Syke — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Syke (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
AI code impact analysis MCP server. SYKE monitors every file your AI touches, maps dependency graphs, detects cascading breakage, and gates builds before damage spreads.
Works with Claude Code, Cursor, Windsurf, and any MCP-compatible AI coding agent.



gate_build to check if all changes are safe.FAIL verdict.SYKE is a safety net, not a gatekeeper. It doesn't block your AI while working — it catches what your AI missed before you ship.
Create ~/.syke/config.json:
{
"licenseKey": "SYKE-XXXX-XXXX-XXXX-XXXX",
"geminiKey": "your-gemini-api-key"
}Get your license key at syke.cloud/dashboard. You only need ONE AI key. Supported:geminiKey,openaiKey,anthropicKey.
Claude Code:
claude mcp add syke -- npx @syke1/mcp-server@latestCursor (.cursor/mcp.json):
{
"mcpServers": {
"syke": {
"command": "npx",
"args": ["@syke1/mcp-server@latest"]
}
}
}Windsurf (~/.codeium/windsurf/mcp_config.json):
{
"mcpServers": {
"syke": {
"command": "npx",
"args": ["@syke1/mcp-server@latest"]
}
}
}Windows note: Ifnpxis not found, use the full path:"command": "C:\\Program Files\\nodejs\\npx.cmd"
Add this line to your project's CLAUDE.md (or equivalent AI instruction file):
After completing code changes, always run the gate_build MCP tool before committing or deploying.This ensures your AI agent automatically runs SYKE's safety check after every task — no manual prompting needed.
SYKE auto-detects your project language and builds the dependency graph on startup. Open http://localhost:3333 to see your live dashboard.
| Tool | Tier | Description |
|---|---|---|
gate_build | Free | Mandatory pre-build check. Returns PASS/WARN/FAIL verdict before any build or deploy. |
check_safe | Free | Quick one-line safety verdict: HIGH/MEDIUM/LOW/NONE risk. |
get_dependencies | Free | Lists internal imports (forward dependencies) of a file. |
analyze_impact | Pro | Full impact analysis with SCC, risk scoring, and git coupling. |
get_hub_files | Pro | Ranks files by PageRank importance score. |
refresh_graph | Pro | Re-scans all source files and rebuilds the dependency graph. |
ai_analyze | Pro | AI semantic analysis (Gemini/OpenAI/Claude) of a file and its dependents. |
check_warnings | Pro | Real-time monitoring alerts for file changes that may break dependents. |
SYKE supports three AI providers for semantic analysis. Bring your own key:
| Provider | Model | Config Key | Env Variable |
|---|---|---|---|
| Google Gemini | gemini-2.5-flash | geminiKey | GEMINI_KEY |
| OpenAI | gpt-4o-mini | openaiKey | OPENAI_KEY |
| Anthropic | claude-sonnet-4-20250514 | anthropicKey | ANTHROPIC_KEY |
Auto-selection: SYKE uses the first available key (Gemini > OpenAI > Anthropic). Force provider: Set aiProvider in config (or SYKE_AI_PROVIDER env var) to override.
SYKE goes beyond simple dependency counting. Five production-grade algorithms work together to deliver precise, fast, and context-rich impact analysis — all running locally with zero AI token cost.
#### 1. SCC Condensation + Topological Sort
Circular dependencies are the #1 source of misleading impact analysis. SYKE uses Tarjan's algorithm to detect all Strongly Connected Components, condenses them into a clean DAG, then runs topological sort to compute correct cascade levels.
