Skip to content
RepoLens

A cartographer for codebases

See how your code is connected.

RepoLens turns any project into a map you can turn in your hands: what depends on what, what breaks if you touch it, and what quietly needs attention. It reads your files in your browser and never uploads a line.

Drop a folder or ZIP anywhere

Dependencies, build output and secret files are always skipped. Read on this device; nothing is uploaded. For big projects, dropping the folder here is much faster than the folder chooser in this browser.

The sample: a React app, a Python API and a Go worker. Drag to turn it.

I. What it finds

  1. 01

    A map you can turn

    Every import becomes a line between files. Folders gather into constellations, so the shape of a project shows at a glance: the tight clusters, the long bridges, the loners.

  2. 02

    What breaks if I touch this?

    Select any file to see everything that depends on it, directly or indirectly, and trace the exact chain of imports that links any two files.

  3. 03

    Where the risk hides

    Files are ranked by blast radius, complexity, missing tests and circular dependencies, so you know where a mistake would cost the most.

  4. 04

    Secrets in the source

    Finds API keys, tokens, private keys and passwords committed to code. The value itself is never stored, shown or exported.

  5. 05

    Architecture, not just files

    Directory-level coupling and stability, loops between folders, and layers that lean the wrong way. The structure you meant to build, checked against the one you built.

  6. 06

    Dead weight

    Unreachable files, exports nobody imports, packages nothing uses, and imports no manifest declares, each marked as confirmed or needs review.

II. Every language, one map

Projects are rarely written in one language, so RepoLens reads them side by side. Imports are followed across files, packages and namespaces, and a React front end, a Python service and a Go worker appear on the same map.

  • JavaScript
  • TypeScript
  • Vue
  • Svelte
  • Astro
  • Python
  • Java
  • Kotlin
  • Scala
  • Go
  • Rust
  • C
  • C++
  • C#
  • Ruby
  • PHP
  • Dart
  • Swift

III. Private by construction

Most tools ask you to trust a promise. RepoLens is built so the promise is enforced by your browser.

Read the security notes
  • No upload path exists. Files are read locally and analysed in a sandboxed worker. The page and the worker are forbidden from making network connections at all.
  • Nothing to track you. No accounts, cookies, analytics or third-party scripts. Fonts are served from this site.
  • Reports hold no source. Exports contain paths and findings. Secret values are never captured, so they cannot leak into a report.
  • Hostile input is expected. Archive size, file count and path checks, and a time limit, bound what any project can do.

IV. From the terminal

The same engine runs in your build. Fail a pull request on a leaked secret or a falling score, and open the saved report here to explore what changed.

npx repolens .                       # summary
repolens . --md report.md            # shareable Markdown
repolens . --json report.json        # open it in the app
repolens . --impact src/db/client.ts # who is affected?
repolens . --fail-on secret          # exit 1 on a leaked key
repolens . --min-score 70            # gate CI on health

V. Questions

Is my code uploaded anywhere?

No. Files are read by your browser and analysed in a Web Worker on your device. The site sends a strict Content Security Policy that forbids network connections from the page and from the worker, so there is nowhere for the data to go. You can confirm it in your browser’s network tab while an analysis runs.

How accurate is it?

JavaScript and TypeScript are parsed with the real TypeScript compiler. Other languages use comment-aware pattern matching, which is reliable for imports but not a full parser. Findings are labelled “confirmed” when they are facts about the graph (a cycle, a syntax error) and “review” when they are judgement calls (possibly unused code). Nothing here replaces your compiler, tests or a security audit.

What are the limits?

In the browser: up to 60,000 files to analyse (after skipping dependencies, build output and anything in .gitignore), 100 MB of readable text and 1 MB per file; ZIPs up to 100 MB. Most large projects finish in well under 30 seconds. If one is over the limit you are told straight away, before anything is read, and can open a subfolder or use the command-line tool.

Can I share what I find?

Yes. Export a JSON report, a Markdown summary or a PNG of the map. Reports hold paths and findings only, and anyone can open a saved report here without access to your code.

What does the health score mean?

It is a transparent, size-adjusted summary of structural problems: exposed credentials, syntax errors, cycles, broken imports, risky constructs, complexity, missing tests, duplication and unused code. Every point deducted is listed and explained. It describes structure, not quality or security as a whole.