A static-analysis engine that turns any codebase into a queryable knowledge graph — built so AI agents receive minimal, precise code context instead of raw file dumps.
🔒 Closed-source, commercial system (part of NovAiOS). This repository is the public architecture tour. Live walkthrough & demo: muratsuer.eu · Contact: murat@muratsuer.eu
AI coding agents waste most of their context window reading files to rediscover structure that never changes: who calls what, what inherits from what, where data flows. This engine extracts that structure once, keeps it incrementally updated via git hooks, and serves it to agents through token-budgeted, read-only MCP tools.
An 11-pass analysis pipeline over Tree-sitter ASTs with SCIP symbol IDs:
flowchart LR
A["1–2\nStructure &\nExtraction"] --> B["3–4\nResolution &\nEnrichment"]
B --> C["5\nValidation"]
C --> D["6\nCross-language\nBridges"]
D --> E["7–8\nCycles &\nCommunity\n(Louvain)"]
E --> F["9\nPageRank\nCentrality"]
F --> G["SQLite graph\n(recursive-CTE queries)"]
G --> H["21 MCP tools\n(token-budgeted, read-only)"]
| Capability | Detail |
|---|---|
| Knowledge graph | Entities + edges (calls, inheritance, imports, value-level data flow) stored in SQLite, queried with recursive CTEs |
| Incremental engine | Git-hook driven — only re-analyzes what changed |
| Test-impact analysis | "Which tests must run for this diff?" |
| Contract validation | Detects violations of declared module I/O contracts |
| Dead code & cycles | Graph-based detection, not grep heuristics |
| Community detection | Louvain clustering reveals de-facto module boundaries |
| PageRank centrality | Ranks entities by structural importance — agents read the load-bearing code first |
| MCP surface | 21 read-only tools, every response capped by a token budget |
39 file types parsed. 15 languages with fully proven call & inheritance graphs — recall floor 1.00, locked as regression gates:
Python · JavaScript · TypeScript · Java · C# · Go · Rust · Kotlin · Swift · Scala · Dart · Haskell · OCaml · Solidity · Zig
Plus partial call extraction for C, C++, PHP, Ruby and others, and value-level data-flow edges (the foundation of the taint-analysis engine built on top of this graph).
Zero-false-positive extraction policy: an edge is only recorded when the resolver can prove it. Precision over recall — agents must be able to trust the graph.
Dogfooded on a real production codebase:
- 8,000+ entities / 8,700+ edges
- 480+ tests
- 11-pass pipeline, 15 languages full-depth / 39 file types parsed, 21 MCP tools
- Zero external dependencies in the analysis core (Tree-sitter grammars vendored & hash-locked)
Python · Tree-sitter · SQLite (recursive CTE) · SCIP · MCP · ForceGraph3D (visualization)
Author: Murat Süer — AI Engineer & Data Scientist · LinkedIn Source access and live demos available for interviews and evaluation.