaml platforms.targets, or detected from Flutter platform folders, Expo app.json, React Native, Electron / Tauri, or the conditions themselves), how many conditions (#[cfg], cfg!, #if, Platform.OS / Platform.select, Platform.isX / kIsWeb, .ios.ts / .android.ts / .native.ts files, Dart conditional imports) were found and evaluated, and files / symbols per target. Pass `platform` to reaches / impact / downstream / path / routes / search to see one target's build.

Every protocol endpoint in one view (#31 model): HTTP client endpoints and routes (http / ws / graphql), Pusher broadcast channels and subscriptions, NestJS microservice messages (nest-rpc / nest-event / nest-ws / grpc), job queues (bull, laravel-queue, celery), application events (laravel-event, nest-event-emitter, django-signal), web / native bridges and desktop IPC (capacitor, react-native, flutter, electron-ipc, tauri ...) and the generic endpoint:<protocol>:<name> nodes (code -SENDS_TO-> endpoint -RECEIVED_BY-> handler, MATCHES_ENDPOINT for wildcard / template matches; MQTT, NATS, AMQP, K…

Use before changing a column, table, connection, env key or symbol: everything that depends on it. Reverse transitive dependents of one or more targets (union), e.g. ["orders.customer_id", "connection:warehouse", "connection:tenant_*"]. Groups: RUNTIME (live; reached from http routes/schedules/jobs/listeners, or main()/exported FFI symbols in Rust/C/C++), LIBRARY (only via a library's public API), DEV (only tests/benches/examples/build scripts), OPERATOR (artisan commands / admin panels only: one-off import & provisioning), GATED (dead under the indexed gate scenario, e.g. code that only runs…

Who reads a DB table, a column or a stored property. `prop` is `table`, `table:X`, `table.column` / `column:table.column` (READS_TABLE / READS_COLUMN edges, grouped by column; heuristic string-literal MENTIONS_COLUMN matches come last and are labelled) or `Type.prop` / `Class::$prop` (READS_PROP edges: Swift, Kotlin, Python, TypeScript, PHP). Each site with the entry-point kinds that reach it; test code's property reads come last. An unknown spec lists what was tried, the table's columns and close matches. A site on a database connection other than the default shows `conn=<name>`; `connection`…

Every place a concept (e.g. 'timezone', 'locale') is resolved, deterministically: assignment/return sites whose value is a `??`/`?:` chain or an ordered sequence of early returns, expanded into a fallback chain of request input keys (FormRequest rules / $request->input / $filters['x'] through helper calls), settings (getSetting(key, default)), model columns, config/env and literal defaults. Sites are grouped into lettered chains by signature; the divergence section shows pairwise where chains first differ; each chain lists the routes that reach it. On a combined graph, also the frontend side: …

Heuristic (#88): does a stored property `Type.prop` round-trip through a lossy transform? Each write site with the lossy call it passes through (clamp, min/max, round, truncating casts, `fit*`, `.cg.yaml` `lossy:` names, `@cg-lossy` functions; within the function plus one hop through direct callers), each read site that seeds UI state (init, onAppear, remember, useState(initial), mounted), and un-narrowed ranges drawn next to such a read. Findings are heuristic evidence with file:line, not proof. An empty `prop` (or `*`) checks every stored property in one pass and lists only the round trips.

Use for route, auth and middleware questions. Routes with their middleware / guards / auth, in one call. Optional scope: writes="*" (routes that reach any DB write) or writes="<table>", reaches=[specs] (routes that reach any of these nodes: table, column, connection, method, env key...). Optional filters: missing="<name>" keeps routes with no guard whose name contains it (e.g. "auth:api", "ApiKeyGuard"), unguarded=true keeps routes with no auth guard (the framework presets' auth guards and the auth name pattern; extend with auth_pattern, a regex, or .cg.yaml auth.extra_patterns). An unconditio…

Use first to find a symbol instead of grep. Finds nodes by name / FQN substring (case-insensitive), optionally filtered by kind (class, method, route, command, table, column, connection, config, env, job, admin...). Also matches route middleware, guards, auth and access checks (e.g. "auth" finds `auth:api`, `ApiKeyGuard`, `IsAuthenticated`) and lists the routes that carry them. Platform-specific symbols carry their targets, e.g. `[ios, android]`. platform: only code built for that target (windows, linux, macos, ios, android, web): code under a platform condition that is false there (#[cfg], #i…

Code parallel to a symbol that often needs the same change: classes sharing its parent/interface/trait, the same method in sibling classes, other code touching the same tables/columns/config/connections, and co-callers (methods calling the same helpers; Jaccard on callees).

Use instead of opening a whole file. Source of one symbol: a `path:start-end` header then the body with line numbers. Resolves a node id or a symbol / FQN (as node() and search() do); an ambiguous name lists the candidates instead of guessing. context adds lines around the span; max_lines caps the body (truncation noted).

Starter queries derived from this graph, each with the tool call to run: the write route without an auth guard that writes the most tables, the most-written / most-read table, the most-used DB connection and env key, the page with the largest backend reach, the most-called functions. A good first call on an unfamiliar repository.

Index metadata and node/edge counts by kind.

Tests that exercise a symbol, route or table. DIRECT: the test code itself calls / instantiates it or sends an HTTP request to the route ($this->getJson('/x'), Playwright request.get). TRANSITIVE: through application code (test -> route -> controller -> service -> target). target: Class::method | Class | route:VERB /uri | `VERB /path` or /path (matched against route URIs) | table.column | any node id. Tests are PHPUnit / Pest (tests/), Vitest / Jest / Playwright / Cypress spec files; they never count as callers in the other queries. A base / interface method also lists the tests of its overrid…

Who writes a DB table, a column or a stored property. `table` is `table`, `table:X`, `table.column` / `column:table.column` (WRITES_TABLE / WRITES_COLUMN edges; for a column, the writers of that column, then a separate "table-level writes (columns not recorded)" group) or `Type.prop` / `Class::$prop` (WRITES_PROP edges: Swift, Kotlin, Python, TypeScript, PHP). Grouped by module, with the columns written, evidence lines and the entry-point kinds that reach each writer. A writer on a database connection other than the default shows `conn=<name>`; `connection` keeps only the writers on that conne…