GitHub - jdefrancesco/SrcWranglr: SrcWranglr - A graphical C/C++ source navigator.

Explore C/C++ codebases through interactive graphs, linked source, and code auditing tools.

SrcWranglr is a free, MIT-licensed desktop application for getting oriented in unfamiliar C and C++ projects. Open a folder, pick a symbol, and follow its callers, dependencies, and uses alongside the source. Keep notes as you investigate, trace values across functions, and identify code worth reviewing or fuzzing.

Written in Rust with egui and tree-sitter. Inspired by Sourcetrail, with an independent implementation that shares no code with it.

Quick start · Features · Features planned · Limitations · User guide · Algorithms · AI policy

About

I built SrcWranglr to help me understand C/C++ codebases while learning Rust. The core analysis code was written by hand; AI tools have assisted with GUI work, tests, and documentation.

Before the Rust re-write, the project used the working name slurcetrail and was written in Python for a prototype, then C, then I got side tracked by other things.

Quick start

Requires Rust 1.95 or newer. Development and testing currently happen on macOS. Linux and Windows are not yet tested.

git clone https://github.com/jdefrancesco/SrcWranglr.git
cd SrcWranglr
cargo run --release --locked

Try the built-in demo from the start page, or choose File → Open Project… and select a C/C++ project folder. You can also open a project directly:

cargo run --release --locked -- ~/code/myproject

Indexing reads source directly; you do not need to build the project or provide a compilation database. It runs in the background, supports cancellation, and respects .gitignore. See limitations for indexing and analysis boundaries.

Semgrep, cppcheck, and flawfinder are optional. Install them separately to use their integrations; the graph, navigation, and built-in analysis work without them. See external analyzers for what each adds, and File → Settings… for tool discovery and editor options.

Features

See how the code fits together

The Trail view keeps the selected symbol in the center, its callers on the left, and what it calls or uses on the right. Members sit inside their class boxes, and large groups show a hidden-item count to keep the view readable.

• Follow calls, inheritance, type and member uses, and containment.
• Switch to Call hierarchy to explore a tree of calls from entry points or a function you select. Callees appear in source order, with recursion and additional callers marked.
• Click a resolved name in the source or a node in the graph to explore it. Step through declaration and use locations, then go back through your navigation history.
• Press X over any name for IDA-style cross references: every use and call, with the function each is in. It works for library functions like memcpy too.
• Click any name in the source to highlight it everywhere in the file.
• Jump to a symbol with fuzzy search, pan and zoom the graph, and open the current location in your preferred editor.

Investigate code and find audit leads

Input reach-ability helps prioritize findings. Value traces follow assignments, calls, returns, copies, out-parameters, and struct fields where supported. Both use syntax and heuristics; review the source to establish what a path means.

See the user guide for analysis behavior, examples, tool configuration, and limits.

Bring in external analyzers

SrcWranglr runs these tools on the project and puts their results in Findings, next to its own checks, where you can filter them and record verdicts. Each one is optional. File → Settings… → Tools shows where each was found and how to install it.

The audited code can't silence these tools: SrcWranglr ignores its // nosemgrep, cppcheck-suppress, and Flawfinder: ignore comments, and lists each such comment as a finding of its own.

Install them with brew install semgrep cppcheck flawfinder, or pipx install semgrep flawfinder and your system's cppcheck package.

Keep your investigation organized

• Notes, bookmarks, and TODOs: attach context to symbols and source lines, and browse TODO-style comments already in the code.
• Sessions: reopen a project where you left off, or save a .srcwranglr-session file.
• Audit bundles: export notes, bookmarks, TODOs, verdicts, and your exploration position to a .srcwranglr-audit file. A teammate can preview and merge it into their own checkout.
• Strings and documentation: find string literals and their use sites, read project doc comments and Doxygen documentation, look up library functions in system man pages, or click the project's name to read its README, rendered from Markdown.
• Customizable workspace: arrange panes, choose source themes, symbol-list and top-bar fonts, and configure your editor and tool locations.

Essential controls

See all controls for pane layout, sessions, and analysis actions.

