hotspots

A code-analysis command that ranks files or symbols by how often they change and how complex they are. A symbol is a code unit such as a function or class.

In plain words
What is it for?
Use it in a Git repository with a code index to find refactoring priorities, optionally filtering by date, change count, comparison reference, or file-versus-symbol scope.
Why use it?
It helps identify parts of a codebase where frequent changes and complexity make bugs and refactoring work more likely.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/agentis-tools/ctx/hotspots
Clone the repo
git clone --depth 1 https://github.com/agentis-tools/ctx
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 495 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.00495
Opus 5 $0.00000 $0.00247
Sonnet 5 $0.00000 $0.00099
Haiku 4.5 $0.00000 $0.00049

Measured 2d ago against content hash dcdf38108e0e, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

hotspots scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

docs/commands/hotspots.md · 67 lines

What it actually says

ctx hotspots

Rank files and symbols by churn x complexity to find refactoring hotspots.

Synopsis

ctx hotspots [OPTIONS]

Description

The hotspots command combines git history (how often code changes) with index metrics (how complex it is) to rank the places where refactoring pays off most. Code that is both complex and frequently touched is where bugs cluster and where extraction into smaller modules helps first.

Prerequisites

Requires a git repository and an index:

ctx index

Options

Option Description Default
--since <SPEC> Git date spec bounding the churn window (e.g. "6 months ago", 2025-01-01) 6 months ago
--limit <N> Maximum number of results 20
--by <SCOPE> Rank by file or symbol file
--min-churn <N> Ignore entries with fewer than N commits in the window 2
--against <REF> Only rank files changed relative to REF none
--json Machine-readable output (global flag) false

Exit Codes

Code Meaning
0 Success (informational command)
2 Operational error (not a git repo, missing index, bad git ref)

Examples

# Top refactoring candidates over the last 6 months
ctx hotspots

# Symbol-level hotspots in the last quarter
ctx hotspots --since "3 months ago" --by symbol --limit 10

# Only files touched by the current branch
ctx hotspots --against main

# Machine-readable (standard envelope: ctx_version, command, generated_at, data)
ctx hotspots --json

Caveats

  • Churn counts commits per file from git log; renames are not followed, so a renamed file's history restarts.
  • Complexity uses the shared fan-in/fan-out formula from the index; dynamic calls and macro-generated code are not tracked.

See Also

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 67 lines · 0 tokens per session scan A dcdf38108e0e

Subscribe to this mod's changes

hotspots is a command published in the GitHub repository agentis-tools/ctx (11 stars, last pushed 15d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 495 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.