static-analysis on tomrochette.com

Repowise

tom@tomrochette.com (Tom Rochette) — Tue, 13 Oct 2026 00:00:00 +0000

Repowise is an AGPL-3.0 local code-intelligence tool that parses a repository’s code, call graph, git history, tests, docs, and architectural decisions into one local index, then serves it to coding agents through ten task-shaped MCP tools and to humans through a dashboard and CLI.

Repowise is the broadest bet in this category that understanding, not retrieval, is the product: the same index that answers an agent’s “what calls this” also scores every file’s health, finds the dead code, and ranks what to fix first, and it is the only member that benchmarked itself against this table’s other columns directly.

What it is
#

A Python CLI (uv tool install repowise) that builds the index in .repowise/ with zero LLM calls, then serves it through repowise serve as a local dashboard plus an MCP server with ten tools (get_overview, get_answer, get_context, get_symbol, search_codebase, get_risk, get_change_risk, get_why, get_dead_code, get_health, plus list_repos for workspaces). The deterministic layers (graph, git, health, tests, dead code, docs) never call a model; model-written prose and decision mining are opt-in on your own key or offline through Ollama. Beyond the agent surface it writes CLAUDE.md and AGENTS.md from the real index, keeps them current, shrinks command output with repowise distill, seeds linked worktrees from the base checkout, and spans repositories into workspaces with cross-repo contract checks. Hosted repowise.dev runs the same engine as a service, and a commercial licence adds modification rights, in-VPC or air-gapped deployment, and SLA support, priced per seat, per indexed repository, or enterprise-wide. Made by the repowise-dev organization, AGPL-3.0 or commercial, Python, active on PyPI as repowise.

Status
#

Young and growing: 7,617 stars, 856 forks, and 313 open issues as of 2026-10-13, created 2026-03-23 and pushed 2026-10-12, PyPI at 0.56.0. The community footprint is thin for the star count: two Show HN posts drew 4 and 1 points in April 2026 and the vendor’s own blog threads stayed single-digit, so the adoption signal is stars and downloads (about 16.8k PyPI downloads in the trailing month) without practitioner debate. The vendor publishes the most checkable benchmark claims in this category: call-graph precision of 0.976 to 0.995 against the Go and TypeScript compilers’ own resolution, and a self-built 42-instance context-tool comparison where its file coverage (0.876) leads Graphify, code-review-graph, and Serena, with the losing rows published.

Strengths
#

The agent surface is genuinely task-shaped: a question like “what breaks if I change this” returns symbol-level blast radius plus the tests that reach it, in one call, which is the context-selection job this category exists for.
The benchmark section is the category’s most falsifiable: compiler-graded call-graph precision per language, a sealed held-out comparison split, and losing rows published next to the wins.
One index serves agents, humans, and CI at once, so the health scores and the agent’s answers come from the same parsed facts rather than two divergent tools.
The agent integrations go past MCP: generated CLAUDE.md/AGENTS.md from the real index keep non-MCP agents informed, and repowise distill applies reversible output shrinking in the same tool.

Cautions
#

Every published number is self-run: the ContextBench comparison split is the vendor’s own construction, and no third party has replicated any figure as of 2026-10-13.
The suite is far wider than the context job (health scores, security signals, SBOM and compliance reporting on the commercial roadmap), and the vendor’s own commercial document labels capabilities GA, in-development, or planned, so expect uneven maturity across layers.
AGPL-3.0 is a stop sign for embedders who will not accept copyleft, and the commercial licence that removes the obligation publishes no figures, only proposal-based pricing in three models.
The thin footprint cuts both ways: 7.6k stars with two single-digit Show HNs is the star-velocity-without-debate pattern this section has flagged before.

Pricing
#

Free and open source under AGPL-3.0: the local CLI, dashboard, MCP server, and the full deterministic layer set (graph, git, health, tests, dead code, docs, decisions) with zero LLM calls and no API key. Hosted repowise.dev is free to start. The commercial licence (modification without AGPL obligations, in-VPC or air-gapped deployment, SLA support, patent grant) is priced per seat, per indexed repository with unlimited seats, or enterprise-wide, with specific figures provided by proposal only, none published as of 2026-10-13.

