Intelligent codebase visualizer.
Turn any TypeScript, JavaScript, Python, Go, Rust, or Java repository into a living, queryable graph — every node carries a functional summary, a technical summary, and a security assessment.
Click the image to watch the demo
- What is DevLens?
- Supported languages
- Quick Start
- Screenshots
- Why it's faster & cheaper
- Ways to use DevLens
- Configuration
- What DevLens understands
- Benchmarks
- Who is this for
- How DevLens compares
- Repository layout
- DevLens Cloud
DevLens turns a codebase into a pre-built dependency graph. Instead of reading files one at a time, you (or your AI agent) query the graph: every component, class, function, route, struct, or trait is a node, and every connection is a typed edge (CALLS, IMPORTS, HANDLES, IMPLEMENTS, …). Each node carries:
- Functional summary — what business purpose does this serve?
- Technical summary — how does it work?
- Security assessment — severity + explanation
This is the difference between an AI that re-reads your whole repo every session and an AI that already knows the architecture — architecture reviews, impact analysis, security audits, and onboarding take seconds, not hours.
DevLens parses six languages with native parsers (no regex, no tree-sitter) and understands their frameworks:
| Language | Frameworks / stacks the graph understands | What gets parsed |
|---|---|---|
| TypeScript / JavaScript | React, Next.js (app & pages router), Express/Hono/Fastify, React Router, TanStack Router, any Node | components, hooks, state stores, classes, methods, functions, routes |
| Python | FastAPI, Flask, Django (+DRF), SQLAlchemy / Django ORM, Celery, Pydantic | classes, methods, functions, routes, data models |
| Java | Spring Boot (controllers, JPA, Spring Data repositories) | classes, methods, interfaces, enums, routes |
| Go | net/http, Gin, Echo, chi, Fiber, GORM, database/sql | structs, interfaces, methods, functions, routes |
| Rust | axum, actix-web, rocket, utoipa, Diesel | structs, enums, traits, impl blocks, methods, functions, routes |
Each repo is analyzed with its language's own parser (Python ast, JavaParser, Go go/ast + go/types, Rust syn, TS compiler API), so edges are real — type-checked interfaces (IMPLEMENTS), framework routes (HANDLES), and ORM data layers (READS_FROM/WRITES_TO).
1. Install
npm install -g @devlensio/cliNo Node.js? Use the standalone binary installer (zero dependencies):
Linux / macOS:
curl -fsSL https://raw.githubusercontent.com/devlensio/devlensOSS/main/scripts/install.sh | shWindows (PowerShell):
irm https://raw.githubusercontent.com/devlensio/devlensOSS/main/scripts/install.ps1 | iex
2. Configure your AI provider (only needed if you want AI summaries — structure-only works offline)
cd your-project
devlens init3. Analyze
devlens analyze . --summarizeDevLens detects the language (TS/JS, Python, Go, Rust, Java) from your manifests, builds the graph, and summarizes every node.
4. Explore
devlens overview # language, framework, stats, central nodes
devlens detect # "what is this repo?" — language, manifest, deps
devlens find-nodes -t ROUTE # every route in the app
devlens architecture # one-command architecture brief
devlens security # security flags across the codebaseThat's it. Want it in your AI agent instead? Jump to the Agent Skill.
Interactive graph explorer · node inspector with AI summaries & security risk · focused node subgraph · security findings
A node summary is ~50 tokens. The file it describes is ~2,000. Querying summaries and graph slices (get_blast_radius, get_subgraph) costs a fraction of reading files — humans get answers faster, and AI agents spend dramatically fewer tokens on the same task.
Pick the interface that fits your workflow:
For when you want to see your codebase laid out as an interactive graph.
Open the Web UI, paste your repo path, and explore a force-directed canvas — click any node to see its summaries, callers, callees, and security flags. Search, filter, diff commits across versions.
git clone https://github.com/devlensio/devlensOSS.git
cd devlensOSS && bun install && bun run dev
For scripts, CI, and answers fast without leaving the terminal. Every command supports --json for piping into scripts, -v/--verbose for diagnostics, and --quiet for minimal output.
