graph

A single HTML file that maps the structure of a whole codebase as an interactive diagram. A codebase is the collection of source files in a project; the diagram groups its symbols, such as functions, methods, structs, and traits, by module and shows their connections.

In plain words
What is it for?
Use it to explore modules, find highly connected symbols, inspect calls or other relationships, and see when code was added. It can display the whole index or one module family and can reuse a saved data dump.
Why use it?
It makes relationships and growth in a large codebase easier to inspect than reading files one by one. Search, filtering, connection highlighting, and date ranges help narrow the view.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/bartolli/codanna/graph
Any agent
npx skills add bartolli/codanna --skill graph
Clone the repo
git clone --depth 1 https://github.com/bartolli/codanna

Made for: Claude Code, Codex.

Per session 131 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,271 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00131 $0.02271
Opus 5 $0.00066 $0.01136
Sonnet 5 $0.00026 $0.00454
Haiku 4.5 $0.00013 $0.00227

Measured 2d ago against content hash fec5d903a93f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

graph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 23 executable files (graph.mjs, lib/adapter.mjs, lib/dates.mjs, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/plugins/claude/codanna-toolset/skills/graph/SKILL.md · 91 lines

How it starts

The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.

What it draws

One HTML file, no server: the codanna index rendered as a pie chart of symbols. Each top-level module owns a wedge sized by its share; inside a wedge symbols fill rings from the centre outwards, best-connected first, so hubs sit near the middle and leaves on the rim. Unlinked symbols form their own inner group. Above the disc a heatmap shows symbols added per day (each symbol dated by the oldest surviving line of its span, via git blame). Hover or click a symbol to see its edge web and the connected symbols; the legend hides (eye) or highlights (label) modules and submodules; the ribbon under the heatmap brushes a date range (drag its handles, use the date fields, or click a year chip) and Refresh replays the codebase growing oldest-first.

Run

node ${CLAUDE_SKILL_DIR}/graph.mjs                      # whole index, Calls edges, default kinds
node ${CLAUDE_SKILL_DIR}/graph.mjs --root crate::indexing   # one module family
node ${CLAUDE_SKILL_DIR}/graph.mjs --relation calls,uses,implements,extends
node ${CLAUDE_SKILL_DIR}/graph.mjs --kinds function,method,struct,trait --dates none --light
  • Runs codanna dump in the project (--from graph.jsonl reuses a saved dump, --binary PATH picks the binary)
  • Output: .codanna/visualizations/graph-disc-<timestamp>.html, opened in the browser (--no-open to skip, --out FILE to place it)
  • --group <wedge>[/<tint>] -- wedge axis module (default), language, or kind; tint axis module (default), kind, or visibility. The wedge is the angle (share, neighbours adjacent); the tint is the legend tree inside it (three biggest get their own shade, the rest pool). module/kind keeps the structure and shows what each module is made of; language/module for polyglot indexes; module/visibility for API surface per module; kind/module is a census (edges cross everywhere)
  • --root PREFIX scopes to a module prefix (crate:: is dropped, ./::// all separate segments); applies to the module segments whatever the wedge axis
  • --kinds defaults to Function, Method, Struct, Class, Trait, Enum, Interface, TypeAlias, Constant, Macro
  • --relation defaults to calls; any of calls, uses, implements, extends, defines, comma-separated
  • --dates blame|git|none -- blame (default) dates every symbol by the oldest surviving line of its span (git blame -M over the working tree; per-file JSON cache at .codanna/visualizations/dates-cache.json keyed by content hash, so warm runs spawn no blame -- delete the file to reset); git uses the file's first-commit day (cheap, but a refactor reads as mass birth); none leaves the timeline and heatmap empty
  • --unlinked include|drop -- drop removes symbols with no edge over the chosen relations at build time (smaller file, smaller disc); in the page, the legend eye on (unlinked) hides the same set with the cascade animation
  • --name NAME sets the title (default: project directory name); --light builds the light theme

Read the full file on GitHub · 91 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 91 lines · 131 tokens per session scan A fec5d903a93f

Subscribe to this mod's changes

graph is a skill published in the GitHub repository bartolli/codanna (729 stars, last pushed 3d ago), licensed Apache-2.0. It adds 131 tokens to every session and 2,271 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

use-ivygrep

Gather focused local repository context with ivygrep before implementing, debugging, reviewing, or explaining code. Use for coding tasks involving unfamiliar paths, branch changes, stack traces, architectural relationships, callers, dependents, tests, configuration, or documentation. Prefer one bounded context pack…

bvolpato/ivygrep · 65 tokens

codemeridian-test-planning

Plan focused tests with CodeMeridian by finding relevant test shields, coverage gaps, impacted behavior, and the smallest useful test set before implementation.

Driftya/code-meridian · 35 tokens

codemeridian-context

Gather minimal, graph-grounded CodeMeridian context before implementation, refactoring, deletion, debugging, or test planning.

Driftya/code-meridian · 29 tokens

codemeridian-frontend

Route frontend HTML/CSS/SCSS work through CodeMeridian's generic frontend-aware tools first, then use cascade and style-duplicate analysis only when the question is truly frontend-specific.

Driftya/code-meridian · 43 tokens

codemeridian-refactor

Plan safer refactors with CodeMeridian by checking graph freshness, exact symbols, impact, tests, duplication, and architecture risk before editing.

Driftya/code-meridian · 34 tokens

human-cognitive-seed

Preserve and strengthen the user's independent reasoning during design, strategy, learning, interpretation, hypothesis work, and consequential decisions, and preserve justified durable context with explicit provenance when supported. Use when a task benefits from human-led judgment, model-building, productive…

Driftya/code-meridian · 99 tokens