Compared to
#

code-review-graph: the closest member, also a stored local graph with blast radius, risk scores, and dead code; repowise adds git analytics, health scores, generated docs, decision mining, and workspaces, plus a commercial tier code-review-graph refuses to have.
Graphify: both parse a repo into a queryable graph, but Graphify’s is a deterministic AST map for structural questions while repowise’s is compiler-checked with per-edge confidence stamps and carries git, tests, and decision context alongside.
Serena: Serena parses the working tree live for symbol-precise retrieval and editing; repowise keeps a standing index for repo-scale questions and change risk, so they compose on a large codebase.

Bottom line
#

Recommended for teams whose agents burn tokens re-discovering a large codebase and who want one local index to also carry the health and dead-code answers, after re-running the vendor’s benchmark protocol on your own repository. Not for buyers who need published prices, a permissive licence, or independently replicated numbers, because none of those exist here yet. My disagreeable claim: a context engine that also tells you what to fix first is the right product for the agent era, and the pure-retrieval columns in this table will sprout analytics layers within a year or lose the budget line to tools like this one.

Changes
#

2026-10-13 - Created from the cross-category scan’s flag (repowise-dev/repowise), admitted after the API’s NOASSERTION license reading resolved to AGPL-3.0 and the kind call held (a local index served to agents over MCP, with analytics riding the same index), with the self-run-benchmark and thin-footprint cautions recorded as the critical angle.

References
#

https://api.github.com/repos/repowise-dev/repowise - stars, forks, issues, AGPL-3.0 license, creation and push dates as of 2026-10-13
https://raw.githubusercontent.com/repowise-dev/repowise/main/README.md - the three-way product map, the ten MCP tools, the benchmark tables with their losing rows, and the deployment matrix
https://raw.githubusercontent.com/repowise-dev/repowise/main/docs/business/COMMERCIAL.md - the AGPL/commercial split, the three pricing models with no published figures, and the GA/in-development/planned capability labels
https://pypi.org/pypi/repowise/json - the distribution at 0.56.0
https://pypistats.org/api/packages/repowise/recent - 16,776 downloads in the trailing month as of 2026-10-13
https://api.npmjs.org/downloads/point/last-month/repowise - 1,048 downloads in the month to 2026-10-11
https://hn.algolia.com/api/v1/search?query=repowise&tags=story&hitsPerPage=10 - the footprint check: two Show HNs at 4 and 1 points, the rest unrelated or the vendor’s own blog threads (fetched 2026-10-13)
https://docs.repowise.dev - the docs portal (fetched 200, 2026-10-13)
https://repowise.dev - the hosted service site (fetched 200 after redirect, 2026-10-13)

code-review-graph

tom@tomrochette.com (Tom Rochette) — Sun, 11 Oct 2026 00:00:00 +0000

code-review-graph is a local-first Python tool that parses a repository into a Tree-sitter knowledge graph and serves it to AI coding tools over MCP and a CLI, so a review reads the blast radius of a change instead of the repository.

The mechanism is a context engine wearing a review badge: the graph decides what enters the window, the smallest file set a change touches, and the project ships the category’s most self-critical benchmarks, stating in its own README that its recall metric is circular and its whole-corpus baseline is one no agent pays.

What it is
#

A pip or pipx CLI (MIT, Python 3.10+) by Tirth (tirth8205), solo maintainer, with an MCP server on stdio or localhost HTTP and one SQLite graph per repository in .code-review-graph/. Tree-sitter parses 30-plus languages and notebooks into nodes (functions, classes, imports) and edges (calls, inheritance, tests); queries return blast radius, risk-scored change detection, hub and bridge detection, community maps, execution flows, dead code, and a generated wiki. install detects up to sixteen AI coding tools (Codex, Claude Code, Cursor, Windsurf, Zed, Continue, OpenCode, and more) and writes each one an MCP entry plus hooks, skills, and rules-file text; uninstall removes exactly what it wrote. A composite GitHub Action posts risk-scored PR comments updated in place, with an optional fail-on-risk merge gate, running the graph on your runner with no source sent anywhere; there is no telemetry, and cloud embeddings are opt-in behind a printed egress warning.

Status
#

Active and unusually fast-growing: 32,096 stars, 2,937 forks, and 184 open issues as of 2026-10-13, created 2026-02-26, pushed 2026-10-06, so five figures of stars arrived in under eight months. PyPI carries 2.3.9 (uploaded 2026-09-18) across 37 releases on a roughly monthly cadence, and the repo runs a documented staging to testing to main promotion flow. The community footprint is lopsided: a Hacker News search returns three story hits, the largest a 12-point launch thread with two comments (one an install failure), so the star count arrived without front-page discussion, the Trendshift-badge pattern this section has seen before. Every number below is the author’s own; no independent benchmark exists.

