weavatrix-rust

Turn a repository into evidence your Rust code can trust.

weavatrix-rust maps a codebase into a deterministic, typed evidence graph with exact source provenance. It then answers impact, architecture, API, health, history, search, semantic, and temporal-memory questions without executing the repository it analyzes.

Use the crate to:

• embed repository analysis in a Rust application;
• produce a serializable Snapshot for CI, indexing, or review systems;
• run 39 bounded read-only operations over repository and graph evidence in the default full build;
• run the standalone weavatrix-rust CLI.

This crate is an engine, not an MCP server. Protocol transport, npm packaging, client profiles, and filesystem watching belong to the separate weavatrix product.

What the crate gives you

Release evidence:

Use this engine through MCP

The canonical weavatrix product wraps this crate with MCP stdio, profile discovery, incremental refresh, and native filesystem watching:

npx -y weavatrix mcp .

Or compile the same adapter from crates.io:

cargo install weavatrix
weavatrix mcp .

Codex configuration:

[mcp_servers.weavatrix]
command = "npx"
args = ["-y", "weavatrix", "mcp", ".", "--profile=code"]

Claude Code:

claude mcp add weavatrix -- \
  npx -y weavatrix mcp . --profile=code

The MCP product delegates its catalog and every operation call to this engine. The weavatrix-rust crate itself remains protocol-independent and does not open stdio or start a watcher.

Embed it as a Rust library

Choose the smallest feature set your application needs:

[dependencies]
weavatrix-rust = { version = "2.0.0", default-features = false }

use std::path::Path;
use weavatrix_rust::{Analyzer, AnalyzerConfig};

let snapshot = Analyzer::new(AnalyzerConfig::default())
    .analyze(Path::new("."))?;

println!(
    "{} nodes, {} edges, {} diagnostics",
    snapshot.nodes.len(),
    snapshot.edges.len(),
    snapshot.diagnostics.len()
);

# Ok::<(), weavatrix_rust::Error>(())

Call the same bounded operation catalog used by the MCP product:

use weavatrix_rust::{Weavatrix, operations};

let mut engine = Weavatrix::open(".")?;
let result = operations::call(
    &mut engine,
    "graph_stats",
    blazingly_json::json!({}),
)?;

println!("{}", blazingly_json::to_string_pretty(&result)?);

# Ok::<(), Box<dyn std::error::Error>>(())

The minimal build retains the analyzer, lossless parsing, scanner, graph, snapshot model, standalone analyze, list-tools, and tool commands:

cargo check --no-default-features
cargo run --no-default-features --bin weavatrix-rust -- analyze . --pretty

Architecture

repository path or SourceInput[]
             |
             v
 language + contract adapters
             |
             v
      analysis pipeline
             |
             v
 evidence model + Snapshot
             |
             v
      repository engine
             |
             v
 read-only operations --> Rust facade
                     \--> standalone CLI

The engine composes focused first-party crates:

Feature selection

The default feature set is the complete native engine: full + lang-rust. Embedders can disable default features and enable only the analysis components they use.

[dependencies]
weavatrix-rust = {
    version = "2.0.0",
    default-features = false,
    features = ["lang-rust", "git", "search"]
}

Disabled capabilities disappear from the operation catalog; they are not advertised as unavailable stubs.

Evidence model

Each relationship can carry:

• extractor identity;
• evidence class;
• confidence;
• source file and exact span;
• optional extractor detail.

The enclosing Snapshot binds the graph to a repository and revision and records the scan, graph, and language capabilities evaluated for that snapshot.

Static reachability is never relabeled as measured test coverage. Ambiguous dynamic behavior remains bounded evidence instead of being connected to an arbitrary same-named symbol. Missing artifacts remain explicit rather than becoming reassuring zeroes.

See the evidence model for the exact interpretation rules.

Repository and language surfaces

The engine extracts evidence from:

• Rust, JavaScript, TypeScript, Python, Go, Java, C#, C, C++, Bash, SQL, Solidity, Swift, HTML, CSS-family sources, Terraform, XML, Markdown, MDX, reStructuredText, and AsciiDoc;
• HTTP routes, GraphQL operations, Protobuf/gRPC services and streaming modes;
• Kafka, RabbitMQ/AMQP, JMS, NATS, SQS, SNS, and MongoDB usage;
• JSON/JSONC, YAML, Kubernetes, package manifests, lockfiles, architecture contracts, and measured coverage artifacts.

The first-party lossless tokenizer preserves the complete input byte stream while structural facts retain exact spans. This supports diagnostics, round-trip validation, and future source-to-source consumers without making the graph depend on regex reconstruction.

The 39 default analysis operations

The default full build exposes 39 operations. The public operations layer sits above the engine and is usable from Rust or the CLI. Feature-minimal builds expose only operations backed by compiled capabilities.

Standalone CLI

Install the binary from crates.io:

cargo install weavatrix-rust

Analyze and query without an MCP client:

weavatrix-rust analyze . --pretty
weavatrix-rust list-tools
weavatrix-rust tool graph_stats .

The CLI calls the same engine and operation implementations as an embedded application.

Product boundary

This repository owns analysis, evidence, repository state, and read-only operations. The prebuilt npm/MCP distribution for Codex, Claude Code, and other clients is weavatrix. Source editing belongs to weavatrix-refactor; licensed network workflows belong to weavatrix-online.

Performance and parity evidence

The native engine was checked against an immutable 502-file JavaScript-engine revision after normalizing paths, symbols, and relation identities:

For calls, 2,024 edges matched exactly and 299 reached the same source-line target with an additional Rust owner. There were zero missing and zero wrong shared targets.

Repository and operation benchmarks measure this engine directly. The separate npm product additionally measures packaging, startup, protocol initialization, discovery, calls, shutdown, and process-tree memory. See the methodology and raw evidence.

Safety boundary

• #![forbid(unsafe_code)] in the engine;
• no network implementation;
• no application-source writes or commit creation;
• no execution of analyzed repository code;
• no spawning git, rg, Node.js, Python, or language servers;
• canonical-path containment for repository reads;
• deterministic pagination and bounded results;
• explicit evidence limitations instead of fabricated certainty.

Development gates

cargo fmt --all -- --check
cargo clippy --locked --all-targets --all-features -- -D warnings
cargo clippy --locked --all-targets --no-default-features -- -D warnings
cargo test --locked --all-targets --all-features
cargo test --locked --no-default-features
cargo test --locked --test architecture_self
RUSTDOCFLAGS="-D warnings" cargo doc --locked --no-deps --all-features
cargo publish --locked --dry-run

Documentation

• Getting started
• Operation reference
• Evidence model
• Languages and repository surfaces
• Library, CLI, and product boundary
• Architecture
• Dependencies and feature boundaries
• Benchmark methodology and evidence

License

MIT. Third-party crates retain their own licenses.