Before changing code, a team needs to understand which parts of the system are affected, where to check behavior and which risks deserve investigation. Text search helps find a name or string. Questions about calls, dependencies and data movement need relations between program elements.
CodeGraph uses a Code Property Graph (CPG) and specialized analysis workflows to investigate these questions. Results can be connected to a task and revision, checked against source code and used during review. This page helps you choose a check by its expected result and then find the instructions for running it.
The same code, different questions
Suppose a team changes how a service calculates a limit. Impact analysis helps investigate dependencies of the changed method. Code review examines the change and analyzer findings. Security hypotheses investigate selected weaknesses; threat modeling examines trust boundaries. Software Composition Analysis (SCA) examines dependencies when the change affects software composition.
These checks provide different evidence for a decision. Choose them according to task risk and define the answer you need before starting. After analysis, an engineer checks source locations and uses tests to verify expected behavior. The team receives the selected checks’ results and uses them when discussing the change.
What graph context adds
The graph connects available program elements and relations, including files, symbols, calls and dependencies. A team can investigate connections between code in different files. Analysis uses facts extracted from the selected project revision.
For example, when changing a method, the team needs more than its declaration.
It needs the methods that call it directly or through other methods. The impact
command separates direct and transitive callers. The --max-depth option sets
the search depth, which defaults to five levels. For a method with more than 100
direct callers, analysis uses direct relationships. Engineers use the result to
choose code for review and tests that exercise the affected behavior.
For a recurring construct, structural search returns matching locations. Dataflow analysis helps investigate the path from a value’s source to a dangerous operation. The team uses each result for a specific purpose: callers define the change scope, matches identify locations to inspect, and a data path explains the risk mechanism. Reviewers can discuss concrete relationships and source locations.
Use the dataflow guide for data paths and the architecture control guide for component boundaries. Digital employees explain how to hand an analysis result to an independent reviewer and connect it to acceptance.
This reference maps user questions to CodeGraph commands, then explains the mechanisms used by the checks.
Choose a workflow
| Question | Command help | What to inspect after analysis |
|---|---|---|
| What changed, and what should a reviewer check? | python -m src.cli review --help |
Findings and review evidence for the selected diff. |
| What can this change affect? | python -m src.cli impact --help |
Dependency and blast-radius evidence. |
| Which security hypotheses are supported by the CPG? | python -m src.cli hypothesis --help |
Confirmed, rejected, and inconclusive hypotheses. |
| Where does a structural pattern occur? | python -m src.cli patterns --help |
Matches for the selected pattern and scope. |
| Which threats apply to the system boundary? | python -m src.cli threat-model --help |
Threat-model findings and mitigations. |
| Which dependency risks are present? | python -m src.cli sbom audit --help |
Software-composition findings for the current inputs. |
| How do I describe component boundaries and choose architecture rules? | gocpg architecture --help |
Component model and rule applicability; follow the architecture control guide to run checks. |
The table commands show help; they do not run analysis. Prepare the Python environment using the CLI guide, open PowerShell in the CodeGraph repository root, and enable the local entry point:
$env:CODEGRAPH_ALLOW_LOCAL_PYTHON_CLI = "1"
The architecture-control row requires an installed GoCPG executable. Use its file path if gocpg is not on your PATH.
Use the guides below to perform the analysis. Check the installed version’s --help before automating flags. MCP and REST availability depend on the active profile and running server catalog.
Supported analysis surfaces
Review and change impact
python -m src.cli review combines change context with review-oriented analyzers. Use
python -m src.cli impact when the question is specifically about affected symbols, dependencies,
and regression scope. Save the supporting paths and findings with the Git revision so reviewers
can open the same code and check the conclusions.
See Code review for task-level guidance. Use the live impact
help for its positional method name and optional depth, database, and output fields.
Security analysis
python -m src.cli hypothesis evaluates vulnerability hypotheses against a CPG.
python -m src.cli threat-model addresses the broader system and trust boundary.
python -m src.cli sbom audit addresses components and dependencies. The team selects these checks
according to the question it needs to answer.
See Hypothesis system, threat modeling, and SCA/SBOM.
Structural pattern search
python -m src.cli patterns is the supported starting point for reusable structural queries.
Search compares the source code structure with the selected pattern and returns matching code.
Engineers open those locations to review architecture, find repeated constructs or prepare a refactoring.
See Pattern Search for setup and interpretation.
How the checks work
Clone detection and symbolic execution are internal analysis mechanisms. They have no standalone CLI, REST or MCP surface; use the supported workflows above.
Analysis workflows use these mechanisms:
| Mechanism | What it does |
|---|---|
| Clone detection | Finds similar code fragments within an analysis workflow. |
| Symbolic execution | Assists taint-path feasibility checks. |
| Control- and data-flow analysis | Examines execution order and value propagation during change and security checks. |
| Fix preparation | Prepares proposed changes for diff review and testing. |
For example, refactoring a shared method raises several questions. Impact analysis helps find its callers, pattern search finds similar constructs, and clone detection identifies repeated fragments. The developer uses these results to select the change scope and regression tests. When the method handles external input, data-flow analysis and security hypotheses add checks for values reaching dangerous operations. The team chooses checks for the task, using relationships in one graph and concrete source locations.
Use an analysis result
Record the project, commit, command, configuration, and graph timestamp before interpreting the output. Inspect at least one finding back to its source location and confirm that the reported language and path coverage match the intended scope. After a change, rerun the same bounded command against a refreshed graph and compare finding identities rather than raw counts.
Findings help the team select code for review and build a regression test suite. For a vulnerability hypothesis, examine the data path, execution conditions and system impact. For a generated fix, compare the proposed changes with the original code and run the tests. Repeat the analysis to see how the result of the selected check has changed.
Related guides
Use the scenario guide when you know the goal but not the command. For setup problems, consult troubleshooting. For agent-driven analysis, discover the active surface with the MCP operator guide.