Limitations

SrcWranglr uses tree-sitter for syntax-based indexing and heuristic name resolution. These boundaries matter when interpreting the graph and analysis:

• Symbol identity: overloads with the same name merge into one symbol. Same-named static functions in different files also merge in the index, which can affect graph relationships and reachability.
• Language coverage: macros are not expanded and using namespace is not followed. Global variables, enums, and general typedef/using aliases are not indexed yet; named typedef struct declarations are supported. Ambiguous references are left unlinked.
• Analysis coverage: unresolved indirect calls, function pointers, pointer aliases, and checks that constrain a value are not fully modeled. Reachability can include calls that do not receive the input, and a finding without an input tag is not proven unreachable. A displayed trace describes a possible path, not a confirmed vulnerability.
• Resource limits: indexing defaults to 100,000 source files and skips files larger than 2 MiB with a warning. Analysis also has time and traversal limits and reports when a trace is cut short.
• Harness drafts: generated fuzz harnesses need review and may need changes before they compile, particularly around macros, include order, and project-specific types.

Detailed behavior is documented in the user guide.

Build a package

This builds and packages SrcWranglr for the host platform, placing the results in dist/.

Packaging support for Linux and Windows is present; those platforms remain untested. See packaging details for signing and other build targets.

Command line

srcwranglr [PROJECT_DIR] [--symbol QUALIFIED_NAME] [--view trail|calls] [--triage]
srcwranglr --version

For example, open LevelDB at a function in the call hierarchy:

srcwranglr ~/code/leveldb --symbol leveldb::DBImpl::Write --view calls

Use --triage to open the project survey after indexing. See the command-line reference for all options.

Development

Run the format check, Clippy, and tests:

Inspect the syntax tree of a C/C++ file:

cargo run --example dump_tree -- path/to/file.cpp

The core pipeline is:

discover files → extract syntax → resolve names → CodeGraph → layout → render

Indexing lives in src/index/, graph layout and rendering in src/graph/, value tracing and analysis in src/analysis/, and application behavior in src/app/. See the source map and development reference for individual modules, headless indexing measurements, and harness export commands. Algorithms explains the techniques behind each feature: name resolution, tracing, input reachability, fuzz-target scoring, code matching, rule drafting, and git history.

Bug reports are especially useful with a small C/C++ example, the expected relationship or trace, the observed result, and your platform. Open an issue.

Features planned

Planned additions include:

• Following values through pointer aliases.
• Richer semantic indexing and search beyond syntax shapes and call behaviors.
• Collecting useful seed corpora for fuzz targets.
• Exploring lightweight language-model assistance for understanding large codebases: explaining a function, triaging a finding, and drafting a rule from a description.

AI Policy

This project was ported from software I had been working on years ago. I decided to perform a rewrite in Rust for learning if I am capable of writing real tools in Rust. Oh, also because "Rustaceans" are relentless zealots who pushed it so hard that knowing it has become a requirement for a lot of system development. The cult of Rust can give it a rest now though that us unlikely to happen heheh...

The majority of the code is manually written with the exception of:

1. The GUI. Writing UIs isn't something I find thrilling.
2. Documentation found in the repository.
3. The Makefile and various helper scripts.
4. Yak-shaving tasks that consume too much time for a one man army.

That being said, blind usage of LLMs aren't acceptable. AI has become very useful but I am a strong believer that humans need to be driving and crafting a deep understanding of their code. Prototyping, helping debug difficult problems, and security review are also acceptable uses of LLMs. So please, if you plan to contribute use AI as a tool and exercise discretion. AI Slop can easily derail otherwise awesome project,

Acknowledgements

• Inspired by Sourcetrail by Coati Software, now archived. SrcWranglr is an independent implementation and shares no code with it.
• Screenshots show LevelDB (BSD-3-Clause, © The LevelDB Authors).
• Bundles the fonts Source Code Pro (© Adobe) and Iosevka (© Renzhi Li), both under the SIL Open Font License 1.1, and Ubuntu Regular and Medium (© Canonical Ltd.) under the Ubuntu Font License 1.0; see assets/fonts.
• Built on egui/eframe, tree-sitter with tree-sitter-cpp, ignore, rfd, nucleo-matcher, gitoxide, and pulldown-cmark.

License

MIT © 2026 Joseph DeFrancesco