code-knowledge-graph — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited code-knowledge-graph (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Codebase'i knowledge graph olarak modeller. Dosya, modul, fonksiyon ve class'lar node; import, call, inheritance ve composition iliskileri edge olur. Sonuc: Mermaid diagram + JSON graph data.
Kod text degil, graph'tir. Her dosya diger dosyalara baglidir. Bu baglantilari anlamadan:
Knowledge graph tum bu iliskileri gorsellestirir ve olculebilir yapar.
/code-knowledge-graph [hedef-dizin] [--focus module] [--depth N] [--format mermaid|json|both]# Tum codebase analizi
/code-knowledge-graph src/
# Belirli module odaklan
/code-knowledge-graph src/ --focus auth
# Sadece circular dependency kontrolu
/code-knowledge-graph src/ --focus circular
# Hotspot analizi
/code-knowledge-graph src/ --focus hotspots
# Orphan/dead code tespiti
/code-knowledge-graph src/ --focus orphans# Dosya agaci
tldr tree ${PATH:-src/} --ext .py
# Kod yapisi: fonksiyonlar, class'lar, export'lar
tldr structure ${PATH:-src/} --lang pythonHer dosya, class, fonksiyon ve export bir node olur.
# Dosyanin import'lari (outgoing edges)
tldr imports ${FILE}
# Modulu kim import ediyor? (incoming edges)
tldr importers ${MODULE} ${PATH:-src/}
# Cross-file call graph
tldr calls ${PATH:-src/}Her import ve fonksiyon cagrisi bir directed edge olur.
# Architectural layer analizi
tldr arch ${PATH:-src/}Node'lar 3 katmana ayrilir:
| Katman | Tanim | Ornekler |
|---|---|---|
| Entry | Disaridan cagirilan, ici cagirmayan | routes, cli, main, handlers |
| Middle | Hem cagrilan hem cagirir | services, business logic |
| Leaf | Cagirilan ama baskasini cagirmayan | utils, helpers, constants |
# Bu fonksiyona kim bagimli?
tldr impact ${FUNCTION} ${PATH:-src/} --depth 3
# Dead code: hicbir yerden cagrilmayan fonksiyonlar
tldr dead ${PATH:-src/}codebase-memory MCP kuruluysa, persistent graph sorgusu yap:
mcp: index_status -> Repo index durumu
mcp: index_repository -> Repo'yu indexle (yoksa)
mcp: query_graph -> Graph sorgusu (iliskiler)
mcp: search_graph -> Pattern arama
mcp: get_architecture -> Mimari genel bakis
mcp: trace_call_path -> Fonksiyonlar arasi cagri yoluMCP, session'lar arasi kalici graph verisi saglar. tldr ise anlik taze analiz verir. Ikisini birlikte kullan.
A dogrudan B'yi import ediyor:
A --import--> BA, B'yi import ediyor, B de C'yi import ediyor. A, C'ye transitif bagimli:
A --import--> B --import--> C
A ....transitif....> CTransitive dependency chain'i uzadikca risk artar. tldr impact ile transitif zincirleri gor.
| Metrik | Yuksek Degerin Anlami | Risk |
|---|---|---|
| Fan-In (in-degree) | Cok modul buna bagimli | Fragile - degisiklik cascade yapar |
| Fan-Out (out-degree) | Bu modul cok seye bagimli | Unstable - disaridan kirilabilir |
Hedef: Leaf node'larda yuksek fan-in (iyi - utility), entry node'larda yuksek fan-out (kotu - god module).
Circular dependency = A imports B, B imports A (dogrudan veya transitif).
ONCE: A <--> B (circular)
SONRA: A --> IB <-- B (interface ile decouple)Her iki modul de bir interface'e bagimli olur, birbirine degil.
ONCE: A --> B --> A (circular)
SONRA: A --> B, A <-- C (C yeni modul, B'nin A'ya ihtiyac duydugu kismi tasir)ONCE: A <--> B (ortak kod paylasiyor)
SONRA: A --> Shared <-- B (ortak kod ayri module)ONCE: A --> B --> A (geri cagri)
SONRA: A --> EventBus <-- B (event ile haberlesme)| Durum | Strateji |
|---|---|
| Type/interface paylasimi | Extract Interface |
| Fonksiyon geri cagrisi | Dependency Inversion |
| Ortak utility kodu | Extract Shared Module |
| Async bildirim ihtiyaci | Event-Based Decoupling |
Hotspot = Graph'ta en cok baglantisi olan node.
