Stop Coding in the Dark.
Give Your AI `X-Ray Vision`.
Go-Synapse converts massive codebases into an interactive visual 2D canvas for developers and a 2ms SQLite AST database for AI agents. Eliminate AI context amnesia and human snippet tunnel vision — running 100% locally with zero API leaks.
$Go-Synapse -dir . -web -mcp
Go-Synapse eliminates accidental file corruption by maintaining strict mathematical isolation between AST analysis and code modifications:
1. Go-Synapse (Read-Only)
Enforces a compiler-level filesystem jail. Computes ASTs, SSA taints, and indexes symbols into a 2ms SQLite database. Never modifies your code files.
2. AI Harness (Code Mutation)
Your AI client (Cursor, Claude Code, AntiGravity, VS Code) executes prompts, reasons on architecture facts, and performs the actual file writes in your editor.
3. Live Hot-Reload Bridge
The instant your editor saves changes to disk (Cmd + S), Go-Synapse's WebSocket file watcher hot-reloads the 2D visual graph on-the-fly.
The 3 Core Superpowers
Engineered for deterministic static-to-graph analysis and instant AI context retrieval.
1. Interactive 2D Canvas
Zoom smoothly across 5 set-theory layout tiers from high-level bounded domains down to function calls.
- 5-Tier Compound Viewports: Domain, Package, File, Clean Symbols, and Working Code.
- Hub Portals (📞): Eliminates line spaghetti on high-indegree utilities.
- 5% Taint Dimming: Illuminates threat execution paths in glowing red.
2. 2ms SQLite AST Engine
Turns your codebase into a lightning-fast local SQLite database queryable by AI agents via MCP.
- Recursive CTE Queries: Trace deep call chains in 2ms without prompt bloat.
- 13 MCP Directives: Direct SQL access, node painting, and camera focus control.
- Bi-Directional Canvas: AI drives your viewport while auditing code.
3. Open Knowledge Format
Compiles live AST relationships into portable Markdown architecture blueprints under ~/.go-synapse/exports/.
-
Zero Codebase Pollution: OKF blueprints stay isolated in
~/.go-synapse/exports/. - Day-1 Developer Onboarding: New hires grasp 500k-line architectures in 15 minutes.
- Smart Incremental Testing: Run only tests directly touched by your call graph.
Experience the 2D Spatial Viewport
Toggle between Set Theory compound layout modes, taint trace execution paths, and dead-code quarantine.
The 6-Phase Sub-100ms Ingestion Flow
A linear, debounced cascade that guarantees instant developer feedback and fresh AI context on every file save with zero binary recompilation.
⚡ Event Trigger Phase
The kernel-level fsnotify file watcher detects file system operations (manual developer save, git branch switch, or AI agent tool writes).
⏱️ Filter & Debounce Engine
Strict source extension filtering isolates code files (.go, .ts, .py, .c, .rs, etc.) while ignoring logs, databases, and build artifacts to prevent event storms. Multi-file batch writes are debounced across a 50ms window.
🌲 Linear Dual-Engine AST Extraction
Executes a deterministic priority cascade: queries active compiler language servers (Priority 1: LSP) for verified call hierarchies; if the LSP binary is missing, instantly falls back to Priority 2: Native Tree-Sitter AST with zero external runtime dependencies.
parser.go / Tree-Sitter + LSP Cascade⚙️ Graph Compilation & SQLite Sync
Extracts Native SSA control-flow blocks and CFG edges, runs the Global Linker pass to resolve cross-package call references, and normalizes the entire graph into warm SQLite tables (nodes, edges, audit_ledger).
🛡️ Pre-Flight Threat & Injection Scan
Dynamically reads security/signatures.json from disk and executes a high-speed AST query against SQLite. Sinks, tainted inputs, SQL injections, prompt hijacks, and hardcoded secrets are flagged with glowing probability zones.
📡 Live WebSocket & MCP Distribution
Serializes an incremental delta patch and broadcasts it over WebSockets (/ws) to the Cytoscape 2D frontend while updating the MCP tool cache for connected AI agents (Claude Desktop, Cursor, AntiGravity).
Tree-Sitter Baseline vs. LSP Compiler Precision
Why Go-Synapse uses a hybrid cascade rather than relying solely on one mechanism.
🌲 Tree-Sitter AST Layer
- Instant Zero-Config Baseline: Operates directly on source files with zero toolchains or SDKs installed.
- Resilient Syntax Parsing: Parses incomplete or broken code during active developer typing.
- Universal Language Coverage: Built-in support for all 11 polyglot languages in pure Go/CGO.
⚡ LSP Compiler Layer
- Compiler-Grade Type Inference: Resolves exact generic types, macro expansions, and polymorphism.
- Authoritative Call Hierarchies: Queries incoming/outgoing calls across deep third-party module boundaries.
- Cross-File Dataflow Precision: 100% accurate variable taint tracking with zero false positives.
22 In-Depth Technical Articles
Explore deep architecture breakdowns, AppSec threat tracing tutorials, CS educator workbooks, and ROI analyses.
10-Threat & Injection Sink Matrix
Automated pre-flight AST audit and static taint tracing across 11 programming languages, powered by an extensible JSON rule engine.
| Threat / Vulnerability | Risk Description | Detection Sink Example | Visual Action |
|---|---|---|---|
|
●
1. Indirect Prompt Injection
|
Hidden prompt hijacking strings targeting AI agents via MCP / tool context. | ignore previous instructions | Flagged & Red Glow |
|
●
2. SQL Injection (SQLi)
|
Unsanitized user inputs concatenated into raw DB query sinks. | db.Query("SELECT " + input) | Taint Traced to Sink |
|
●
3. Cross-Site Scripting (XSS)
|
Injected script payloads rendered unescaped into user DOM sinks. | element.innerHTML = input | Mapped to DOM Sink |
|
●
4. Command Injection (RCE)
|
User inputs passed straight to OS execution commands or subshells. | exec.Command(input) | Critical RCE Node |
|
●
5. Hardcoded Secret Leaks
|
Plaintext API keys, JWT secrets, passwords, or tokens embedded in code. | apiKey = "sk_live_..." | Pre-flight Blocker |
|
●
6. Plaintext Network Sinks
|
Unencrypted HTTP or plaintext WebSocket protocols transmitting sensitive data. | "http://api.internal.net" | Protocol Warning |
|
●
7. Loop-Scoped Defer Leaks
|
Go defer placed inside loops causing socket handle & memory leaks. |
for ... { defer file.Close() } | Resource Exhaustion |
|
●
8. Wide SQL Wildcard Sinks
|
Unbounded table projections risking unintentional sensitive data exposure. | SELECT * FROM users | Exfiltration Risk |
|
●
9. Unresolved Security Debt
|
Unresolved security bypasses, TODO markers, and FIXME debt flags. | // FIXME: bypass auth check | Audit Ledger Badge |
|
●
10. Dead Code & Orphaned Logic
|
Abandoned functions with zero incoming caller references adding debt. | in_degree == 0 (unreferenced) | Quarantine Sweeper |
security/signatures.json — evaluated across the AST database on every file save with zero recompilation.
One-Click AI Agent Integration
Plug Go-Synapse directly into Claude Desktop, Cursor, AntiGravity, or Neovim via stdio.
{
"mcpServers": {
"go-synapse": {
"command": "/usr/local/bin/Go-Synapse",
"args": [
"-dir", "/Users/yourname/workspace/your-project",
"-mcp"
]
}
}
}Frequently Asked Questions
127.0.0.1:8080. There is zero telemetry, zero analytics, and zero cloud API egress.
THIRD_PARTY_LICENSES.txt.