File path built from untrusted inputno path found
src/flask/config.py:208os.environ (line 124) → filename → herewith open(filename, mode="rb") as config_file:
Paste a GitHub repo and read it like a manual — what every part does, how it all connects, and what breaks if you touch it. One sweep, about a minute, nothing to install.
Sweeping your own repo takes a free account — we'll keep the URL and run it the moment you land. Or read one already swept, no account at all.
Read one now, without signing up.
Three repos already swept. Every panel is open — the source, the call graph, the findings, the grade. These are the real reports, not a tour.
7languages read to a call graphJavaScript/TypeScript, Python, Go, Java, C#, PHP and Ruby — parsed to functions, calls and complexity, not matched with regexes.0AI in the analysisCloning, parsing, the call graph and every signal are computed by code. The AI layer sits on top and can be switched off entirely.10tools your agent can callThe same analysis over MCP — blast radius, untested hotspots, a pre-commit change simulation. One npx command.10supply-chain attacks, by versionNamed, dated incidents matched against the exact package versions a repo still declares — not a generic advisory feed.
01Paste a repoAny GitHub URL — public or private. Nothing to install, nothing to configure.
02One sweep, about a minuteFull git history, AST structure, security, dependencies — computed in a single pass.
03Read the manualA grade to orient you, then the survey: source, Faultline, signals — every claim with its evidence.
Read the code, with the map drawn on it.
Every function carries its computed complexity, its callers, and its risk. Click one and the AI explains what it does in plain language — sent on your click, never stored.
codetrawl.com — source
lib/codeAnalysis/plugins/javascript.ts·coffeejones/gitvision
8285 function lookupVariableType(name: string): string | null {
829 for (let i = methodStack.length - 1; i >= 0; i--) {
830 const t = methodStack[i].locals.get(name);
831 if (t) return t;
832 }
833 const cls = currentClass();
834 if (cls) {
835 const t = cls.fields.get(name);
836 if (t) return t;
837 }
838 return null;
839 }
lookupVariableTypeComplexity 5Called from 74 twinsNo test guards it
What it doesSearches a stack of method scopes and the current class for a variable's type, returning the first match or null.
Where the risk isThe function is structurally duplicated 4 times elsewhere in the codebase, and the file containing it is not reached by tests, making it difficult to verify correctness across all copies if the logic needs to change.
Worth consideringExtract this lookup logic into a shared utility function to consolidate the 4 duplicates and reduce maintenance burden.
Reads this function’s source with AI — sent to Anthropic on your click, never stored.Haiku 4.5
codetrawl.com — faultline
High riskif you delete lib/db/index.ts
index.ts
is load-bearing — deleting it breaks
15
files,
12
with no test to catch it.
page.tsx
app/(workspace)/account/billing/NO TEST
page.tsx
app/(workspace)/account/connections/NO TEST
page.tsx
app/(workspace)/account/security/NO TEST
route.ts
app/api/admin/reset-billing/NO TEST
route.ts
app/api/billing/cancel/NO TEST
route.ts
app/api/billing/change-plan/NO TEST
route.ts
app/api/billing/portal/NO TEST
route.ts
app/api/polar/webhook/NO TEST
auth.ts
lib/NO TEST
refreshQuota.ts
lib/billing/NO TEST
githubUserToken.ts
lib/NO TEST
watches.ts
lib/NO TEST
gates.ts
lib/billing/COVERED
metrics.ts
lib/COVERED
watchMonitor.ts
lib/COVERED
15 files break12 with no test1 hop — direct importers only
Know what a change breaks — before you make it.
Pick a file and simulate deleting or changing it. The call graph shows exactly which files break, and which ones have no test to catch it. Understanding how a repo holds together, made literal.
The dangerous code, matched to the line.
Three deterministic scanners — secrets, dynamic-execution patterns, and known supply-chain incidents. Every hit is pinned to the exact line, or the exact package. Matched against the record, never a guessed CVE.
codetrawl.com — security
Security · Code + dependencies
What deserves a security review.
2 informationalcounts proven reach only · 2 more listed below without a traced path
10 curated supply-chain attacks
Regex scan of source + config files
Dangerous calls traced from 50 entry points
eval / new Function / exec scanner
Findings4
What we can show, firstexec() of a runtime valueno path found
src/flask/config.py:209os.environ (line 124) → filename → hereexec(compile(config_file.read(), filename, "exec"), d.__dict__)
eval(compile(f.read(), startup, "exec"), ctx)
exec(compile(config_file.read(), filename, "exec"), d.__dict__)
Everything one sweep reads.
Eight ways of reading a codebase, computed in a single pass and cross-linked — follow any thread to the evidence it came from.
01Git historyWho really owns each corner — and where change keeps piling up.
02StructureHow the pieces connect: call graphs, import chains, dead ends.
03SourceThe code with every finding drawn on it, function by function.
04FaultlineWhat breaks if you change a file — before you change it.
05SecuritySecrets, risky eval, known incidents — matched to a line, not guessed.
06DependenciesWhich packages carry CVEs or have drifted out of date.
07DuplicatesThe same function body, copy-pasted where it shouldn't be.
08DiagramsThe type graph and architecture, drawn from the code itself.
Computed, never generated. Every finding is measured from the real code — tree-sitter ASTs, full git history, resolved dependency graphs. The AI narrates what was found; it never invents it.
Questions worth asking first.
Where does my code go?
We take two temporary copies to analyze it — a metadata-only git clone for history, and the repository archive, because the parsers have to read the files — and the analysis process deletes both when it is done. What we keep afterwards is the result: paths, structure, symbol names, metrics, findings. Not your files, with a short list of named exceptions we spell out rather than round off.
The whole answer is on one page, including the parts that are inconvenient for us.
Is this just an LLM guessing about my repo?
No — the analysis engine calls no AI at all. The clone, the parse, the call graph and every signal are computed by code, and with no API key configured the product loses its narration and nothing else. The AI layer sits on top in three clearly different shapes: the health verdict is written from the computed signals alone, the briefing also draws on what the model knows about well-known projects, and the per-function explainer reads that one function’s source when you click it.
We split those out instead of claiming the strongest one covers all three.
What does it cost?
Every panel is free on one repo, private repositories included — the source browser, the call graph, Faultline, the AI briefing, the grade. Nothing is held back to make the free tier feel thin. What you pay for is keeping more than one repo on the go, a grade on every pull request, and a daily re-sweep that tells you when something regressed.
What happens if CodeTrawl disappears?
The source is public and licensed under PolyForm Noncommercial, so you can read exactly what it does to your code and run it yourself — the
MCP server is one npx command and does its analysis on your machine, with no CodeTrawl server in the path at all. We are one person, not a funded team, and
we say so plainly; that is the reason the escape hatch exists rather than something to discover later.
Read your first repo now.
Free on one repo — private repos included. Nothing to install.
Sweeping your own repo takes a free account — we'll keep the URL and run it the moment you land. Or read one already swept, no account at all.