Codemap

Codemap

Query your codebase. Codemap builds a local SQLite index of structural metadata (symbols, imports, exports, components, dependencies, CSS tokens, markers, and more) so AI agents and tools can answer “where / what / who” questions with SQL instead of scanning the whole tree.

• Not grep semantics by default — use ripgrep / your IDE for raw text matches. Codemap ships opt-in FTS5 (--with-fts / fts5: true) when you want body matches that JOIN with symbols / coverage / markers in one SQL.
• Is a fast, token-efficient way to navigate structure: definitions, imports, dependency direction, components, and other extracted facts.

Documentation: [docs/README.md](docs/README.md) is the hub (topic index + single-source rules). Topics: [architecture](docs/architecture.md), [agents](docs/agents.md) (codemap agents init), [benchmark](docs/benchmark.md), [golden queries](docs/golden-queries.md), [packaging](docs/packaging.md), [roadmap](docs/roadmap.md), [why Codemap](docs/why-codemap.md). Bundled rules/skills: [.agents/rules/](.agents/rules/), [.agents/skills/codemap/SKILL.md](.agents/skills/codemap/SKILL.md). Consumers: [.github/CONTRIBUTING.md](.github/CONTRIBUTING.md).

---

What you get

Structural questions answered in one SQL round-trip instead of 3–5 file reads:

| Question | Grep / Read (today) | Codemap | | -------------------------------------------------- | ------------------------------------------------------------ | -------------------------------------------------------------------------------------- | | Find a symbol by exact name | Glob + Read + filter by hand | SELECT name, file_path, line_start FROM symbols WHERE name = 'X' | | Who imports ~/utils/date? | Grep + resolve tsconfig aliases manually | SELECT DISTINCT from_path FROM dependencies WHERE to_path LIKE '%utils/date%' | | Components using the useQuery hook | Grep useQuery + filter to component files | SELECT name, file_path FROM components WHERE hooks_used LIKE '%useQuery%' | | Heaviest files by import fan-out | Impractical without a parser | SELECT from_path, COUNT(*) AS n FROM dependencies GROUP BY from_path ORDER BY n DESC | | All CSS keyframes / design tokens / module classes | Grep @keyframes, --var-, .module.css then disambiguate | One SELECT against css_keyframes / css_variables / css_classes | | Deprecated symbols (@deprecated JSDoc) | Grep @deprecated + cross-reference symbol | SELECT name, kind FROM symbols WHERE doc_comment LIKE '%@deprecated%' |

Full schema and recipe catalog: [docs/architecture.md § Schema](docs/architecture.md#schema) · [docs/why-codemap.md](docs/why-codemap.md) · codemap query --recipes-json.

---

Install

bun add @stainless-code/codemap
# or: npm install @stainless-code/codemap

Engines: Node ^20.19.0 || >=22.12.0 and/or Bun >=1.0.0 — see package.json and [docs/packaging.md](docs/packaging.md).

---

CLI

• Installed package: codemap, bunx @stainless-code/codemap, or node node_modules/@stainless-code/codemap/dist/index.mjs
• This repo (dev): bun src/index.ts (same flags)

Daily commands

codemap                                                      # incremental index (run once per session)
codemap dead-code --json                                     # outcome alias → query --recipe untested-and-dead
codemap query --json --recipe fan-out                        # recipe SQL by id (alias: -r)
codemap query --json "SELECT name, file_path FROM symbols WHERE name = 'foo'"  # ad-hoc SQL
codemap --files src/a.ts src/b.tsx                           # targeted re-index after edits
codemap validate --json                                      # detect stale / missing / unindexed / rejected files
codemap context --compact --for "refactor auth"              # JSON envelope + intent-matched recipes
codemap ingest-coverage coverage/coverage-final.json --json  # Istanbul / LCOV (auto-detected) → coverage table; joins with symbols
NODE_V8_COVERAGE=.cov bun test && codemap ingest-coverage .cov --runtime --json  # V8 protocol (per-process dumps); local-only
codemap ingest-churn metrics/churn.json --json               # precomputed file_churn → churn-complexity-hotspots (non-git / CI)
codemap query --json --recipe churn-complexity-hotspots      # change-frequency × complexity (not the hotspots alias)
codemap agents init                                          # scaffold .agents/ rules + skills
codemap agents init --mcp                                    # PM-aware project MCP config (see docs/agents.md)
codemap apply rename-preview --params old=foo,new=bar --dry-run  # preview recipe-driven edits (substrate executor)

Version-matched agent guidance: codemap agents init writes thin pointer files to .agents/ (short SKILL + rule). The full content is served live by codemap skill / codemap rule (CLI) and codemap://skill / codemap://rule (MCP / HTTP) — so bun update @stainless-code/codemap auto-refreshes the content agents see, no re-init needed. See [docs/agents.md](docs/agents.md).

