Understand Anything - Moses Yebei

Abstract

Graphs that teach > graphs that impress. Turn any code into an interactive knowledge graph you can explore, search, and ask questions about. Works with Claude Code, Codex, Cursor, Copilot, Gemini CLI, and more.

The Problem

Onboarding onto an unfamiliar codebase means reading thousands of files blind. You need to know which modules are load-bearing, how functions call each other, and where business logic lives, but static navigation tools only show you file trees. The result is hours of manual tracing before you can make a confident change.

What This Does

Understand Anything builds an interactive knowledge graph of your codebase. It analyzes files, functions, classes, and dependencies via a multi-agent pipeline, then renders the result in a dashboard you can search, pan, and query. The core logic lives in understand-anything-plugin/packages/core/, with language-specific extractors in src/plugins/extractors/ (C++, C#, Go, Java, PHP, Rust, Ruby, and more) and a React dashboard in understand-anything-plugin/packages/dashboard/.

It ships as a plugin for Claude Code, Codex, Cursor, Copilot, and Gemini CLI via the .claude-plugin/ and .copilot-plugin/ manifests. A marketing homepage in homepage/ (Astro) documents the project.

How It Is Wired

Execution starts in the dashboard's DashboardContent (packages/dashboard/src/App.tsx:220), which renders the React frontend. The core analysis pipeline begins with registerAllParsers (packages/core/src/plugins/parsers/index.ts:31), which registers 12 parser plugins. The init function in tree-sitter-plugin.ts:124 bootstraps the tree-sitter parser.

The graph builder (packages/core/src/analyzer/graph-builder.ts) is the central orchestrator. It calls detectLanguage, basename, addFile, and addFileWithAnalysis to construct nodes and edges. Persistence is handled by loadGraph and saveDomainGraph in packages/core/src/persistence/index.ts:85,152, which read and write graph files to disk—the only external I/O besides file reads in the extractors.

The most-connected modules are the type definitions: languages/types.ts (58 modules depend on it) and types.ts (48). Both are stable hubs with zero outgoing dependencies. The highest-churn functions are findChild (called from 32 places), useI18n (23), and parse (18). The I18nContext.tsx file is the UI's central dependency, imported by 21 other files.

Two modules participate in a circular import cycle: packages/dashboard/src/utils/elk-layout.ts and layout.ts. This complicates refactoring of the layout code.

How To Use It

The repo provides install scripts for the plugin:

# For Claude Code
/plugin marketplace add https://github.com/moses-y/Understand-Anything

# Or run the install script
./install.sh

After installation, run the plugin's scan command in your project to generate the graph, then open the dashboard. The understand-anything-plugin/package.json defines the plugin's dependencies and scripts. No environment variables are documented in the repo.

Real-World Use

A developer joining a 200,000-line TypeScript monorepo runs the plugin once. The dashboard shows that findChild is called from 32 places, immediately flagging it as high-risk for changes. The domain view maps the payment module to the checkout flow, letting them trace a bug from UI to service layer without reading every file.

Code Health & Issues

Static analysis found 42 findings: 9 high, 33 medium, 0 low.

High - Hub modules: languages/types.ts and types.ts each have 50+ dependents. Changes ripple widely.
High - Oversized files: dashboard/src/store.ts (642 lines) and GraphView.tsx are hard to navigate.
High - Import cycle: elk-layout.ts and layout.ts in the dashboard utils.
High - Duplicated code: 344 repeated 6-line blocks across 81 files.
High - Deep nesting: FilterPanel.tsx, ThemePicker.tsx, WarningBanner.tsx hit indentation depth 6.
Medium - High branching density in base-extractor.ts, registry.ts, language-registry.ts.

The security audit found one high issue: third-party GitHub Actions pinned to tags (pnpm/action-setup@v4) instead of commit SHAs. Medium issues include missing least-privilege token permissions, no Dependabot, no dependency vulnerability scan in CI, and two 8-10MB GIFs committed to the repo.

The Bottom Line

A practical tool for codebase onboarding with solid multi-language support and a polished dashboard. The heavy use of tree-sitter extractors and the centralized type definitions make the core maintainable, but the dashboard's oversized files and import cycle need attention. Teams adopting Claude Code or similar agents will get the most value; standalone users may find the plugin setup overhead unnecessary.

What the analyser found

Deployment readiness

7/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

412 files

TypeScript178
Markdown105
TSX36
JSON25
YAML11
Python6

ReactFlaskFastAPIExpressSpringDocker

Module dependencies

The 10 most depended-upon modules of 236, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_ges_core_src_languages_types["types"] n1_ugin_packages_core_src_types["types"] n2_packages_dashboard_src_store["store"] n3_ard_src_contexts_I18nContext["I18nContext"] n4_src_plugins_extractors_types["types"] n5_ns_extractors_base_extractor["base-extractor"] n6_ackages_core_src_fingerprint["fingerprint"] n7_es_core_src_plugins_registry["registry"] n8_d_src_components_LayerLegend["LayerLegend"] n9_gin_packages_core_src_schema["schema"] n6_ackages_core_src_fingerprint --> n1_ugin_packages_core_src_types n6_ackages_core_src_fingerprint --> n7_es_core_src_plugins_registry n5_ns_extractors_base_extractor --> n4_src_plugins_extractors_types n4_src_plugins_extractors_types --> n1_ugin_packages_core_src_types n7_es_core_src_plugins_registry --> n1_ugin_packages_core_src_types n8_d_src_components_LayerLegend --> n2_packages_dashboard_src_store n8_d_src_components_LayerLegend --> n3_ard_src_contexts_I18nContext

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high1

medium5

low2

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

pnpm/action-setup@v4

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

5 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium2 occurrences

homepage/public/images/overview-structural.gif

2 blobs over 5MB: overview-structural.gif 10.0MB, overview-domain.gif 8.0MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set persist-credentials: false on checkoutmedium

.github/workflows/ci.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.