NewPull requests checked against every caller

Documentation that is true, because it is generated.

Kuuhaku scans your repositories, finds how they talk to each other and keeps the result as a site: a map of every connection with its evidence, a page per repo, docs that update on every import.

$ kuuhaku scan architecture.yaml
Scans what you already run
NodeExpressVueNextFlutter+ Java, Python, Go ›
With the CLI, only the graph leaves your machines

One site for the architecture, not a wiki about it.

Every screen is built from the last import. The numbers are the code's numbers, with the file and line that produced them.

Map

Repos are nodes; REST, queues, sockets and shared databases are the edges. Pan, zoom, expand a node in place.

A page per repo

Routes with callers, models, queues, env keys, dependencies, deploy and git.

GET /upload/single/:id7 callers
POST /auth/login3 callers
DELETE /devices/:idnever called
GET /healthno auth
Review inbox

What the scan could not resolve, grouped by kind, each with a suggested answer. Your click becomes a declaration.

POST /upload/single/*
no route matched · nearest /upload/single/:id · 0.81
AcceptIgnore
Import diffs

Each import is compared with the previous one. The dashboard shows what moved.

routes+4 −1
queues orphaned2
advisories+2
commits23
Evidence, never percentages

A connection shows the file and line on both sides and is graded by the kind of proof behind it.

configPort and host
inferredNames in the code
declaredWritten by hand
unresolvedClient, no target
observedSeen at runtime
Pull requests

Know what a pull request breaks before it merges.

The check scans the branch and its base side by side and compares every call between your repos. What stops working lands on the pull request, with the file and line of each caller.

  • A route removed or its method changed while something still calls it
  • A new call to a route that does not exist, with the nearest ones
  • A queue that loses its publisher while consumers wait
  • A model field dropped while another repo still reads it
  • A rule from architecture.yaml broken: "the front never talks to the database"
  • One CI job on GitHub Actions or Bitbucket Pipelines, or the hosted app

Measured on 14 public systems: 127 routes moved on purpose, 165 of their 169 callers named, no false alarm.

Built for pull requests written by coding agents. Claude Code, Cursor and Copilot see one repository at a time; the contract with the others is what they break. The check sees all of them. With the MCP server connected the agent asks who_calls and impact first, and kuuhaku agents writes an AGENTS.md in every repo that says what the others depend on.

$ kuuhaku check . --base origin/main
kuuhakubot commented on #482
✗2 breaking changes
api no longer serves PUT /devices/:id: that path takes PATCH now src/routes/devices.js:42
  • web_app src/pages/devices/edit.vue:118
  • mobile_app lib/services/devices.dart:57
web_app calls POST /orders/cancel on api, which serves no such route
  • web_app src/store/orders.js:88
  • nearest: POST /orders/:id/cancel
▸ 1 note: api adds 1 route nothing calls yet, GET /devices/export
7 repositories scanned at origin/main and with the change
Also in the box

The parts a wiki never has.

Personal data map

Model fields and route parameters tagged by LGPD and GDPR category from their names. Which services share the database, which paths put personal data in access logs, and a CSV for the record of processing.

patients.blood_typehealth · sensitive
customers.cpfidentifier · 3 repos
GET /users/:emailin access logs
Alerts and a weekly digest

Slack or Teams hear about an import that changed the architecture and about a failed scan. Every week, an email with what moved: routes added, callers lost, queues orphaned, what was decided in the review inbox.

#platformapi: +2 routes, 1 caller lost
Monday 09:00digest · 7 repos touched
scan failedorders: key refused
Flow

Pick a route, a queue or a repo and follow it across the workspace: who reaches it, what it touches hop by hop, and the deploy order that keeps a caller from meeting a route that is not there yet.

PUT /orders/:idweb_app, mobile_app
orders → payments, shipping1 hop
deploypayments · orders · web_app
How it works

Three steps, then it keeps itself up to date.

01
Describe the workspace

An architecture.yaml names the repos and how each one calls the others. Paste our prompt into your AI assistant and it writes the first draft from the code.

repos:
  web_app:
    sinks:
      - patterns: ["api.$METHOD($URL)"]
  backend:
    port_env: PORT
02
Scan with a read-only key

One SSH key per workspace, or the CLI on a machine that already has the code. Routes, call sites, models, queues, env keys and git history come out of the code itself.

$ kuuhaku scan architecture.yaml
  routes     861 in 146 files
  call sites 1.383 through 5 clients
  match      979 exact · 471 pattern
  review     44 items
03
Decide what the code cannot prove

Unmatched calls and queues nobody consumes land in an inbox with a suggested answer. Your click becomes a declaration and survives every rescan.

POST /upload/single/*
  no route matched
  nearest  /upload/single/:id
  suggest  typo in the client · 0.81
Real systems

See it on code you can read yourself.

Nine open-source systems scanned with no YAML and no hand-fixing, opened read-only in the app: the map, every repo page, the review inbox and the cleanup list. No account needed.

What each map shows, service by service →

Command line

Scan where the code lives.

The CLI runs on a laptop or in CI, reads every repository in a folder and uploads only the graph: names, paths and line numbers, and three lines around each item left for review.

  • One install with npm, or npx in CI
  • A folder of repositories scans them all at once
  • Every connected machine listed in the workspace
  • Windows, macOS and Linux · Node 18 or newer
~/work/acme
$ npm install -g kuuhaku
$ kuuhaku login --token ••••••••••••
✓ ana-laptop is connected to Acme Platform
$ kuuhaku scan . --push
acme: 7 git repositories, scanned as one workspace
  web_app         link clients · 3 of 3 resolved
  api             routes · 861 in 146 files
  process_events  queues · 8 published, 6 consumed
acme: 7 repos scanned in 38.4s
edges: 19 (12 rest, 5 queue, 1 websocket, 1 shared_db)
call sites: 1,383 routed 1,302 · 979 exact · 323 pattern
✓ pushed to Acme Platform · import #215
Thirty seconds

The whole thing, in thirty seconds.

One route renamed, three repos broken, and what the map, the check and the agents would have done about it.

Pricing

Pay for repos, not for seats.

Every plan starts with a 14-day free trial, no credit card required. Prices are per organisation, per month, and everyone you invite can read the site.

Early access: free for the first month after sign-up opens, then these prices.

Starter
14 days free
$9/ month

For one person or a small team on its own repos.

  • 1 workspace · up to 5 repos
  • Hosted scans with a read-only GitHub or Bitbucket key, or the CLI
  • Map, repo pages and the review inbox
  • A suggested answer for every review item
  • The pull request check in CI
  • Last 3 imports kept
Start 14 days free

No credit card required

Company
14 days free
$79/ month

For many teams, many repos, and a security review to pass.

  • Everything in Team, plus:
  • Unlimited repos and workspaces
  • Priority support

Code that cannot leave your network: the CLI scans on your own machines or CI and uploads only the graph, on every plan. Coming: SSO and read-only share links.

Start 14 days free

No credit card required

Paying by invoice, or need a contract or a security questionnaire? Write to hello@kuuhaku.dev.

Point it at five repos. Read the map in ten minutes.

14 days free on every plan. No credit card required.