Faultlines — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Faultlines (Agent Skill) and scored it 45/100 (orange). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 13 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 13 flagged
A base64 string of 128+ characters appears in a documentation file. Encoded prompt injection hides the hostile instruction in base64 — invisible to keyword filters — and relies on the agent's ability to decode it at runtime. There is no normal authoring reason to embed a multi-hundred-byte base64 blob in skill docs.
*.sig, SIGNATURES) outside the documentation.Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<div align="center">
<a href="https://dynvo.ai"> <picture> <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/PashaSchool/dynvo/main/assets/dynvo-logo-dark.png"> <img src="https://raw.githubusercontent.com/PashaSchool/dynvo/main/assets/dynvo-logo-light.png" alt="Dynvo — Codebase intelligence for teams and AI agents" width="420"> </picture> </a>
<br>
Dynvo turns raw git history into a living map of every _feature_ and _user flow_ in your repo — with bug hotspots, test coverage, and the precise context your AI coding agent actually needs.
No Jira. No annotations. No manual tagging. Just git log and your code.
Website · Quick start · For AI agents · How it works · Releases
</div>
Every engineer rediscovers the same thing on a new codebase:
"Which files actually implement checkout?" "What breaks if I change this?" "Who owns the billing flow?" "Where are the bugs hiding?"
Your issue tracker doesn't know — it's full of aspirational tickets. Static analysis sees imports, not intent. And your AI agent just greps 15 files and burns your context window guessing.
The answers were in your git history the whole time. Dynvo reads them.
$ dynvo ./my-app
✓ 472 commits analysed · 1,284 files mapped
FEATURE HEALTH COVERAGE HOTSPOTS FLOWS
─────────────────────────────────────────────────────────
Billing & Subscriptions 62 48% 3 7
Authentication 88 91% 0 4
Document E-Sign 41 ⚠ 22% 5 9
Team & Permissions 79 66% 1 5
…
→ Highest blast radius: src/payments/charge.ts (touches 4 features)
→ Riskiest flow: e-sign/finalize (low coverage · 5 recent bug-fixes)A two-layer feature map:
…each broken into flows (real user journeys), scored, attributed down to the function and line range, and served to humans and AI agents.
lcov.pip install dynvo
# Scan a repo. Bare `dynvo <repo>` runs the scan pipeline —
# flows and symbol-level attribution are included by default.
dynvo /path/to/your/repoDynvo is deterministic-first: the feature/flow structure comes from your code and git history with no LLM required. Set an ANTHROPIC_API_KEY and a Haiku pass automatically adds human-readable names and flow detection — no flag needed. Pick the model with --model haiku|sonnet|opus (default: haiku):
export ANTHROPIC_API_KEY=sk-ant-...
dynvo /path/to/your/repo --model sonnetscan-v2is the explicit name of the same pipeline (dynvo scan-v2 <repo>); the bare form is just shorthand for it.
That writes a versioned feature-map JSON to ~/.faultline/. Explore it, diff it across runs, ship it to CI, or hand it to your AI agent (below).
This is the wedge. Install the companion MCP server and your agent stops guessing:
# one-off, no install (recommended)
uvx faultlines-mcp
# or install it
pip install faultlines-mcp// ~/.cursor/mcp.json (or: claude mcp add dynvo -- faultlines-mcp)
{
"mcpServers": {
"dynvo": { "command": "faultlines-mcp" }
}
}Now Cursor / Claude Code / Cline / Windsurf can call 13 tools:
| Tools | |
|---|---|
| Discover | list_features · find_feature · get_repo_summary |
| Files & symbols | get_feature_files · get_flow_files · find_symbols_in_flow · find_symbols_for_feature |
| Risk & impact | get_hotspots · get_feature_owners · analyze_change_impact · get_regression_risk |
| Runtime | get_feature_errors (Sentry) · get_feature_pageviews (PostHog) |
Typical result: ~90% fewer tokens per query than a naive grep-and-read loop — your agent reads the right functions, with line ranges, on the first try.
| Metric | What it tells you | Why you care |
|---|---|---|
| Health score | Composite of churn, bug-fixes, coverage & ownership | One number to triage what to refactor next |
| Bug-fix ratio | Share of commits that fix bugs | High = fragile, defect-prone code |
| Churn | How often a feature changes | Hotspot detection; instability signal |
| Impact score | Structural blast radius − coverage | What a change here actually endangers |
| Coverage | Behavioral test coverage per flow | Find untested user journeys, not just untested lines |
| Ownership / bus factor | Who holds the knowledge | Spot single-points-of-failure before they leave |
git history ─┐
├─▶ deterministic extractors ─┐
code/config ─┘ (routes · MVC · schema · │
package · stack patterns) ├─▶ feature & flow map
│ + metrics + symbols
Haiku pass · naming + flows (key set) ─┘ │
▼
feature-map JSON ──▶ CLI · CI · dashboard · MCPDeterministic-first. The structure comes from your routing conventions, configs, schemas and git co-change patterns — no LLM required. When ANTHROPIC_API_KEY is set, an Anthropic (Haiku by default, --model sonnet|opus) pass adds human-readable names and flow detection automatically. The output is a single versioned JSON — the stable contract every consumer reads.
Dynvo is the only layer that joins structure + git history + runtime into one map — and serves it to your AI agent.
Issues, ideas and PRs are welcome. Dynvo is built to map any codebase — if it mis-reads your stack, that's a bug we want to hear about.
MIT — see LICENSE.
<div align="center">
[Star this repo](https://github.com/PashaSchool/dynvo) if Dynvo helps you (or your agent) understand a codebase faster.
Made for engineers and the AI agents that work alongside them · dynvo.ai
</div>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.