What is Depwire?
Depwire parses a project with tree-sitter and pattern-based parsers, builds a symbol-level graph of imports, calls and dependents, and serves it to MCP clients through 24 tools. An agent can ask what depends on a symbol, which files a change affects, which exports look dead, and what a delete, move, rename, split or merge would break before it touches a file. It also scores architecture health from 0 to 100, scans for security patterns and records cross-language edges such as a TypeScript fetch call matched to a Flask route.
It is written in TypeScript by Atef Ataya, ships as the depwire-cli package on npm, and released v1.29.0 on 10 November 2026. The licence is the Business Source License 1.1, free for personal and internal company use and converting to Apache 2.0 on 25 February 2029. The repo has about 70 stars and npm counted 574 downloads in the week to 10 November.
How to install Depwire
npx -y depwire-cli mcpIs Depwire worth it?
Depwire answers one question well: what breaks if the agent changes this. Its simulate_change tool takes a delete, move, rename, split or merge and returns broken imports, affected nodes and the health-score change from the graph, without editing source files. impact_analysis, get_dependents and affected_files cover the narrower cases, and find_dead_code lists exports with no dependents, each with a confidence level and a reason code. Because the graph comes from parsing rather than embeddings, the same code gives the same answer every time.
The README is unusually frank about its limits. A July agent benchmark and the performance claims drawn from it were withdrawn after an audit found an exposed answer key and unequal working directories, and the project tells readers not to cite them. The tables of real-world parses carry a note that v1.9.0 fixed parser bugs affecting symbol and edge counts and that the figures were never re-measured. verify_change says outright that it does not certify a change as safe and runs no build or tests. That candour is worth more than a benchmark, but it also means there is no current public evidence that agents do better with Depwire than without it.
For security, parsing reads files without executing them, the CLI sends no telemetry, and source code never goes to Depwire. The MCP server runs over stdio; the visualisation servers bind to 127.0.0.1. The tools do write: graph output, a SQLite cache, generated docs and .depwire/AGENTS.md, plus claims and decisions logs from the coordination tools. connect_repo can clone any GitHub URL, which brings untrusted code and comments into the agent's context. A November 2026 advisory (GHSA-h5xc-3hqf-qqm2) showed a symlink could slip past connect_repo's block on paths such as .ssh and /etc; v1.28.3 fixed it.
Against the neighbours, codebase-memory-mcp covers similar impact and call-path questions as an MIT-licensed C binary with more users, and CocoIndex Code does semantic search rather than graph queries. Depwire's distinctive pieces are the what-if simulation, the structural diff between git refs and cross-language route edges. The BUSL licence allows internal use at a company, but anyone building a product or hosted service on it needs a commercial licence from the author.
Where it earns its place
A backend engineer on a 300-file TypeScript service
Delete a utility module without breaking the build
The agent calls simulate_change with a delete on the file, reads the list of broken imports, fixes each caller, then runs the build. Free under BUSL for internal use; the graph answer is not a substitute for the test suite.
A tech lead on a 13-module Maven project
See which extension modules a core interface change reaches
impact_analysis resolves imports across Maven and Gradle module boundaries, so the lead gets a cross-module dependent list before the change is planned. Parse once with depwire parse and start MCP from the saved graph.
A platform team running two coding agents on one repo
Stop agents editing the same files at once
Each agent records intent with claim_files and checks get_active_claims before editing. Claims are advisory records in .depwire/claims.jsonl, not filesystem locks, so they only work with cooperating clients.
Before you commit
- Setup
- npx -y depwire-cli mcp in the client config, or npm install -g depwire-cli. Documented for Claude Desktop and Cursor; any stdio client works. Node 22 or newer is recommended; on Node 20 the parse cache may be unavailable. depwire parse . first lets MCP start from the saved graph.
- Integrations
- 24 tools, mostly read-only queries (get_dependents, impact_analysis, find_dead_code, simulate_change, security_scan). Write tools: update_project_docs, claim_files, release_files and record_decision write under .depwire/. Also a CLI, SDK, GitHub Action, pre-commit hook and VS Code extension.
- Data and privacy
- Runs locally over stdio; no telemetry and no source code sent to Depwire. Security scans run dependency audits by default, which send dependency metadata to package registries and advisory services; --no-dependency-audit turns that off. connect_repo clones GitHub URLs, a prompt-injection path. Advisory GHSA-h5xc-3hqf-qqm2 (symlink bypass of protected paths) fixed in v1.28.3.
- Cost at scale
- Free for personal and internal company use. Depwire Cloud and VS Code Pro are $9.99/month; commercial licensing for products built on it is by email, price not published.
- Limits
- Parsers capture only the constructs they support; files over 1 MB are skipped. verify_change returns not_comparable for cyclic-group safety on edited content and runs no build or tests. Cloud's /pr-review endpoint has returned HTTP 503 since 18 October 2026.
What’s good
- What-if simulation of five refactor types
- Deterministic graph, no embeddings
- 16 languages plus Angular templates
- Frank about withdrawn benchmarks and parser limits
What’s not
- BUSL-1.1, not open source until 2029
- About 70 stars and a single main author
- connect_repo clones untrusted repos into context
- Graph misses relationships its parsers do not support
Best for
Engineers on mid-sized TypeScript, Python or JVM codebases who want an agent to check the blast radius of a refactor before it edits.
Depwire alternatives
Depwire: common questions
- Is Depwire worth it?
- A careful, honest graph tool for asking what a change will break, held back by a small user base and a licence that is not open source. We rate it 3.6 out of 5.
- How much does Depwire cost?
- The CLI and MCP server are free for personal and internal use under BUSL-1.1. Depwire Cloud and the VS Code extension's Pro features cost $9.99/month.
- What are the downsides of Depwire?
- BUSL-1.1, not open source until 2029; about 70 stars and a single main author; connect_repo clones untrusted repos into context; graph misses relationships its parsers do not support.
- Who is Depwire best for?
- Engineers on mid-sized TypeScript, Python or JVM codebases who want an agent to check the blast radius of a refactor before it edits.
- How much does Depwire cost for a team or in production?
- Free for personal and internal company use. Depwire Cloud and VS Code Pro are $9.99/month; commercial licensing for products built on it is by email, price not published.
- Is Depwire safe for company data?
- Runs locally over stdio; no telemetry and no source code sent to Depwire. Security scans run dependency audits by default, which send dependency metadata to package registries and advisory services; --no-dependency-audit turns that off. connect_repo clones GitHub URLs, a prompt-injection path. Advisory GHSA-h5xc-3hqf-qqm2 (symlink bypass of protected paths) fixed in v1.28.3.
- What are the best Depwire alternatives?
- The closest alternatives we have reviewed are codebase-memory-mcp, CocoIndex Code, CodeGraph and Serena.
Answers checked Nov 11, 2026.