npm install -g @devlensio/cliAnalyze & summarize
| Command | What it does |
|---|---|
devlens detect [path] |
Inspect a repo before analyzing: language, manifest, dependency count, source files |
devlens analyze [path] [--summarize] |
Build the graph (optionally add AI summaries) |
devlens summarize [path] |
(Re)generate summaries for an analyzed repo |
devlens status |
Which repos are analyzed, their language + summary coverage |
devlens doctor |
Environment health check — git, storage, LLM provider, and all 4 extractor runtimes |
Explore & understand
| Command | What it does |
|---|---|
devlens overview |
Big picture — language, framework, stats, central nodes |
devlens find-nodes <name> |
Search by name / type / file / severity (supports -t ROUTE, -t CLASS, -t STRUCT …) |
devlens nodes-in-path <path> / get-node <id> / get-summaries <ids…> / node-code <id> |
Drill into nodes — summaries before source |
devlens architecture |
One-call architecture brief — modules, routes, flows, health |
Impact & quality
| Command | What it does |
|---|---|
devlens blast-radius <id> |
What breaks if I change this? (upstream dependents) |
devlens khop <id> |
What does it depend on? (downstream) |
devlens subgraph <seed> |
The cohesive cluster (module) a node belongs to |
devlens cycles |
Circular dependencies |
devlens security / security-brief |
Security findings, ranked with blast-radius reach |
devlens diff <from> <to> / review-pr |
Compare analyzed commits / full PR review packet |
devlens check-freshness / coverage |
Is the graph stale vs HEAD? What's summarized? |
devlens guard |
Warn before editing high-value / high-blast-radius nodes |
Manage & integrate
| Command | What it does |
|---|---|
devlens config |
View / set LLM provider config (~/.devlens/config.json) |
devlens repos |
List analyzed repos |
| `devlens graphs list | delete` |
devlens serve |
Start the HTTP API for the Web UI |
devlens mcp |
Run the MCP server (see below) |
Full reference:
src/cli/README.md— every command with options and examples.
The most powerful way to use DevLens. Your AI agent normally reads files one at a time — the DevLens Skill teaches it to query the pre-built graph instead.
npx @devlensio/skill installThen reload your tool and use /devlens in Claude Code, Cursor, Kilo, opencode, pi, or any AI coding agent:
| Command | What it does |
|---|---|
/devlens init |
Connect MCP, configure provider, analyze the repo |
/devlens architecture |
Full system brief — stack, modules, routes, patterns, security posture |
/devlens explain [path] |
Onboard to a module or the whole repo — callers, callees, reading path |
/devlens diagram [type] |
Mermaid diagrams (architecture, cluster, flow, deps) with typed edges |
/devlens security-analysis [level] |
Prioritized security report with reach + fix-order |
/devlens impact <symbol> |
Blast radius — what breaks if you change this? |
/devlens tech-debt |
Cycles, coupling hotspots, god-files |
/devlens guard [target] |
Warn before editing high-risk code |
/devlens onboard |
Write a saved ONBOARDING.md for new devs |
/devlens find <name> |
Locate any component, class, function, struct, or route |
/devlens summary <kind> <target> |
On-demand technical / functional / security summary |
/devlens changes [range] |
Explain recent work or a merge conflict, by functionality |
Full reference:
packages/skill-installer/README.md— all subcommands, install options, and supported AI tools.
Wire DevLens into any MCP client (Claude Code, Claude Desktop, IDE agents, …). The server is bundled inside the CLI and exposes 21 tools covering discovery, search, traversal, security, and one-call workflow summaries.
devlens mcp # stdio mode
claude mcp add devlens -- devlens mcp # register in Claude Code
devlens mcp http -p 7000 # HTTP modeYour agent can: list analyzed repos, get a repo overview (language + framework + stats), find nodes by name/type/severity, read summaries, trace blast radius / k-hop / subgraphs, find cycles, analyze a new repo, compare commits (analyze_changes), and generate whole-packet architecture/security/PR-review/onboarding/context outputs from one call.
Full reference:
src/mcp/README.md— tool catalog, registration, configuration.
