Reveal the skeleton of your codebase — turn any folder of code, docs, and assets into a blazing-fast queryable knowledge graph. Built in Rust.
SaferSkills independently audited codeskeleton (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Reveal the skeleton of your codebase — turn any folder of code into a queryable knowledge graph. Single binary, zero runtime dependencies, blazing fast.
codeskeleton .codeskeleton-out/
├── graph.html interactive graph — click nodes, search, filter by community
├── GRAPH_REPORT.md god nodes, surprising connections, suggested questions
├── graph.json persistent graph — query later without re-reading
└── cache/ SHA256 cache — re-runs only process changed filesRequires: Rust 1.70+
cargo install codeskeletonOr build from source:
git clone https://github.com/DhanushNehru/codeskeleton.git
cd codeskeleton
cargo build --release
./target/release/codeskeleton .codeskeleton . # analyze current directory
codeskeleton ./src # analyze a specific folder
codeskeleton . --no-cache # force full re-extractionAdd a .cographignore file to exclude folders:
# .cographignore
vendor/
node_modules/
dist/
*.generated.pySame syntax as .gitignore. Patterns match against file paths relative to the analyzed folder.
God nodes — highest-degree concepts (what everything connects through)
Surprising connections — cross-community edges ranked by structural distance, with plain-English explanations
Communities — automatically detected clusters of related code with cohesion scores
Suggested questions — 4-5 questions the graph is uniquely positioned to answer
Interactive visualization — dark-themed vis.js graph with search, click-to-inspect, community coloring
Incremental builds — SHA256 file caching means re-runs only process changed files
| Language | Extensions | Extraction |
|---|---|---|
| Python | .py | Classes, functions, imports, calls via tree-sitter AST |
| JavaScript | .js .jsx | Classes, functions, imports, calls via tree-sitter AST |
| TypeScript | .ts .tsx | Classes, functions, imports, calls via tree-sitter AST |
| Rust | .rs | Structs, enums, traits, functions, use declarations via tree-sitter AST |
| Go | .go | Types, functions, methods, imports via tree-sitter AST |
| Java | .java | Classes, interfaces, methods, imports via tree-sitter AST |
| C | .c .h | Structs, functions, includes via tree-sitter AST |
codeskeleton runs a deterministic AST pass using tree-sitter. No LLM needed — pure structural extraction:
.gitignore and .cographignoreEvery relationship is tagged EXTRACTED (found directly in source) or INFERRED (call-graph second pass). You always know what was found vs guessed.
detect → cache-check → extract (parallel) → build_graph → cluster → analyze → report → exportEach stage is a pure function in its own module. No shared mutable state, no side effects outside codeskeleton-out/.
| Module | Responsibility |
|---|---|
detect.rs | Directory walk, file filtering |
cache.rs | SHA256 file caching |
languages.rs | Per-language tree-sitter configs |
extract.rs | Generic AST extraction engine |
graph.rs | petgraph construction |
cluster.rs | Label propagation community detection |
analyze.rs | God nodes, surprising connections |
report.rs | GRAPH_REPORT.md generation |
export.rs | JSON + HTML visualization |
types.rs | Shared types (Node, Edge, Confidence) |
codeskeleton is written in Rust for maximum performance:
Adding a language:
Cargo.tomlSupportedLanguage in languages.rsLanguageSpec with AST node typesfrom_extension()extract.rsMIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.