architecture-knowledge-graph — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited architecture-knowledge-graph (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill teaches you how to turn a codebase into a clean, durable knowledge graph using the kg_* MCP tools. The graph (default .claude/architecture.md) is the single source of truth; diagrams are rendered views of it.
Graph quality depends almost entirely on how well you read the code. The MCP preserves, validates, and renders whatever you put in — it does not analyze the codebase. That analysis is your job.
Model services/components and how they communicate, not classes, functions, or every import. A "service" is a deployable unit / bounded context — one repo, one container, one logical responsibility.
kg_import to bootstrap from an existing .excalidraw).kg_add_service, setting component_type, domain, and owner while the info is in front of you (Dockerfiles, CODEOWNERS, READMEs, manifests).
kg_link.Linking before a target exists fails; that's why discovery comes first.
failure. Fix them before rendering.
kg_render_view / kg_render_around /kg_render_domain** for focused diagrams.
Look for these signals and translate each into a labelled kg_link:
| Signal in code | Link | Label / style |
|---|---|---|
| HTTP client, base URL, OpenAPI/Swagger spec | sync call | "REST /orders", style: solid |
| gRPC stub / proto service | sync call | "gRPC GetOrder", style: solid |
| Kafka/SQS/RabbitMQ producer | async event | "Kafka order.created", style: dashed |
| Kafka/SQS/RabbitMQ consumer | async event (incoming) | label with the same topic |
| DB connection string / ORM config | datastore | "reads/writes", style: solid |
Service-discovery / env var (PAYMENTS_URL) | dependency | name the protocol |
To connect services across repos, match a producer in repo A to a consumer in repo B using the shared join key:
order.created, B subscribesorder.created → kg_link order-svc -> fulfilment-svc "Kafka order.created" style=dashed).
https://payments/charge→ link A → payments).
Do a producer/consumer inventory across all repos before linking, so you don't miss an edge whose two ends live in different codebases.
order-service — neverOrderService one session and orders the next. Id drift silently corrupts a cumulative graph.
solid = sync (REST/gRPC/DB), dashed =async (events/queues). Consistency makes diagrams instantly readable.
render one domain at a time.
The full graph may be large, but any single rendered view should stay readable (~6–15 services). If a domain has 20 services, render it per sub-domain with kg_render_domain / kg_render_view rather than one giant picture. Resist decomposing a service into its internal classes — that's a different diagram.
A dependency is keyed on (from_id, to_id), so a second kg_link between the same pair replaces the first. If A talks to B two ways (REST and Kafka), combine them into one label — "REST /orders · Kafka order.created" — or link the primary transport. Don't issue two kg_link calls expecting two arrows.
Unlike diagrams, the graph is deterministically checkable. After building, run whats_connected_to <service> and kg_lint to sanity-check the topology matches your understanding of the system before sharing rendered views.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.