Config lives in ~/.devlens/config.json and is set via devlens init or devlens config.
| Provider | Recommended model | Notes |
|---|---|---|
| Ollama (local) | qwen2.5-coder:7b |
Free, local, 8 GB+ RAM |
| OpenAI | gpt-4o-mini |
Fast, cost-effective |
| Anthropic | claude-haiku-4-5 |
Best cost/quality for summaries |
| DeepSeek | deepseek-v4-flash |
Strong code model |
| OpenRouter | deepseek-v4-flash or mimo-v2.5 |
Best cost/quality balance |
| Gemini | gemini-2.0-flash |
Fast, large context |
# Interactive setup — picks from a catalog and fetches live model lists
devlens config --set
# Non-interactive scripting
devlens config --provider openai --provider-name deepseek --model deepseek-v4-flash --api-key <key>
# Switch between saved providers without re-entering credentials
devlens config --active openai:deepseek
# Health check
devlens doctorModels are discovered dynamically from each provider's /models endpoint — no hardcoded model lists. Custom OpenAI- or Anthropic-compatible endpoints can be added through the interactive flow. Summaries are never generated silently — the skill and CLI ask permission first; structure-only analysis needs no provider at all.
Node types (per language — a graph is per-repo/per-language):
| Language | Node types in the graph |
|---|---|
| TS / JS | COMPONENT, HOOK, STATE_STORE, UTILITY, CLASS, METHOD, FUNCTION, ROUTE, FILE, TEST, STORY, THIRD_PARTY |
| Python | CLASS, METHOD, FUNCTION, ROUTE, FILE, TEST, THIRD_PARTY |
| Java | CLASS, METHOD, INTERFACE, ENUM, ROUTE, FILE, TEST, THIRD_PARTY |
| Go | STRUCT, INTERFACE, METHOD, FUNCTION, ROUTE, FILE, TEST, THIRD_PARTY |
| Rust | ENUM, STRUCT, TRAIT, IMPL_BLOCK, METHOD, FUNCTION, ROUTE, FILE, TEST, THIRD_PARTY |
Edge types (the connections the graph draws):
CALLS, IMPORTS, READS_FROM, WRITES_TO, PROP_PASS, EMITS, LISTENS, WRAPPED_BY, GUARDS, HANDLES, TESTS, USES, NEXTJS_API_CALL, NAVIGATES_TO, IMPLEMENTS (class → interface / trait / ABC), EXTENDS (class → base class).
EXPORTS and THROWS + node types MODULE/PACKAGE are reserved for future languages.
Router awareness — routes are real graph nodes:
Next.js (app & pages), React Router / TanStack Router / wouter, Express / Fastify / Hono / Koa, Django URLconf / DRF, Flask blueprints, @RestController (Spring), Gin / Echo / chi / HTTP handlers, axum / actix / rocket.
Every node carries: importance score + functional summary + technical summary + security assessment (when summarized).
Tested across real-world tasks — architecture understanding, feature implementation, and bug finding — comparing the same model (DeepSeek V4 Flash, GLM 5.2, Kimi K2.6, Qwen 3.6) with and without DevLens.
| Metric | Without DevLens | With DevLens | Improvement |
|---|---|---|---|
| Avg cost per query | $0.163 | $0.075 | 54% cheaper |
| Avg input tokens | 88,980 | 35,035 | 61% less |
| Avg output tokens | 9,549 | 3,233 | 66% less |
| Avg tool steps | 14.3 | 7.8 | 45% faster |
| Structured output | 50% | 100% | 2× more reliable |
| Architectural debt found | 0% | 50% | Now discoverable |
Even the strongest tested model was 81% cheaper ($0.0035 vs $0.0185) and used 83% fewer input tokens with DevLens.
- Developers & teams — onboard devs in hours not weeks, review PRs with impact context, catch circular deps and god-files, keep living documentation.
- Engineering leaders — bird's-eye architecture view, spot debt before it becomes a crisis, understand work across repos.
- AI-augmented developers — stop letting your agent burn tokens re-reading files; it queries the graph instead.
DevLens is the only tool in this space that combines three things: native semantic parsing (not regex or tree-sitter), per-node AI summaries with per-node security analysis, and framework-aware data edges (routes, ORM reads/writes). That combination is what makes it uniquely suited for AI agents working inside a single codebase — and it's the only option you can use commercially under AGPL.