hotspot_score = (in_degree * 2) + out_degree + (change_frequency * 3)in_degree * 2: Bagimli modul sayisi (en onemli - cascade risk)out_degree: Bagimlilik sayisi (kirilganlik)change_frequency * 3: Git log'dan degisiklik sikligi (degisen hotspot = en tehlikeli)| Hotspot Tipi | Oncelik | Aksiyon |
|---|---|---|
| Yuksek in-degree + sik degisen | P0 CRITICAL | Hemen split et, test ekle |
| Yuksek in-degree + stabil | P2 MEDIUM | Test ekle, dikkatli degistir |
| Yuksek out-degree | P1 HIGH | Dependency'leri azalt, facade pattern |
| Yuksek her ikisi | P0 CRITICAL | God module - parcala |
# Git log'dan en cok degisen dosyalar
git log --format=format: --name-only --since="6 months ago" | sort | uniq -c | sort -rn | head -20Cok degisen + cok baglantili = en yuksek risk.
graph TD
subgraph Entry["Entry Layer (Red)"]
routes[routes.py]
cli[cli.py]
end
subgraph Middle["Middle Layer (Orange)"]
auth[auth_service.py]
user[user_service.py]
end
subgraph Leaf["Leaf Layer (Green)"]
utils[utils.py]
validators[validators.py]
end
routes --> auth
routes --> user
cli --> user
auth --> utils
auth --> validators
user --> utils
style routes fill:#e74c3c,color:#fff
style cli fill:#e74c3c,color:#fff
style auth fill:#f39c12,color:#fff
style user fill:#f39c12,color:#fff
style utils fill:#27ae60,color:#fff
style validators fill:#27ae60,color:#fffgraph LR
handle_request --> validate
handle_request --> authorize
authorize --> check_token
authorize --> check_role
validate --> sanitize
check_token --> decode_jwtgraph LR
A[module_a] -->|imports| B[module_b]
B -->|imports| C[module_c]
C -->|imports| A
style A fill:#e74c3c,color:#fff
style B fill:#e74c3c,color:#fff
style C fill:#e74c3c,color:#fff
linkStyle 0 stroke:#e74c3c,stroke-width:3px
linkStyle 1 stroke:#e74c3c,stroke-width:3px
linkStyle 2 stroke:#e74c3c,stroke-width:3pxgraph TD
A[utils.py<br/>in:12 out:1<br/>HOTSPOT]
B[service.py<br/>in:3 out:8]
C[routes.py<br/>in:0 out:5]
D[models.py<br/>in:6 out:2]
C --> B
C --> A
B --> A
B --> D
D --> A
style A fill:#e74c3c,stroke:#c0392b,stroke-width:4px,color:#fff
style D fill:#f39c12,stroke:#e67e22,stroke-width:2px,color:#fffKnowledge graph review'da su sorulari cevaplar:
tldr impact changed_function src/ --depth 3 tldr impact function_name src/Yeni developer'a codebase'i tanitmak icin:
Graph verisi mimari kararlari destekler:
| Karar | Graph Verisi |
|---|---|
| "Bu modulu bolmeli miyiz?" | In-degree + out-degree + LOC |
| "Microservice siniri nerede?" | Cluster analizi (yuksek ic baglantilar, dusuk dis baglantilar) |
| "Hangi modulu once refactor edelim?" | Hotspot score siralamasina bak |
| "Yeni feature nereye oturur?" | Mevcut layer'a ve dependency pattern'ine bak |
| "Bu dependency guvenli mi?" | Transitif dependency chain'ine bak |
| Komut | Kullanim | Cikti |
|---|---|---|
tldr tree [path] | Dosya agaci | JSON |
tldr structure [path] --lang X | Kod yapisi (codemaps) | JSON |
tldr calls [path] | Cross-file call graph | JSON |
tldr impact <func> [path] | Reverse call graph | JSON |
tldr dead [path] | Dead/orphan code | JSON |
tldr arch [path] | Layer detection | JSON |
tldr imports <file> | Dosyanin import'lari | JSON |
tldr importers <module> [path] | Modulu kim import ediyor | JSON |
{
"metadata": {
"project": "project-name",
"analyzed_at": "2026-03-26T10:00:00Z",
"total_nodes": 45,
"total_edges": 128,
"languages": ["python"]
},
"nodes": [
{
"id": "src/auth/service.py::AuthService",
"type": "class",
"file": "src/auth/service.py",
"layer": "middle",
"in_degree": 5,
"out_degree": 3,
"is_hotspot": true,
"is_orphan": false
}
],
"edges": [
{
"source": "src/routes.py::handle_login",
"target": "src/auth/service.py::AuthService.authenticate",
"type": "call"
}
],
"layers": {
"entry": [],
"middle": [],
"leaf": []
},
"circular_dependencies": [],
"hotspots": [],
"orphans": []
}| Arac | Ne Zaman |
|---|---|
graph-analyst agent | Tam graph analizi, otomatik rapor |
tldr arch | Hizli layer detection |
tldr calls | Hizli call graph |
codebase-memory MCP | Persistent graph, session arasi sorgulama |
/explore architecture | Genel mimari kesfetme |
architect agent | Graph verisiyle mimari karar |
janitor agent | Orphan/dead code temizligi |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.