Before: "47 files affected" (inflated by cycles)
After: "3 files in circular cluster (Level 0) → 5 files (Level 1) → 4 files (Level 2)"#### 2. Composite Risk Scoring
Five signals combined into a single 0–1 risk score:
| Signal | Weight | What it measures |
|---|---|---|
| Fan-in | 30% | How many files depend on this one |
| Stability Index | 20% | I = Ce/(Ca+Ce) — lower = foundation file = riskier to change |
| Cyclomatic Complexity | 20% | Internal branching complexity (regex-based, 8 languages) |
| Cascade Depth | 15% | How many layers deep the impact propagates |
| PageRank | 15% | Recursive importance in the dependency graph |
auth_service.ts → Risk: 0.82 (CRITICAL)
Fan-in: 24, Stability: 0.12, Complexity: 47, Cascade: 4 levels, PageRank: 99th
string_utils.ts → Risk: 0.31 (LOW)
Fan-in: 18, Stability: 0.85, Complexity: 3, Cascade: 1 level, PageRank: 42ndAI agents can now make threshold decisions: proceed if < 0.3, warn if 0.3–0.7, block if > 0.7.
#### 3. Historical Change Coupling
Static imports miss hidden dependencies — files that always change together but have no import relationship. SYKE mines your git history (last 500 commits) to find these logical couplings.
auth_service.ts changed →
[Dependency Graph] auth_provider.ts, login_screen.ts
[Git Coupling — Hidden Dependencies]
config/auth_config.json (85% confidence, 12 co-changes)
styles/auth.css (72% confidence, 8 co-changes)#### 4. PageRank for File Importance
Simple fan-in counts treat all dependents equally. PageRank computes recursive importance — a file imported by many important files ranks higher than one imported by many leaf files.
Before: utils.ts ranked #1 (25 dependents — but all are leaf components)
After: auth.ts ranked #1 (20 dependents — 15 of which are core modules)#### 5. Incremental Graph Updates + Memoized Queries
For large codebases (10K+ files), full graph rebuilds are too slow. SYKE now updates only the changed file's edges and invalidates only the affected cache entries.
Before: 1 file changed → re-parse all 500 files → 2+ seconds
After: 1 file changed → re-parse 1 file → edge diff → 50ms
Same file queried again → cache hit → O(1) instantAuto-detected, zero-config: Dart/Flutter, TypeScript/JavaScript, Python, Go, Rust, Java, C++, Ruby.
Live dependency graph visualization at localhost:3333 with:
SYKE reads from ~/.syke/config.json (primary) with environment variable overrides:
| Config Key | Env Variable | Description | Required |
|---|---|---|---|
licenseKey | SYKE_LICENSE_KEY | Pro license key from dashboard | No (Free tier works without) |
geminiKey | GEMINI_KEY | Google Gemini API key for ai_analyze | No (any one AI key) |
openaiKey | OPENAI_KEY | OpenAI API key for ai_analyze | No (any one AI key) |
anthropicKey | ANTHROPIC_KEY | Anthropic API key for ai_analyze | No (any one AI key) |
aiProvider | SYKE_AI_PROVIDER | Force AI provider: gemini, openai, or anthropic | No (auto-selects) |
port | SYKE_WEB_PORT | Dashboard port (default: 3333) | No |
Full config example (~/.syke/config.json):
{
"licenseKey": "SYKE-XXXX-XXXX-XXXX-XXXX",
"geminiKey": "AIza...",
"openaiKey": "",
"anthropicKey": "",
"port": 3333
}You (developer) AI Agent SYKE
| | |
|-- "Add feature X" -->| |
| |-- modifies files |
| |-- modifies files |
| |-- modifies files |
| | |
| |-- gate_build --->|
| | |-- scans graph
| | |-- checks impact
| |<-- PASS/FAIL ----|
| | |
|<-- "Done. Safe to | |
| build." ----------| |We're giving the first 100 developers full Pro access for 30 days — no credit card, no strings.
What you get:
How to claim:
Spots are limited. Once they're gone, they're gone.
gate_build, check_safe, get_dependencies).Pro and Cortex features (advanced algorithms, AI analysis, real-time monitoring, web dashboard) are included in the npm package as compiled code.You can use, modify, and distribute SYKE freely, with two limitations:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.