Full reference

# Index project root (optional /config.{ts,js,json}; --state-dir overrides .codemap/)
codemap

# Version (also: codemap --version, codemap -V)
codemap version

# Full rebuild
codemap --full

# SQL against the index (after at least one index run). Bundled agent rules/skills use --json first; omit it for console.table in a terminal.
codemap query --json "SELECT name, file_path FROM symbols LIMIT 10"
# With --json: JSON array on success; {"error":"..."} on stdout for bad SQL, DB open, or query bootstrap (config/resolver)
codemap query "SELECT name, file_path FROM symbols LIMIT 10"
# Query is not row-capped — add LIMIT in SQL for large selects
# Bundled SQL (same as skill examples): fan-out rankings
codemap query --json --recipe fan-out
codemap query --json --recipe fan-out-sample
# Outcome aliases — thin wrappers over `query --recipe `; every query flag passes through.
# Capped at 5 to avoid alias-sprawl.
codemap dead-code --json                                     # → query --recipe untested-and-dead
codemap deprecated --ci                                      # → query --recipe deprecated-symbols --ci
codemap boundaries --format sarif > boundary-findings.sarif  # → query --recipe boundary-violations --format sarif
codemap hotspots --json --group-by directory                 # → query --recipe fan-in (import hubs — not churn×complexity)
codemap coverage-gaps --json --summary                       # → query --recipe worst-covered-exports --json --summary
# Parametrised recipes validate params from .md frontmatter before SQL binding.
codemap query --json --recipe find-symbol-by-kind --params kind=function,name_pattern=%Query%
codemap query --recipe rename-preview --params old=usePermissions,new=useAccess,kind=function --format diff
# Architecture-boundary rules (declare in .codemap/config.ts):
#   boundaries: [{ name: "ui-cant-touch-server", from_glob: "src/ui/**", to_glob: "src/server/**" }]
# Default action is "deny"; the table is reconciled from config on every index pass.
codemap query --recipe boundary-violations --format sarif > boundary-findings.sarif
# Counts only (skip the rows) — pairs well with --recipe for dashboards / agent context windows
codemap query --json --summary -r deprecated-symbols
# PR-scoped: filter result rows to those touching files changed since 
codemap query --json --changed-since origin/main -r fan-out
codemap query --json --summary --changed-since HEAD~5 "SELECT file_path FROM symbols"
# Group rows by directory, CODEOWNERS owner, or workspace package
codemap query --json --summary --group-by directory -r fan-in
codemap query --json --group-by owner -r deprecated-symbols
codemap query --json --summary --group-by package "SELECT file_path FROM symbols"
# Snapshot a result, refactor, then diff (saved inside .codemap/index.db, no JSON files)
codemap query --save-baseline -r visibility-tags                # save under name "visibility-tags"
codemap query --json --baseline -r visibility-tags              # full diff: {baseline, current_row_count, added, removed}
codemap query --json --summary --baseline -r visibility-tags    # counts only: {baseline, current_row_count, added: N, removed: N}
codemap query --save-baseline=pre-refactor "SELECT file_path FROM symbols"   # ad-hoc SQL needs an explicit =
codemap query --baseline=pre-refactor "SELECT file_path FROM symbols"
codemap query --baselines                                       # list saved baselines
codemap query --drop-baseline visibility-tags                   # delete
# --group-by is mutually exclusive with --save-baseline / --baseline (different output shapes)
# Diff per-delta baselines vs current — files / dependencies / deprecated drift in one envelope
codemap query --save-baseline=base-files       "SELECT path FROM files"
codemap query --save-baseline=base-dependencies "SELECT from_path, to_path FROM dependencies"
codemap query --save-baseline=base-deprecated   -r deprecated-symbols
codemap audit --baseline base                                   # auto-resolves base-{files,dependencies,deprecated}
codemap audit --json --summary --baseline base                  # counts-only — useful for CI dashboards
codemap audit --files-baseline base-files                       # explicit per-delta — runs only the slots provided
codemap audit --baseline base --files-baseline hotfix-files     # mixed — auto-resolve deps + deprecated; override files
codemap audit --baseline base --no-index                        # skip the auto-incremental-index prelude (frozen-DB CI)
codemap audit --base origin/main --json                         # ad-hoc — added[].attribution; --summary adds added_introduced/inherited
codemap audit --base origin/main --format sarif                 # emit SARIF 2.1.0 directly (Code Scanning); also: --ci alias
codemap audit --base origin/main --ci                           # CI shortcut: --format sarif + non-zero exit on additions
codemap audit --base v1.0.0 --files-baseline pre-release-files  # mix --base with per-delta override