Strengths
#

The benchmark section is the category’s most self-critical: recall 1.0 is labelled circular (the ground truth comes from the same graph the predictor walks), the whole-corpus baseline is called an upper bound no agent pays, the co-change mode is reported not yet usable, and pins, seeds, and a reproduction recipe are published.
Incremental freshness is mechanical and measured: SHA-diffed re-parses through hooks, watch mode, or a daemon, about 2.5 seconds for a two-file edit on a 3,000-file repository.
The installer is the widest wiring surface in this category’s matrix, one command configuring up to sixteen platforms, with an uninstall documented down to atomic config writes.
Genuinely local: no telemetry, a SQLite file in the repo, and a stated rule that cloud embedding text is identifiers, signatures, and docstring summaries, never function bodies.

Cautions
#

The headline roughly 63x median reduction is measured against that whole-corpus baseline; the agent-baseline eval that would measure a fairer comparison exists, but no canonical capture of it is published.
A third-party write-up quotes older claims (6.8x fewer tokens on reviews, up to 49x on daily coding) that it admits it has not verified and that the current README no longer makes, so secondary coverage lags the primary numbers.
Solo maintainer, eight months old: bus factor one, and the star velocity is ahead of any independent validation.
Impact analysis is deliberately low-precision (flagging an extra file beats missing a dependency), which costs tokens on large dependency graphs, and the README’s own limitations put flow-detection recall at 33%.
Small repositories and single-file diffs are named by the project itself as cases where graph context costs more than it saves, and the name oversells the review job: the tool judges nothing on the PR stream.

Pricing
#

Free, MIT, entirely local. Pricing does not apply.

Compared to
#

Graphify: the closest sibling, also a local AST knowledge graph; Graphify aims at repo-scale Q&A and path tracing, this tool is change-and-review-first with blast radius and a CI action.
Serena: LSP-backed symbol tools that parse live and edit at symbol level, more precise per symbol; this tool wins multi-hop impact questions from a stored graph.
Repomix: the one-file whole-repo pack, simplest for one-shot questions on repos that fit a window; no structural queries, and stale the moment you edit.

Bottom line
#

Recommended for review-heavy teams on multi-thousand-file repositories that want the agent to read only the blast radius, after reading the benchmark caveats and ideally re-running the eval on your own repo; not for small repos, single-file diffs, or anyone expecting a tool that judges code.

Changes
#

2026-10-11 - Created from the code-review scan’s flag, shelved in context-engines over code-review because the graph serves context and judges nothing, with the whole-corpus-baseline and solo-maintainer cautions recorded as the critical angle.

References
#

https://api.github.com/repos/tirth8205/code-review-graph - stars, forks, issues, license, creation and push dates as of 2026-10-11
https://raw.githubusercontent.com/tirth8205/code-review-graph/main/README.md - mechanism, installer surfaces, benchmark tables, and the limitations list
https://raw.githubusercontent.com/tirth8205/code-review-graph/main/docs/FAQ.md - the when-not-to-use size thresholds, the no-telemetry statement, and the Serena and Repomix comparison
https://pypi.org/pypi/code-review-graph/json - version 2.3.9 and the 37-release train
https://api.github.com/repos/tirth8205/code-review-graph/releases?per_page=5 - release cadence through v2.3.9 (2026-09-18)
https://hn.algolia.com/api/v1/items/47314090 - the 12-point launch thread with the install-failure comment
https://hn.algolia.com/api/v1/search?query=code-review-graph&tags=story&hitsPerPage=10 - the thin Hacker News footprint check as of 2026-10-11
https://dev.to/stevengonsalvez/code-review-graph-stop-your-agent-reading-the-whole-repo-4272 - the third-party write-up quoting unverified older figures, the record’s skeptical source
https://code-review-graph.com - the website, client-rendered this run (title only fetched), cited through the fetched primaries

static-analysis on tomrochette.com

Repowise

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

code-review-graph

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

static-analysis on tomrochette.com

Repowise

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

code-review-graph

What it is #

Status #

Strengths #

Cautions #

Pricing #

Compared to #

Bottom line #

Changes #

See also #

References #

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#

What it is
#

Status
#

Strengths
#

Cautions
#

Pricing
#

Compared to
#

Bottom line
#

Changes
#

See also
#

References
#