ripwire - Moses Yebei

Abstract

The ripgrep of AI context: a zero-dependency C++23 CLI + MCP server giving coding agents a ranked, deterministic map of any repo, blast radius, tests-to-run and quality deltas. Signatures at 80% fewer bytes than bodies; ~5% of a grep-and-read pass's tokens.

The Problem

Coding agents burn tokens grepping a repository and reading whole files to answer one question: what do I touch, what breaks, and which tests prove it? ripwire replaces that pass with a ranked, deterministic call graph — signatures at 80% fewer bytes than bodies, roughly 5% of a grep-and-read pass's tokens — so the agent gets a map before it reads anything.

What This Does

ripwire is a zero-dependency C++23 CLI plus an optional MCP server. It parses 21 languages via vendored tree-sitter grammars (src/, 154 files) and emits a ranked symbol list with per-symbol risk: complexity, git churn, change amplification (touch ingest and 266 graph nodes feel it), purity, and test coverage. Output is a token-budgeted answer or a self-contained HTML call-graph (--html, no CDN).

The skills/ folder (24 files) installs task-shaped agent skills so Claude Code, Codex, Cursor, Windsurf, Gemini, opencode, and aider know when to invoke the tool. bench/ (299 files) is a serious evaluation harness — head-to-head runs against other repo tools with preregistered protocols (bench/headtohead/r3-headroom-2026-08-03/PREREGISTRATION.md) and an agent-loop edit suite (bench/agentloop/editsuite/).

How It Is Wired

The static analysis mapped 189 internal modules but resolved only 13 import edges — all in test/ fixtures, zero circular dependencies. That means the core src/ call graph has not been traced by this pipeline; I won't invent it. What is grounded: the install script (scripts/install.sh) drops a single binary and activates skills for every agent on the machine; the MCP endpoint is configured via .mcp.json and .codex-plugin/plugin.json; CMakeLists.txt builds the binary. The bench fixtures (bench/h4fixtures/*/main.*) are language parsers' test inputs, not the product entry point.

How To Use It

The README documents both steps verbatim:

RIPWIRE_REPO=redhat-et/ripwire bash -c "$(curl -fsSL https://raw.githubusercontent.com/redhat-et/ripwire/main/scripts/install.sh)"
ripwire . --for="incremental cache invalidation"

That second line answers in ~4.3K tokens: ranked symbols with doc comments quoted in place, risk annotated, and one-hop call context. No API key, no embeddings, no daemon. The MCP server is the optional second interface.

Real-World Use

Before editing ingest in this repo, an agent runs ripwire . --for="incremental cache invalidation". The output ranks kCacheMagic first, flags ingest as high-churn (128 recent edits) with 266 downstream graph nodes affected, and names the tests that reach it. The agent edits with a blast-radius map instead of guessing.

Code Health & Issues

Static analysis found 1,009 findings (250 high, 758 medium, 1 low), one kind: deep nesting ×60 in three bench files (bench/bench_sort_large.cpp, bench/bench_svector_diff.cpp, bench/bench_svector_wave.cpp), max indentation depth 17. Fix: early returns and extracted inner blocks.

SDLC audit (7 findings, 0 critical):

High — GitHub Actions pinned to tags, not commit SHAs (.github/workflows, e.g. softprops/action-gh-release@v2). Tags can be moved; pin to SHA.
High — continue-on-error on a correctness step (.github/workflows/ci.yml:107) lets failing tests report green.
Med — No least-privilege GITHUB_TOKEN declaration in CI.
Med — No Dependabot/Renovate; advisories sit unpatched.
Med — No dependency vulnerability scan in CI.
Med — 12 blobs over 5MB in third_party/deps/csharp/src/parser.c (28.3MB, 26.9MB, 19.7MB); every clone pays for them.
Low — No timeout-minutes on CI jobs.

Tests, CI, license, and lockfile are present; no committed secrets. present/ declares typescript (2 majors behind) and react (1 major behind), but that's the showcase deck, not the product.

The Bottom Line

Serious engineering: honest benchmarks with preregistered protocols, a real token-budget story, and a clean zero-dependency design. The CI hygiene gaps are exactly the kind a consultant flags before production. Use it if your agents spend real tokens mapping unfamiliar repos; the bench suite alone is worth reading.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

2,023 files

Shell598
C/C++ Header372
C++191
Markdown153
Python143
JSON77

ReactFlaskExpressCUDA

Module dependencies

The 10 most depended-upon modules of 189, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_t_impactimportfix_lib_Widget["Widget"] n1_test_extvetofix_own["own"] n2_importprecisefix_rel_sibling["sibling"] n3_test_tsimportprecisefix_a_b["b"] n4_tsimportprecisefix_idx_index["index"] n5_t_tsimportprecisefix_other_x["x"] n6_test_tsimportprecisefix_x["x"] n7_st_tsimportprecisefix_caller["caller"] n8_test_extvetofix_ext["ext"] n9_st_impactimportfix_lib_alpha["alpha"] n8_test_extvetofix_ext --> n1_test_extvetofix_own n9_st_impactimportfix_lib_alpha --> n0_t_impactimportfix_lib_Widget n7_st_tsimportprecisefix_caller --> n6_test_tsimportprecisefix_x n7_st_tsimportprecisefix_caller --> n3_test_tsimportprecisefix_a_b n7_st_tsimportprecisefix_caller --> n4_tsimportprecisefix_idx_index

Dependencies

2 of 5 declared dependencies are a major version behind. Resolved 5 of 5 against the registry.

Package	Declared	Latest	Behind
`typescript`	^5.4.0	7.0.2	2 major
`react`	^18.2.0	19.2.8	1 major

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium4

low1

Pin third-party GitHub Actions to a commit SHAhigh

.github/workflows

softprops/action-gh-release@v2

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Remove continue-on-error from steps that gate correctnesshigh

.github/workflows/ci.yml

line 107 on a correctness step

A failing test suite reports a green check, which is precisely the path this audit exists to close.

Fix: Delete continue-on-error, or move a genuinely advisory step into a separate non-required job.

Declare least-privilege permissions for GITHUB_TOKENmedium

.github/workflows/ci.yml

1 workflow(s) declare no permissions

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

1 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Move large binaries to Git LFS or out of the repositorymedium12 occurrences

third_party/deps/csharp/src/parser.c

12 blobs over 5MB: parser.c 28.3MB, parser.c 26.9MB, parser.c 19.7MB

One repository here carries twenty blobs over 5MB including a 10.9MB spreadsheet, so every clone and every CI checkout pays for data nobody diffs.

Fix: Track those extensions with LFS, or move datasets to object storage and fetch them in a setup step.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/ci.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.