Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add roedyrustam/vibes-plug --skill living-codebase-ast-graphgit clone --depth 1 https://github.com/roedyrustam/vibes-plugWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/roedyrustam/vibes-plug/living-codebase-ast-graph)<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/living-codebase-ast-graph"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/living-codebase-ast-graph/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/roedyrustam/vibes-plug/living-codebase-ast-graph"><img src="https://agentmods.dev/badge/skills/roedyrustam/vibes-plug/living-codebase-ast-graph.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.02608 |
| Opus 5.5 | $0.00030 | $0.01043 |
| Sonnet 5.5 | $0.00015 | $0.00522 |
| Haiku 4.5 | $0.00008 | $0.00261 |
Grade A, and why
living-codebase-ast-graph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 247 lines — stays where its author put it; the contents beside it link to each section on GitHub.
living-codebase-ast-graph — vibes-plug Skill
English
Orchestration & Integration
- Upstream & Orchestration:
zero-to-prod-orchestrator(Phase 2 foundation & Phase 6 QA),brainstorming,session-memory-manager. - AST Manipulation & Type Systems:
typescript-expert(TS compiler API & symbol binding),autonomous-api-drift-healer(API contract drift blast radius). - Architecture & Refactoring:
scalability-clean-code(Clean Architecture boundary enforcement),legacy-code-translator(strangler migration AST mapping),monorepo-architect(cross-package dependency graphs). - Code Health & Debt Auditing:
zero-tech-debt-auditor(dead symbol & unreachable code eradication),anti-slop(AST anti-slop verification).
Description
Production guide for constructing and querying in-memory Abstract Syntax Tree (AST) knowledge graphs across multi-file and monorepo codebases. Enables autonomous agents to navigate complex symbol relationships, calculate refactoring blast radii, eliminate circular dependencies, determine optimal topological generation sequences, and prune unreachable code without relying on fuzzy string matching.
Trigger Conditions
Activate this skill when:
- Executing large-scale codebase refactoring or renaming symbols across multiple packages.
- Analyzing architectural blast radius before making breaking changes to data models or API signatures.
- Detecting and resolving circular dependencies in TypeScript, JavaScript, Python, or Go codebases.
- Ordering code generation tasks topologically so underlying dependencies are created before dependent modules.
- Identifying dead exports, unreferenced functions, and ghost imports with absolute precision.
Core Concepts & Patterns
1. In-Memory AST Dependency Extractor (TypeScript Compiler API)
import ts from 'typescript';
import fs from 'fs';
import path from 'path';
export interface SymbolNode {
filePath: string;
name: string;
kind: 'function' | 'class' | 'interface' | 'variable' | 'type';
dependencies: string[];
}
export interface CodebaseGraph {
nodes: Map<string, SymbolNode>;
edges: Map<string, Set<string>>;
}
export class LivingCodebaseASTGraph {
private program: ts.Program;
private checker: ts.TypeChecker;
private graph: CodebaseGraph;
constructor(rootFiles: string[], options: ts.CompilerOptions = {}) {
this.program = ts.createProgram(rootFiles, {
target: ts.ScriptTarget.ES2022,
module: ts.ModuleKind.NodeNext,
...options
});
this.checker = this.program.getTypeChecker();
this.graph = {
nodes: new Map(),
edges: new Map()
};
this.buildGraph();
}
private buildGraph(): void {
for (const sourceFile of this.program.getSourceFiles()) {
if (sourceFile.isDeclarationFile || sourceFile.fileName.includes('node_modules')) {
continue;
}
this.analyzeSourceFile(sourceFile);
}
}
private analyzeSourceFile(sourceFile: ts.SourceFile): void {
const filePath = path.resolve(sourceFile.fileName);
ts.forEachChild(sourceFile, (node) => {
if (ts.isFunctionDeclaration(node) && node.name) {
this.registerSymbol(filePath, node.name.text, 'function', node);
} else if (ts.isClassDeclaration(node) && node.name) {
this.registerSymbol(filePath, node.name.text, 'class', node);
} else if (ts.isInterfaceDeclaration(node) && node.name) {
this.registerSymbol(filePath, node.name.text, 'interface', node);
}
});
}
private registerSymbol(
filePath: string,
name: string,
kind: SymbolNode['kind'],
node: ts.Node
): void {
const symbolKey = `${filePath}#${name}`;
const dependencies: string[] = [];
const visit = (child: ts.Node) => {
if (ts.isIdentifier(child)) {
const symbol = this.checker.getSymbolAtLocation(child);
if (symbol && symbol.declarations && symbol.declarations.length > 0) {
const declFile = symbol.declarations[0].getSourceFile().fileName;
if (!declFile.includes('node_modules') && !declFile.endsWith('.d.ts')) {
const targetKey = `${path.resolve(declFile)}#${symbol.getName()}`;
if (targetKey !== symbolKey) {
dependencies.push(targetKey);
}
}
}
}
ts.forEachChild(child, visit);
};
visit(node);
this.graph.nodes.set(symbolKey, { filePath, name, kind, dependencies });
if (!this.graph.edges.has(symbolKey)) {
this.graph.edges.set(symbolKey, new Set(dependencies));
}
}
public calculateBlastRadius(symbolKey: string): string[] {
const affected = new Set<string>();
const queue = [symbolKey];
while (queue.length > 0) {
const current = queue.shift()!;
for (const [nodeKey, deps] of this.graph.edges.entries()) {
if (deps.has(current) && !affected.has(nodeKey)) {
affected.add(nodeKey);
queue.push(nodeKey);
}
}
}
return Array.from(affected);
}
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -22 lines f91a5245ec6d
- yesterday Changed · +1 lines 237b85923a4f
- 4d ago Changed 92ad0ad9efd5
- 13d ago Changed c7f211fea1a7
- 18d ago First seen · 268 lines · 76 tokens per session scan A c690bc1af477
living-codebase-ast-graph is a skill published in the GitHub repository roedyrustam/vibes-plug (111 stars, last pushed today), licensed MIT. It adds 76 tokens to every session and 2,608 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.
Other skills, from other repositories
code-review-and-quality
Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch. Use when asked to review a diff or a pull request, even when the diff is pasted…
doubt-driven-development
Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when you want every assumption cross-examined before proceeding, when stress-testing a plan for hidden failure modes, when correctness matters more than speed, when working in unfamiliar code, when stakes are high…
code-simplification
Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.
code-review
Structured code review focusing on correctness, security, and maintainability. Correctness before style. Every reviewer comment must be actionable.
the-judge
Evidence-first pull request judge that reviews a PR and posts one consolidated GitHub review with inline comments via the gh CLI. Runs the repo's own deterministic checks first, researches current official docs before any claim about external libraries or APIs, then reviews correctness, security, structural quality…
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities". Do NOT use for accessibility (use web-accessibility), SEO (use seo), performance (use…