Code Maps has one idea: put every number you already collect about a codebase into a place you can point at. Here is what that gives you.
One repository, drawn once. Every folder that contains code becomes a building; the first meaningful segment of its path becomes a district with its own plate, colour and name. Nothing is randomly placed: the same repository always produces the same city, so you learn its skyline.
Hover each element and watch it in the city. It is the same city the app draws.
Día reads like a topographic survey sheet. Noche keeps the ground dark and lights only the windows. Neón turns on bloom, which is useless for work and very good in a demo room.
openclaw/openclaw in the Neón theme: 578 buildings, grade C. The diamonds are possible secrets; the repository was truncated at 15.000 files.
The façade colour answers one question at a time. Switching lens keeps every building exactly where it was, which is the whole point: you are comparing four answers about the same place.
Hover each element and watch it in the city. It is the same city the app draws.
Each building radiates its value onto the ground, and each district plate is tinted by the average and the peak of the buildings standing on it. Risk stops being a number in a list and becomes a stain you can see spreading.
Press 2D and the camera goes straight overhead. The skyline disappears and the heat reads as a clean thermal map of the repository — the fastest view for a slide or a screenshot.
The same repository from directly overhead. With the skyline gone, the heat layer reads as a thermal map of where risk collects.
Everything on the buildings comes from a tool that actually ran, or from a heuristic that is written down. There is no model guessing at severity.
Trivy over manifests and lockfiles (npm, yarn, pnpm, pip, poetry, go.mod, Cargo, pom, gradle) and over Dockerfiles, compose, Kubernetes and Terraform. For Java without a lockfile it also scans the jars in build/libs.
gitleaks with its default rules, skipping build, logs, node_modules, target, dist, .gradle and .git. Only the rule name and the file:line are kept. The matched value never leaves the scanner.
TODO FIXME HACK XXX as low; files over 500 lines as medium; more than 0,25 branches per line in files longer than 50 lines as medium. Hours: 1 per medium, 4 per high.
Commits × complexity in the top 5% of the repository, counted as high. This is the single measurement most worth acting on: it is where change and difficulty meet.
Every finding with its file and line, the module's lines, files, complexity and commit count, its imports and importers as clickable chips, and buttons to open the folder on GitHub, in Finder, or in your editor at the exact line.
Last changed 18/09/2026. Imports from 1Used by 1
12 Critical 48 High
Click to open · double-click to enterpackages/react-reconciler/src: 47,019 lines, complexity 7,473, a hotspot, with every finding linked to its file and line.
Code Maps does not compete with your scanners: it gives them a map. Besides what it runs on its own, it reads the reports of the tools you already use and puts every finding on its building.
Runs by itself, locally, with nothing to configure.
Available today. Drop your tool's .sarif into .codemap/ and analyse again. With a security-severity it counts as security; without one, as debt.
snyk code test --sarif-file-output=.codemap/snyk.sarif
semgrep scan --sarif -o .codemap/semgrep.sarifA direct connection, no files in between. It does not exist yet.
Tested end to end with a sample SARIF 2.1.0 report. Secret values are never read: from a secret scanner only the rule and file:line come through.
Available today
Trivy's and gitleaks' as they ship, plus the debt heuristics. And any other tool's, through its SARIF report.
Coming soon
Your .gitleaks.toml, your Semgrep rule packs and your suppressions, applied to all your repositories from one place.
Coming soon
Custom rules over what the map already measures: "no building above 40 complexity without tests", "nothing in billing/ imports from web/".
* Requires a paid Code Maps Cloud plan, which does not exist yet. Pricing →
One node per module, one edge per import resolved inside the repository — external packages do not count. Nodes are grouped into regions by district. Hover shows the direction of every relationship with arrows; node size can follow complexity, lines or risk; edges can be all, between districts only, or hidden. Click a district name to zoom, double-click to enter.
langchain-ai/langchain as a constellation: hovering runnables shows the 13 modules it imports in orange and the 99 that import it in blue.
One panel that grades the whole repository, or whatever slice of it you are currently looking at. Counts by severity, estimated debt hours, the district list with findings per district, and the hotspot list. Click a severity row to isolate those buildings; export every finding to CSV.
Start at 100. Subtract up to 50 for 4 × critical + 1.5 × high + 0.3 × medium, up to 20 for 0.2 × secrets, and up to 30 for 3 × debt hours per 1,000 lines. The caps exist so one catastrophic category cannot hide everything else. It is a heuristic for comparing repositories at a glance, not a compliance standard.
Click a row to isolate those buildings.
The inspection report for react/react: 47 out of 100, grade D, driven by 215 unpatched critical vulnerabilities.
The chat runs against the Anthropic API with five tools: get_findings, get_module, read_file, search_code and highlight_buildings. The AI reads the real code and the real findings before it claims anything.
What should I fix first?
Start with the dependency wall. tomcat-embed-core 10.1.52 carries two auth-bypass CVEs; moving to 10.1.58 clears both.
Then Thymeleaf: the SSTI reachable from any user-controlled template is declared in pom.xml:64.
After that, the two secrets in src/main/resources/application.yml:14 — rotate them before you touch anything else.
(root) · pom.xmlweb/templatesmain/resources
The AI explaining the layers of react/react, naming the real packages and line counts it read on the way.
?repo=…&view=…&lens=…&scope=…&sel=…&cam=…&theme=… — reload or share the link and you get exactly the same view back..repos/, one folder per repository, with the analysis and findings beside them. A repo you have seen before loads instantly; Re-analyse rebuilds it from scratch.react/react, langchain-ai/langchain or your own path. Nothing is uploaded and no account is needed.