User Guides

Choose a guide for your task: project import, code analysis, change review or operations. Use the scenario catalog to choose a workflow or the quick reference to find a command. The CLI guide explains environment setup and command execution.

• CodeGraph quick reference Choose CodeGraph commands for import, audit, review or diagnostics. Find CLI help and workspace commands, then open the linked guides.
• CodeGraph command-line guide Run the CLI from a CodeGraph checkout, inspect project scope, find code elements, and compare files before applying a change.
• Typed scenario invocation Build a typed scenario request, bind it to an accepted task scope, and handle policy rejection or incomplete execution results.
• Import a project into CodeGraph Import a Git repository through the UI, REST API, or server CLI, wait for the job to finish, and verify that its code graph is ready.
• Review a bounded code change Collect findings for commits, staged changes or selected files. Check analysis coverage, graph freshness and report contents before a review decision.
• Code review hooks for Codex and Claude Code Connect CodeGraph hooks to Codex or Claude Code, verify registered events and client loading, and check how each hook handles failures.
• Pilot benchmark Compare five to ten pilot tasks with measured baselines, build a decision report, and check missing data before accepting its recommendation.
• Production monitoring Check CodeGraph metrics collection, alert rules, and notification delivery. Distinguish API availability from project data freshness.
• Troubleshoot CodeGraph safely Diagnose CodeGraph connection, import and analysis failures. Collect scope and logs, review a repair plan and verify recovery before closing it.
• Dogfood operations Check CodeGraph graph freshness, analyze commit changes, and save a quality report. Choose the next maintenance step from diagnostic results.
• Analyze security data flows Trace input data to sensitive operations. Audit a project or analyze a method through MCP, then inspect calls and sanitization.
• CodeGraph LSP server Connect an LSP client to CodeGraph through GoCPG gRPC, verify diagnostics and method information, and diagnose missing results.
• OpenCode quick start with CodeGraph Connect OpenCode to CodeGraph, select the project and run supported analysis commands. Check authentication, graph readiness and output limits.
• Scenario catalog Choose a CodeGraph guide for analyzing, changing, or reviewing code. The catalog connects your task to its expected result and scenario limitations.
• Scenario 01: Onboard to an unfamiliar codebase Map an unfamiliar CodeGraph workspace from source and graph evidence. Check project scope, graph freshness and unanswered questions before changes.
• Scenario 02: Run a bounded security audit Run a scoped CodeGraph security audit, inspect findings and analysis coverage, and collect revision-bound evidence for remediation decisions.
• Security audit autofix previews Generate security patch previews with CodeGraph. Review finding scope and patch limitations before applying changes and checking the result.
• Scenario 03: Create source-backed documentation Draft instructions from current CodeGraph source: explain a command, its options, and error recovery, then review the draft for publication.
• Scenario 04: Develop a bounded feature Find integration points for an accepted feature, verify the investigation result, and implement the scoped change with tests first.
• Scenario 05: Refactoring with impact evidence Bound a refactoring, inspect graph impact, and compare evidence before and after the edit while preserving product behavior.
• Scenario 06: Investigate a performance problem Investigate code paths behind a measured performance problem and verify a change with the same workload and correctness checks.
• Scenario 07: Find and prioritize test gaps Map measured coverage to CPG methods and prioritize risky test gaps. Distinguish a missing artifact from measured zero coverage.
• Scenario 08: Assemble compliance evidence Collect evidence for selected requirements and a source revision, check tool limitations, and submit the results to accountable reviewers.
• Scenario 09: Review a bounded change Review a pull request, commits, or selected files. Get findings with source locations and check results to assess the change.
• Scenario 10: Cross-repository impact Find dependencies and duplicated implementations across repositories. Collect results to assess change impact and plan consolidation.
• Scenario 11: Architecture analysis Find dependencies, cycles and layer violations in one project, assess affected components and prepare a source-backed architecture decision.
• Scenario 12: Technical-debt planning Collect CodeGraph technical-debt findings and prepare a scoped repayment plan. Separate proposed work from implemented and verified corrections.
• Scenario 13: Mass-refactoring plan Analyze a symbol or API migration with CodeGraph and prepare a bounded plan. Check impact scope and analysis limits before editing source files.
• Scenario 14: Security-incident investigation Trace security-incident impact while keeping investigation separate from containment, remediation, postmortem, and closure.
• Scenario 15: Debugging investigation Locate source and static call relationships for a debugging hypothesis. Check graph freshness and reproduce runtime behavior to confirm the cause.
• Scenario 16: Entry points and attack surface Locate candidate external entry points from source and graph evidence. Check trust boundaries and distinguish static links from runtime reachability.
• Scenario 18: Code-optimization analysis Analyze an individual file, inspect suggestions and exit codes, then verify the proposed change with tests and measurements before applying it.
• Scenario 19: Standards check Import coding rules, check selected source files, and save a violations report to review findings and prepare corrections.
• Scenario 20: Dependency analysis Inventory project dependencies and inspect vulnerability and license data. Generate an SBOM and choose the CLI or REST workflow for your project.
• Architecture control in CodeGraph Define component boundaries, check dependencies against a CPG and investigate violations. Apply architecture rules to changes before release.
• Run a CPG-backed project audit Prepare a registered project and its CPG, choose an audit depth, and use the Q1-Q12 report to investigate recurring defects.
• Dashboard score methodology Understand audit and Health Score formulas, data sources, and scoring limits. Check the evidence and its freshness before making a release decision.
• Dashboard operations Check dashboard data freshness and Health Score availability, compare project periods, and configure notifications for project changes.
• Dashboard user guide Find project risks in the CodeGraph dashboard, check evidence freshness, and compare history. Learn the navigation and limits of available actions.
• Operational release gate Select a CodeGraph release profile, inspect results and thresholds in its JSON report, compare run history, and manage approved suppressions.
• Generate an SBOM and audit dependencies Generate a project SBOM and audit dependencies against selected vulnerability sources. Inspect the findings and export a SARIF report.
• Assess software supply-chain risk Inspect dependency provenance, package integrity and typosquatting risks. Interpret supply-chain findings alongside the separate SCA inventory.
• Build and maintain a STRIDE threat model Build a STRIDE model from the CPG. Inspect data flows and trust boundaries, review threats, and compare models after architecture changes.
• Composite analysis workflows Combine security, performance and standards findings into a prioritized list with Scenario 18 and Scenario 19. Inspect merge metadata and conflicts.