Static analysisशून्य से प्रमाण तक— from zero to proof
Know what your code does before you change it.
Paste a GitHub URL. ArchSetu parses the real syntax tree, traces the real call graph, and tells you what a change touches, what nothing calls any more, and where the risk is concentrated. No model is asked to guess, so the same repository gives the same answer twice.
Public repositories are cloned into an isolated container and the clone is deleted when the run finishes. Nothing is sent to a third-party model. Private and very large repositories run inside your own GitHub Actions.
Health
82/100
Read where the shadow falls, as on a Samrat Yantra.
Dead fns
37
Blast radius
3 hops
Complexity
4
Blast radius — Router.handle
- Router.handlelib/router/index.js
- app.handlelib/application.js14×
- Layer.handle_requestlib/router/layer.js9×
- createApplicationlib/express.js2×
Illustrative figures, real report layout. Run any repository above for live numbers.
Repositories analysed
1,070
Completed runs
1,373
Languages in the wild
23/ 47
Of the languages the engine parses, this many have turned up in a repository somebody actually ran.
Functions, one run
768K
torvalds/linux, in a single pass.
Live counts, read from ArchSetu’s own database on each rebuild.
Six questions you cannot answer
by reading the code.
blast_radius
If I change this function, what breaks?
Every caller, transitively, up to three hops out, with the files they live in. Computed from the resolved call graph, so it includes the callers you would not have grepped for. Try it →
blast_radius
14 direct · 63 transitive · 9 files
What in here is nobody calling any more?
Functions with zero resolved callers, grouped by file, with the ones that are safe to delete separated from the ones that are only reachable from a test or an entry point. Try it →
dead_code
37 functions · 11 files
Is this codebase getting better or worse?
One score, recomputed on every run and kept as a series. Weighted across cyclomatic complexity, dead code, test-file ratio, duplication and file size, with each component shown separately so the number is auditable.
health_score
82 / 100 · up 4 since June
Who actually owns this part of the code?
Reconstructed from real commit history rather than a CODEOWNERS file nobody updated, with bus-factor risk flagged where a single author holds most of a directory. Try it →
ownership
bus factor 2 · 4 at-risk dirs
Are there secrets or unsafe patterns in here?
Hardcoded credentials, string-built SQL, unsafe dynamic execution and unvalidated redirects, across five categories. Detailed findings are shown only to a verified owner of the repository. Try it →
security
5 categories · 12+ languages
Does this still match the architecture we agreed on?
Layering and import rules you define, checked on every run and enforceable in CI, so a forbidden dependency fails the build instead of being discovered a year later.
rules
exit 1 on violation
A tool that guesses is worse than no tool.
A growing share of the code in any repository was written by an assistant rather than by somebody who remembers writing it. Nobody holds the whole picture any more, which is exactly when a wrong answer does the most damage: you have no independent memory to check it against.
So the standard ArchSetu holds itself to is not “usually right”. It is that every number on the report can be walked back to the line of code that produced it, and that running the same commit twice produces the same report. That is a property static analysis has and a language model does not.
An AI code reviewer
ArchSetu
Asks a language model to read your code and describe it.
Parses the syntax tree and resolves the call graph directly.
Gives a different answer on Tuesday than it gave on Monday.
Same commit in, same numbers out, every time.
Confident about functions it never actually traced.
Every figure traces back to a file and a line you can open.
Your source leaves your infrastructure to be analysed.
Nothing is sent to a third-party model, ever.
Let the agent ask, instead of guess.
An assistant editing your code sees the files it opened and infers the rest. That inference is where it breaks a caller nobody mentioned. ArchSetu ships an MCP server with 11 read-only tools, so the agent can look the answer up in the real call graph before it edits.
It runs locally, over stdio, on the repository already on your disk. Nothing is uploaded, nothing is written, and no tool can modify a file.
$claude mcp add archsetu --scope project \
-- npx -y @archsetuweb/cli@latest mcp .- Protocol
- 2026-07-28
- Tools
- 11, all read-only
- Transport
- stdio, local
- Network calls
- none
Cursor and Claude Desktop take the same server as a JSON block. Both are on the MCP page.
What it can be asked
11 toolsWorks with Claude Code, Cursor and Claude Desktop. No account needed.
One command, and your
project has an address.
For the project that only runs on your laptop. No account, no deploy config, no credit card. It stays up after you close the terminal and shut the machine.
Run this in your project folder
$npx --yes @archsetuweb/cli@latest shareNode is the only requirement, and 47 languages are recognised — React, Next.js and plain HTML included. There is a step-by-step version for Windows, Mac and Linux if the terminal is unfamiliar.
Your project, running
01A public address anyone can open on a phone, in an interview, or from a CV. Hosted, with your own subdomain.
react-portfolio-live.archsetu.com →A page about the project
02What it is built with, how large it is, and a health score — from the same analysis engine as the rest of the site. Source code is never uploaded, and neither are file paths, secrets or contributor emails.
archsetu.com/s/expressjs-example →The analysis runs on your machine, so its numbers are self-reported and every shared page says so. ArchSetu does not verify them, and the pages are not presented as if it did.
Written for a first terminal, not a first deploy.
47 languages, in production.
43 have a real parser, so functions, complexity and call edges are extracted from them. The other 4 are markup and data formats, recognised and line-counted, because there is no function in a stylesheet to find.
Parsed for functions
43/ 47
Every one of them, printed
Grouped as the Chhap page groups them, from the same list a test pins to the engine.
Most used9
- Python.py
- Java.java
- JavaScript.js
- TypeScript.ts
- C.c
- C++.cpp
- C#.cs
- PHP.php
- SQL.sql
Mobile and app development5
- Kotlin.kt
- Swift.swift
- Dart.dart
- Objective-C.m
- Groovy / Gradle.groovy
Systems and backend8
- Go.go
- Rust.rs
- Ruby.rb
- Scala.scala
- Zig.zig
- Nim.nim
- Crystal.cr
- Solidity.sol
Functional7
- Haskell.hs
- Elixir.ex
- Erlang.erl
- Clojure.clj
- OCaml.ml
- F#.fs
- Julia.jl
Web frameworks4
- Vue.vue
- Svelte.svelte
- GraphQL.graphql
- Protocol Buffers.proto
Scripting, build and infrastructure10
- Shell / Bash.sh
- PowerShell.ps1
- Batch.bat
- Perl.pl
- Lua.lua
- MakefileMakefile
- DockerfileDockerfile
- Terraform.tf
- Vim script.vim
- Emacs Lisp.el
Markup and data4
- HTML.html
- CSS / SCSS.css
- YAML.yaml
- R.r
Real repositories, real numbers.
Pulled from ArchSetu’s own database and refreshed hourly. Open any row for the full call graph and dead-code breakdown.
Cx = median cyclomatic complexity per function.
Full leaderboard →Five of them, each on its own page.
Same engine, one question each. Useful when you want a single answer about a repository rather than the whole report.
In development: PR-time blast-radius comments, config and env-var dead detection, repository trust score, architecture drift detection, merge risk prediction, technical-debt timeline, code ownership map. None of these are shipped, and none of them are on this page pretending otherwise.
Complexity and dead-code annotations inline, and the call graph in a side panel, without leaving the editor.
Point it at a repository and see what comes back.
Free on any public repository. No account needed to run the first one.