Supported stacks

What the scanner reads in each language, and how. Updated 6 October 2026.

Three kinds of reader. tree-sitter parses the code into a syntax tree and matches shapes, so it follows constants, template strings and ternaries. regex adapters read source text with patterns written for each framework: fast to add, exact on the common shapes, blind to the unusual ones. Proxy and gateway files are read as config. Every repo page says which one ran and what it could not read.

StackReaderRoutesHTTP callsModelsQueuesAuth on routesDeps and advisoriesEnv keys
Node · Express, Fastify, Next.js APItree-sitter● incl. file routes●● Mongoose● amqplib, cron, Socket.io● middleware● npm audit, OSV●
Vue, React, Next.js (browser code)tree-sitter–● axios, fetch, request, $http, $.ajax, store actions–◐ Socket.io client–●●
Flutter · Dartregex–● Dio, http–––● pub.dev, OSV–
Java, Kotlin · Spring Boot, Quarkus, Jakarta EEregex● MVC, WebFlux, Data REST, JAX-RS, OpenAPI specs● RestTemplate, WebClient, RestClient, Feign, REST clients, Apache and Java 11 HttpClient● JPA, Mongo● Rabbit, Kafka, JMS◐ method annotations● Maven, Gradle, OSV●
Python · FastAPIregex● with router prefixes● requests, httpx, urllib, gateway decorators● SQLModel, SQLAlchemy● pika, Kafka● dependencies● PyPI, OSV● incl. BaseSettings
Python · Django, DRFregex● nested urls.py, routers●● ORM●◐ mixins, permission_classes●●
Python · Flaskregex● blueprints●● SQLAlchemy●◐ decorators●●
Go · mux, gin, chi, net/httpregex●● net/http◐ tagged structs● amqp, NATS, kafka-go–● go.mod, OSV●
C# · ASP.NET Coreregex● controllers, minimal APIs● HttpClient, Refit, YARP, forwarders––◐ [Authorize]–● incl. appsettings
Rust · actix-web, axum, rocketregex●● reqwest––––●
PHP · Symfony, Laravel, Slimregex●● curl, Guzzle, Http––––●
Ruby · Sinatra, Railsregex●● Net::HTTP, HTTParty, Faraday––––●
Proxies · nginx, Envoy, Spring Cloud Gateway, Zuulconfig● each rule● the hop each call takes–––––
NestJS routes, GraphQL, gRPC methodsNext, by demand. Until then the connections are drawn (message patterns, gRPC stubs by proto service) without the route of each call.

● read◐ partial– not applicable or not yet

Across every stack

Request a stack

Write to support@kuuhaku.dev or use the feedback box in the product, with a public repository that shows the shape. A regex adapter for a framework takes days, not months.