Loading
Codebase intelligence
MLReps draws it, measures it, and tells you what a change will touch — before you merge. Every answer comes from the code, and says what it could not read.
The scan runs in your CI on a checkout that is already there. Your source never leaves your runner — what is published is the graph it built.
How much of it was read
of resolvable call sites · full · ticks at 70 and 90
What the rest of it leans on
Run against expressjs/express, an open-source project, 2026-09-23
97%
of resolvable call sites read — full
1,244
call sites resolved, 32 we could not follow
141
files, in js
20
findings, 0 of them critical
8,624 more call sites are ones no static tool can resolve — a registry, a string-keyed dispatch — and they are reported beside the ratio rather than counted against it.
Why now
AI writes most of the code now. Volume went up, review capacity did not, and the thing that used to catch defects — a senior who had read the whole system — does not scale to forty pull requests a week.
MLReps connects what you already have — the code, its history, the pull request, the running system — into one picture of how the software actually works, so you can move fast without losing track of it.
Six of eight are built. The page says which two are not.
Observe
the repository as it is — history, coverage, dependencies
Understand
the architecture, the capabilities, and what could not be read
Verify
every number traceable to the fact that produced it
Predict
what an edit reaches before it merges, as a floor
Explain
the same answer in your words, for a reader who does not code
Fix
the steps, in the order they have to happen, in your tree
Optimize
needs runtime telemetry this product does not collect yet
Learn
the lesson under a finding — nothing returns it yet
Radh
Not a chat window over your repository. The answer below is arithmetic over the scan — the same numbers on every other screen — and it is the answer whether or not a language model is connected. A model only ever puts it into a sentence.
What is lib/express.js connected to?
Changing it could reach 117 files — 97 of them directly. A lower bound — some calls resolve for no static tool.
78% of the call sites in lib resolved, so 16 calls in this region were not followed. Anything reached only through those is not listed here.
What it answers, continuously
What is this system shaped like?
Architecture, layering and cycles, drawn from the code rather than a diagram somebody keeps.
What will this change touch?
Every place an edit reaches before it merges — as a floor, with what it leaves out named.
What here is dangerous?
Exposed secrets and untrusted input reaching a sink, ranked by the rule's own severity.
What here is fragile?
Load-bearing code that nothing tests and everything changes.
Which file does what?
Capabilities mapped to the files, routes and stores behind them.
What do I owe?
Debt as an estimate in hours, flagged when it is an under-estimate — never a letter grade.
What it refuses to say
A score it did not measure.
Five of the six indices are uncalibrated, and they say so instead of printing a number.
A map of a codebase it could not read.
Below 70% resolution no picture is drawn at all; between 70 and 90 it is drawn with its gaps named.
That a change is safe.
An empty blast radius means we found nothing, never that nothing is affected.
Anything about a person.
No per-developer score, no leaderboard, and no column anywhere for who dismissed a finding.
A key, a workflow, and the next push to main draws it.