# --base materialises  via `git archive | tar -x` to .codemap/audit-cache//, reindexes into
# a cached `.codemap/index.db` at that sha, then diffs. Cache hit on second run against same sha is sub-100ms. Requires git;
# non-git projects get a clean `codemap audit: --base requires a git repository.` error.
# Recipes that define per-row action templates append "actions" hints (kebab-case verb +
# description) in --json output; ad-hoc SQL never carries actions. Inspect via --recipes-json.
# --format  — SARIF for GitHub
# Code Scanning; annotations for GH Actions ::notice lines; codeclimate for GitLab Code Quality;
# badge for issue-count summaries; mermaid/diff for graph and edit previews. All
# formatted outputs require a flat row list
# (no --summary / --group-by / baseline). SARIF / annotations / codeclimate / badge
# auto-detect file_path / path / to_path / from_path; rule.id is codemap.
# (or codemap.adhoc). codeclimate/badge skip aggregate-only rows. Mermaid
# requires {from, to, label?, kind?} rows and rejects unbounded inputs (>50 edges) with a
# scope-suggestion error — alias columns via SELECT col AS "from", col2 AS "to".
codemap query --recipe deprecated-symbols --format sarif > findings.sarif
codemap query --recipe deprecated-symbols --ci                    # CI shortcut: --format sarif + non-zero exit + quiet
codemap query --recipe deprecated-symbols --format annotations    # one ::notice per row
# GitLab Code Quality artifact (locatable rows only; flat minor severity):
codemap query --recipe boundary-violations --format codeclimate > gl-code-quality-report.json
# Badge summary for README paste or CI (counts locatable rows only):
codemap query --recipe boundary-violations --format badge
codemap query --recipe boundary-violations --format badge --badge-style json | jq -e '.status == "pass"'
# Render any audit/SARIF output as a markdown PR-summary comment (for repos without
# Code Scanning / aggregate audit deltas / bot-context seeding):
codemap audit --base origin/main --json | codemap pr-comment - | gh pr comment  -F -
codemap query --format mermaid 'SELECT from_path AS "from", to_path AS "to" FROM dependencies LIMIT 50'
codemap query --format diff 'SELECT "README.md" AS file_path, 1 AS line_start, "# Codemap" AS before_pattern, "# Codemap Preview" AS after_pattern'
codemap query --format diff-json 'SELECT "README.md" AS file_path, 1 AS line_start, "# Codemap" AS before_pattern, "# Codemap Preview" AS after_pattern' | jq '.summary'
# --with-fts — opt-in FTS5 virtual table populated at index time. Default OFF (preserves
# .codemap/index.db size); CLI flag wins over .codemap/config.ts `fts5` field. Toggle change
# auto-detects and forces a full rebuild so `source_fts` stays consistent.
codemap --with-fts --full
codemap query --recipe text-in-deprecated-functions    # demonstrates FTS5 ⨯ symbols ⨯ coverage JOIN
# HTTP API — same tool taxonomy as `codemap mcp`, exposed over POST /tool/{name} for
# non-MCP consumers (CI scripts, curl, IDE plugins). Loopback default; --token required on non-loopback.
TOKEN=$(openssl rand -hex 32)
codemap serve --port 7878 --token "$TOKEN" &                 # --token required when --host is not loopback
curl -s -X POST http://127.0.0.1:7878/tool/query \
  -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"sql":"SELECT name, file_path FROM symbols LIMIT 5"}'
# Watch mode — long-running process; debounced reindex on file changes (default 250ms).
# `mcp` / `serve` boot the watcher in-process by default since 2026-05 — every tool
# reads a live index without per-request prelude:
codemap mcp                           # default-ON watcher
codemap serve --port 7878             # default-ON watcher
codemap watch --quiet                 # standalone (decoupled from a transport)
codemap mcp --no-watch                # opt out for one-shot fire-and-forget calls
CODEMAP_WATCH=0 codemap mcp           # env-var opt-out (mirrors --no-watch)
# List recipe catalog (bundled + project-local) as JSON, or print one recipe's SQL (no DB required)
codemap query --recipes-json
codemap query --print-sql fan-out
# `components-by-hooks` ranks by hook count without SQLite JSON1 (comma-based count on the stored JSON array).

# Project-local recipes — drop SQL files into `/recipes/` (default `.codemap/recipes/`) to make them discoverable across the team
# Bundled recipes live in templates/recipes/ in the npm package; project recipes win on id collision
# (shadowing is signalled via a `shadows: true` field in --recipes-json so agents notice the override)
mkdir -p .codemap/recipes   # or: codemap --state-dir .cm --full && mkdir -p .cm/recipes
echo "SELECT path FROM files WHERE language IN ('ts', 'tsx') AND line_count > 500" \
  > .codemap/recipes/big-ts-files.sql
codemap query --recipe big-ts-files                              # auto-discovered alongside bundled

# Targeted reads — precise lookup by symbol name without composing SQL
codemap show runQueryCmd                                        # metadata: file:line + signature
codemap show foo --kind function --in src/cli                   # narrow ambiguous matches
codemap show --query 'kind:function name:Auth path:src/'        # field-qualified discovery
codemap show --query 'kind:function name:foo' --print-sql       # Moat-A SQL transparency
codemap snippet runQueryCmd

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [stainless-code](https://github.com/stainless-code)
- **Source:** [stainless-code/codemap](https://github.com/stainless-code/codemap)
- **License:** MIT

Install and usage instructions live in the source repository linked above.