settings — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited settings (Hook) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Transform any repository into an AI-aware, intelligent environment — a codebase that any AI agent can jump into on day one without making junior-level mistakes.
npx @wednesday-solutions-eng/ai-agent-skills installMost AI agents in large codebases fail in the same ways: they hallucinate structure, waste tokens re-reading files they've seen before, and make changes without knowing what will break. This system solves all three.
It works by pre-computing a structural dependency graph (SQLite, AST-based, zero LLM) of your entire codebase once, then giving every AI agent — Claude Code, Cursor, Gemini CLI, GitHub Copilot — a precise manual for how to work in your specific project. From that point on, structural questions are answered from the graph in milliseconds, not from re-reading source files.
This system integrates directly with Claude Code, Gemini, and other AI tools as an on-demand skill, feeding them structured repo context and enforcing local guardrails. Answering structural questions via our pre-computed graph saves 70–90% of LLM tokens per query.
.wednesday/)CLAUDE.md, GEMINI.md, .cursorrules, and .github/copilot-instructions.md with available skills and rules.8 before code is submitted.commit-msg: Enforces conventional commit formatting via commitlint.pre-commit: Requires a @wednesday-skills:purpose header on new files.post-commit / post-merge: Automatically maintains and syncs the dependency graph in < 1s using incremental updates.0 to 100 using import volume, public contracts, test coverage, and historical git bug history.plan)PLAN.md outlining phase breakdowns, JWT auth strategies, and threat mitigations.ws-skills search and ws-skills add to pull community-built skills. Enforces PR review fixes (@agent fix all) as atomic commits with zero friction.ws-skills stats --cost to inspect monthly cost breakdowns locally.| Without this system | With this system |
|---|---|
| Reads 20 raw files to answer "what does auth do?" — 6,000 tokens | Queries graph.db — 0 tokens |
| Guesses at dependency structure | BFS traversal on verified AST edges |
| Makes changes with no risk context | Checks blast radius before touching anything |
| Forgets conventions between sessions | Reads enforced rules from CLAUDE.md / .cursorrules on every turn |
| Produces inconsistent commit messages | Every commit enforced by commit-msg hook via commitlint |
Speed — New AI agents (and new developers) are productive on day one. MASTER.md gives full architectural context without reading a single source file.
Safety — High-risk files (risk score > 80) trigger a mandatory review pause before any AI is allowed to edit them. Blast radius is computed before the first keystroke.
Cost — Pre-computed graphs reduce LLM token spend on structural questions by 70–90%. Every map run prints a breakdown:
━━━ Token Usage Report ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Command: map
LLM calls: 18 (6 cache hits → 0 tokens)
Tokens used: 9,240 (in: 6,800 / out: 2,440)
Baseline est: 54,000 (cost of reading raw files)
▼ 44,760 tokens saved (82%)
Cost: $0.0013 (baseline: $0.1620 vs Claude Sonnet)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━Consistency — All AI tools (Claude, Gemini, Cursor, Copilot) follow the same standards because they all read from the same source. No more "Claude lets me do X but Cursor blocks it."
Clean git history — Conventional commits enforced at the hook level. Every PR follows the same shape.
Requirements: Node.js ≥ 18
# Option 1 — npx (no setup)
npx @wednesday-solutions-eng/ai-agent-skills install
# Option 2 — global
npm install -g @wednesday-solutions-eng/ai-agent-skills
wednesday-skills install
# Option 3 — shell (no npm)
bash install.shRun in your project root. The installer:
.wednesday/skills/CLAUDE.md, GEMINI.md, .cursorrules, .github/copilot-instructions.mdcommit-msg, pre-commit, post-commit, post-merge.claude/skills/ for Claude Code's skill picker.commitlintrc.json with GIT-OS conventional commit rulesNo API key needed when using skills inside Claude Code, Cursor, or Gemini CLI. The IDE is the intelligence engine — skills are standard markdown instructions.
API keys are only needed for standalone CLI commands (map, summarize, gen-tests):
wednesday-skills config # interactive setup wizardOr add to .env:
OPENROUTER_API_KEY=... # cheaper, recommended (Gemini Flash-Lite default)
ANTHROPIC_API_KEY=... # fallback
GITHUB_TOKEN=... # for dashboard PR datawednesday-skills map --fullThis runs the full pipeline: AST parse → dependency graph → module summaries → MASTER.md. On a 500-file codebase it takes ~2 minutes and costs under $0.01 using Gemini Flash-Lite.
After this, the graph auto-updates on every commit. You never run map again unless you want a full refresh.
Once mapped, your AI agent already knows the codebase. Open Claude Code or Cursor and ask naturally:
Understanding the codebase:
"Walk me through how a payment is processed."
"What does the auth middleware do?"
"Who owns the billing module?"Before making a change:
"Is it safe to change the signToken function signature?"
"What breaks if I rename UserService?"Starting a new task:
"Start ticket: Add rate limiting to the login endpoint."
