Every codebase is a map. Subway maps your codebase as an interactive, navigable graph — like a subway map for your code.
SaferSkills independently audited subway (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Every codebase is a map.
Subway maps your codebase as an interactive, navigable graph — like a subway map for your code. It analyzes your project's structure, traces navigation paths, calculates synaptic weights (influence, dependency, churn, centrality), and produces a single subway.json that powers a visual browser and MCP tools for AI agents to create a Subway map in HTML.
# Install globally
npm install -g @municode/subway
# Analyze a TypeScript/JavaScript project
cd your-project
subway init
# Generate the interactive visual map
subway serveOr use without installing:
npx @municode/subway init
npx @municode/subway serveOnce installed, Subway can be used as a skill for LLMs, giving AI agents the ability to generate, serve, and explore codebase maps using Subway's MCP tools.
subway.zip from this repository# Create the skills directory if it doesn't exist
mkdir -p ~/.claude/skills
# Extract the skill
unzip subway.zip -d ~/.claude/skills/ls ~/.claude/skills/subway/
# Should show: SKILL.md references/The skill package contains:
subway.json v3.0 schema specificationOnce installed, the Claude/Gemini/Codex/Pi agent can:
The skill instructs the agent to use Subway's MCP server (@municode/subway) which must be installed separately:
npm install -g @municode/subwayOr configure as an MCP server in your Claude/Gemini/Codex/Pi config (see MCP Server section above).
subway serve)| Command | Description |
|---|---|
subway init | Analyze project and generate subway.json |
subway serve | Open interactive visual map in browser |
subway search <query> | Synaptic search from the terminal |
subway station <id> | View full station details |
subway impact <id> | See what depends on a station |
subway init --embed | Generate semantic embeddings (Ollama or OpenAI) |
subway init --narrate | Use LLM to generate descriptions and user flows |
Subway includes an MCP server with 9 tools for AI agents (Claude Desktop, Cursor, Copilot):
| Tool | Purpose |
|---|---|
subway_search | Synaptic search with spreading activation |
subway_station | Full details for any station |
subway_path | Find path between two stations with conditions |
subway_impact | Direct + indirect impact analysis |
subway_conditions | Conditions needed to reach a station |
subway_onboard | Guided onboarding path by role |
subway_line | Full end-to-end flow description |
subway_busrisk | Single-author stations (bus factor risk) |
subway_ask | Natural language questions about the codebase |
Configure in Claude Desktop/Antigravity/Other:
{
"mcpServers": {
"subway": {
"command": "npx",
"args": ["@municode/subway", "subway-mcp", "--file", "/path/to/subway.json"]
}
}
}Or in Cursor (.cursor/mcp.json):
{
"mcpServers": {
"subway": {
"command": "subway-mcp",
"args": ["--file", "/path/to/subway.json"]
}
}
}⚠️ "I installed it but the tools aren't showing up" — This is the most common pitfall with MCP. Installing the npm package (npm install -g) only puts thesubway-mcpbinary on your disk. MCP tools are not automatically available to your AI client — you must also register the server in your client's MCP config. Think of it like installing a program but never creating the desktop shortcut. The wiring is:
>
npm install → binary exists on disk → config entry tells the client where it is → client spawns the server process → tools appear.>
If the config step is missing, the tools simply won't show up, even thoughsubway-mcpworks fine from the terminal. The CLI path (subway init/subway serve) is always available as a fallback.
Subway enriches every station (group of files/module) with four dynamic metrics (synaptic weights) ranging from 0 to 1 (or 0% to 100%) to evaluate code quality, structure, and risk:
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.