Every alternative trades away at least one of those capabilities:
| Dimension | DevLens | Graphify | GitNexus | Sourcegraph | DeepWiki |
|---|---|---|---|---|---|
| Core idea | Prebuilt semantic graph + per-node AI summaries + security | Syntactic knowledge graph + community detection | Agent-focused knowledge graph + taint analysis | Code search + AI assistant (Cody) | AI-generated docs per repo |
| Parsing depth | ✅ Native semantic parsers (TS compiler, Python ast, go/types, JavaParser, syn) — type-resolved |
tree-sitter (syntactic, no type info) | tree-sitter + native bindings (no type info) | SCIP/LSIF symbol index + language servers (no semantic parse) | LLM reads source directly (no structured parser) |
| Edge quality | ✅ Type-checked IMPLEMENTS/EXTENDS, framework routes (Next.js/Django/Spring/Gin/axum), ORM data edges (READS_FROM/WRITES_TO) |
EXTRACTED/INFERRED/AMBIGUOUS tags — no type or framework awareness |
call chains, clusters, processes, route_map — no ORM/data edges |
Precise symbol cross-references (SCIP) — no type-checked inheritance | Docs-level relationships (no structured graph) |
| Per-node AI summaries | ✅ Technical + business + security with severity — every node carries all three | ❌ (LLM used for docs/concepts) | ❌ (embeddings for semantic query) | ✅ Via Cody (hover + inline docs — chat-level, not per-node graph summaries) | ✅ Auto-generated docs per symbol (no security, no technical/business split) |
| Security analysis | ✅ Per-node severity + blast-radius reach — real exploit descriptions, not just flags | ❌ | Partial (opt-in PDG/taint — not built-in) | ❌ (SOC 2/ISO 27001 compliance only — no code-level findings) | ❌ |
| Agent / MCP integration | CLI + 21-tool MCP + /devlens skill + Web UI |
CLI + local skill (no MCP) | CLI + 17-tool MCP + skills + hooks (AGENTS.md) |
MCP server (cross-repo search + Cody agent — not a per-repo graph query surface) | Unknown (no public MCP integration) |
| Language coverage | TS/JS, Python, Java, Go, Rust — native parsers for each | 12 code families + docs/images (shallow syntactic) | Many via tree-sitter (Dart/Kotlin/Swift…) — shallow syntactic | 30+ (via language servers — symbol-level, no semantic edges) | Any (LLM reads source — no structured extraction) |
| License / pricing | ✅ AGPL-3.0 — free, including commercial use | Apache-2.0 | PolyForm Noncommercial (cannot use commercially) | Open-source core; Enterprise paid (cross-repo search) | Free for public repos; enterprise tiers unlisted |
| Multi-user cloud | In development (waitlist open) | No | Enterprise SaaS (paid) | Sourcegraph Enterprise (hosted, paid) | Web-hosted for public repos |
Other notable alternatives: CodeSee (service-level dependency mapping, enterprise-only), CodeQL (GitHub-native semantic security analysis — deep but no AI summaries or graph visualization), and ctags-based indexers (lightweight symbol indexes, no graph intelligence).
Why teams choose DevLens over the others:
- You get semantic edges (type-checked inheritance, ORM data flow, framework routes) that syntactic tools like Graphify and GitNexus simply can't produce — so your agent doesn't guess relationships, it knows them.
- You get per-node security analysis that no other open-source tool provides — not Sourcegraph (which only has compliance certifications), not GitNexus (which has optional PDG, not built-in), not DeepWiki (which ignores security entirely).
- You get 21 MCP tools + a universal
/devlensskill — a tighter, more purpose-built agent surface than Sourcegraph's general-purpose MCP or GitNexus's hooks.
(Feature comparison from public sources, Aug 2026.)
devlensOSS/
├── src/
│ ├── cli/ # `devlens` CLI (commander program + commands)
│ ├── core/ # Shared query core (CLI + MCP — never drift)
│ ├── mcp/ # MCP server (stdio + HTTP) — 21 tools
│ └── server/ # HTTP API for the Web UI
├── frontend/ # Next.js graph visualizer (Cytoscape)
├── plugins/devlens/ # Agent Skill source (Claude plugin)
├── packages/skill-installer/ # @devlensio/skill — the npx installer
├── bin/ # Platform launcher
├── npm/<platform>/ # 5 prebuilt binary packages (darwin/linux/windows × arm64)
├── scripts/ # Release tooling
└── server.json # MCP registry manifest
The analysis engine (“native parsers + graph build”) ships as the separate devlensio package.
A hosted version is in development:
- Shareable graphs your whole team can access
- Cross-repo navigation — understand your entire org
- Graphical context for AI agents — smarter code review and analysis
- No local setup
AGPL-3.0. Part of the devlensio family of tools.