feature-map

A codebase map that shows how product features connect to files, database tables, API endpoints, and user-facing pages. It produces Mermaid diagrams, which are text-based diagrams, plus a written report.

In plain words
What is it for?
Use it to map the whole project or a specific feature, such as payments, and trace that feature from frontend pages through APIs and data storage.
Why use it?
It helps you understand what the software actually contains and how its parts depend on each other. This reduces guesswork when changing or reviewing an unfamiliar project.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/alphaaiservice/cortex/feature-map
Clone the repo
git clone --depth 1 https://github.com/alphaaiservice/cortex
Per session 24 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,382 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00024 $0.03382
Opus 5 $0.00012 $0.01691
Sonnet 5 $0.00005 $0.00676
Haiku 4.5 $0.00002 $0.00338

Measured yesterday against content hash ae646b42b956, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

feature-map scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/feature-map.md · 416 lines

How it starts

The opening of the file, as written. The whole thing — 416 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Feature Map — Codebase Feature Dependency Graph

Map features for: $ARGUMENTS (default: entire project)

Build a complete visual map of all features in the codebase, their dependencies, database tables, API endpoints, and frontend pages. Generates Mermaid diagrams and a text report. Works for ANY stack.

KEY PRINCIPLE: Map what actually exists in the code, not what you assume. Every node in the graph must trace back to real files.


Step 1: Scan for Features

1.1: Detect Project Structure

# Find all route/controller/handler files (API endpoints)
find . -type f \( -name "*route*" -o -name "*controller*" -o -name "*handler*" -o -name "*view*" -o -name "*endpoint*" -o -name "*api*" \) -not -path "*/node_modules/*" -not -path "*/.git/*" -not -path "*/venv/*" -not -path "*/__pycache__/*"

# Find all service/use-case files (business logic)
find . -type f \( -name "*service*" -o -name "*usecase*" -o -name "*use_case*" -o -name "*manager*" -o -name "*provider*" \) -not -path "*/node_modules/*" -not -path "*/.git/*"

# Find all model/entity/schema files (data layer)
find . -type f \( -name "*model*" -o -name "*entity*" -o -name "*schema*" -o -name "*migration*" \) -not -path "*/node_modules/*" -not -path "*/.git/*"

# Find all frontend pages/components
find . -type f \( -name "page.*" -o -name "Page.*" -o -name "*.page.*" \) -not -path "*/node_modules/*" -not -path "*/.git/*"
find . -type d \( -name "pages" -o -name "views" -o -name "screens" \) -not -path "*/node_modules/*" -not -path "*/.git/*"

1.2: Identify Features

Group files into features using directory structure and naming patterns:

Feature Detection Heuristics:
  Directory-based:    auth/, users/, payments/, products/, search/, etc.
  File-prefix-based:  auth.service, user.controller, payment.model
  Route-based:        /api/auth/*, /api/users/*, /api/products/*
  Table-based:        users, products, orders, payments tables

For each feature, collect:

FEATURE: [Name]
  Description: [What this feature does — inferred from code]

  Database:
    Tables/Collections: [list with key columns]
    Migrations: [migration files]

  Backend:
    Models/Entities: [file paths]
    Repositories/DAL: [file paths]
    Services: [file paths]
    Controllers/Routes: [file paths]
    Middleware: [file paths, if any]
    DTOs/Schemas: [file paths]

  API Endpoints:
    [METHOD] [path] — [purpose]

  Frontend:
    Pages: [file paths]
    Components: [file paths]
    State/Store: [file paths]
    API Client: [file paths]

  External Dependencies:
    APIs: [third-party APIs used]
    SDKs: [external SDKs]
    Services: [external services — Stripe, SendGrid, etc.]

  Internal Dependencies:
    Depends on: [other features this feature imports/calls]
    Depended by: [other features that import/call this feature]

Read the full file on GitHub · 416 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 416 lines · 24 tokens per session scan A ae646b42b956

Subscribe to this mod's changes

feature-map is a command published in the GitHub repository alphaaiservice/cortex (1 stars, last pushed 25d ago), licensed MIT. It adds 24 tokens to every session and 3,382 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.