→ Creates branch feat/rate-limiting-login
→ Prints PR description template
→ Enforces atomic commits throughoutPR workflow:
"@agent fix #2 and #4" # fix specific review comments
"@agent fix all" # fix everything in the queueAfter shipping:
"Run pre-deploy checklist for the auth service."
"Generate an onboarding guide for the payments module."| Skill | Trigger | What happens |
|---|---|---|
wednesday-git | Starting a task, committing, opening a PR | Enforces branch naming, atomic commits, conventional messages, GIT-OS PR format |
standards-kit | Writing any code or UI | Blocks custom components, enforces complexity < 8, naming conventions, import ordering |
pr-review | @agent fix #N in PR comments | Fetches comments, categorizes by impact, applies fixes as separate atomic commits |
deploy-checklist | Pre/post deploy | Walks env vars, migrations, rollback plan, smoke tests, monitoring |
greenfield | New project planning | Runs Architect + PM + Security personas in parallel, produces PLAN.md with tensions |
| Skill | Trigger | What happens |
|---|---|---|
codebase-intel | Any structural question or pre-edit check | Queries graph.db for impact, risk score, blast radius, entry points, dead code |
brownfield-drift | Architecture review or PR merge | Validates code boundaries against PLAN.md — blocks domain spillage |
brownfield-e2e-gen | Test coverage gaps | Generates tests using real AST callers and mock behavior, not scaffolding |
You: "Map this codebase completely."AI runs wednesday-skills map --full. After 2 minutes you have:
MASTER.md — full architecture in plain EnglishFrom this point, any structural question is answered from the graph, not from re-reading files.
You: "Fix the token expiration bug in auth.ts."AI checks blast radius before writing a single line. If risk score > 80:
⚠ HIGH RISK — auth.ts has risk score 87
This file is imported by 14 modules across Auth and Billing.
Recommend running these 3 tests before editing: [list]
Proceed? (y/n)Only after your confirmation does it write code — then commits with fix(auth): Resolve token expiry on silent refresh.
You: "Generate an onboarding guide for the payments module."AI uses recursive SQL traversal on graph.db to trace the full request path from API entry point to database layer, producing a focused Mermaid diagram and file reading order — specific to the exact layer the developer needs to touch.
You: "Check if this PR follows our architecture."brownfield-drift reads PLAN.md boundary rules and validates them against the actual import graph. If a frontend module starts importing from the database layer, it's caught here before merge.
# Setup
wednesday-skills install # install + configure all agents
wednesday-skills config # interactive API key and model setup
wednesday-skills sync # re-sync all agent config files
wednesday-skills sync --tool cursor # re-sync one specific agent
# Codebase Intelligence
wednesday-skills map --full # full AST parse → graph.db → MASTER.md
wednesday-skills map --incremental # update changed files only (< 1s)
wednesday-skills blast <file> # blast radius report for a file
wednesday-skills score <file> # risk score 0–100
wednesday-skills dead # dead files and unreferenced exports
wednesday-skills drift # architecture drift vs PLAN.md
wednesday-skills chat "question" # plain-English codebase Q&A
wednesday-skills onboard # onboarding guide for a module
# Git & PR
wednesday-skills pr # validate + push + open PR
wednesday-skills coverage # test coverage report
wednesday-skills sonar # SonarQube report
# Skill Registry
wednesday-skills list # installed skills
wednesday-skills search <term> # search community registry
wednesday-skills add <skill> # install from registry
wednesday-skills update # update all skills
wednesday-skills stats # token usage and cost breakdownyour-project/
├── CLAUDE.md ← Claude Code instructions (auto-managed)
├── GEMINI.md ← Gemini CLI instructions (auto-managed)
├── .cursorrules ← Cursor instructions (auto-managed)
├── .github/
│ └── copilot-instructions.md ← Copilot instructions (auto-managed)
├── .commitlintrc.json ← Conventional commit rules
└── .wednesday/
├── tools.json ← Which agents are registered
├── config.json ← API keys and model preferences
├── skills/ ← Installed skill SKILL.md files
├── graph.db ← SQLite dependency graph (auto-updated)
└── codebase/
├── MASTER.md ← AI-generated architecture guide
├── summaries.json ← Module purpose index
└── dep-graph.json ← Serialized graph for toolingGit hooks (in .git/hooks/):
| Hook | What it enforces |
|---|---|
commit-msg | Conventional commit format via commitlint |
pre-commit | Module header required on new JS/TS files |
post-commit | Incremental graph update (< 1 second) |
post-merge | Full graph refresh after a pull |
The dependency graph parser handles: JavaScript, TypeScript, Python, Go, Ruby, Java, Kotlin, Swift, C, C#, PHP, GraphQL
| Guide | What it covers |
|---|---|
| Getting Started | Install, configure, first map, recommended workflow |
| Architecture | Engine internals, adapters, graph, data flows |
| CLI Reference | Every command with flags and examples |
| Best Practices | Token efficiency, CI setup, team workflows |
| Token Cost Report | How cost tracking works, pricing table, model selection |
License: MIT — Wednesday Solutions
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.