See to the bottom of any codebase.
Paste a URL. CodeTrawl runs one deterministic sweep — full git history, AST-level structure, security, and supply chain — and shows its work. The surface grade orients you in seconds. The survey underneath — the full report, line by line — is the product.
A surface grade orients — it isn't a gate. It points you straight at what to look at first; the survey beneath is where the work is.
COMPUTED, NEVER GENERATED — every grade and signal is deterministic: tree-sitter AST parsing · full-history git analysis · resolved dependency graphs. The model only narrates what was measured.
The grade is the surface.
The survey is the depth.
One sweep computes every signal — then keeps the working. Each line in the survey follows back to the commits, files, and manifests it was measured from.
one pass · ~60s · deterministic end to end — the model never sits between the signals and the grade
Four lenses. One sweep.
History, structure, security, supply chain — four ways of reading a codebase, computed in the same pass.
Git history
Churn × complexity hotspots and bus factor from the full commit graph — plus PR cycle time from recent pull requests.
Structure
tree-sitter ASTs across 8 languages — call graphs, class maps, import cycles, dead ends.
Security
Secret scanning, dynamic-execution patterns, known supply-chain incidents — matched against the record, not guessed.
Supply chain
Dependencies resolved across npm, Cargo, and PyPI — advisories scoped runtime vs dev before they count.
What the survey actually shows.
Six of the views CodeTrawl renders from a sweep — real layouts, real data. Pick one.
One repository, one verdict.
Four departments vote from deterministic signals. The grade is their sum, capped by the worst outcome — never an AI's opinion.
Conditional approval
Approved with conditions attached
Two departments cleared this codebase; two attached conditions before approval.
Test coverage and churn sit within a healthy range.
6 signals consideredPassed all three security scanners.
3 signals consideredflask/app.py concentrates churn across few authors.
2 of 3 signals flagged3 of 24 dependencies carry known CVEs.
3 of 7 signals flaggedAI narrates. It never decides.
- Runs the sweep — git history, ASTs, dependency graphs, security scans
- Computes every signal and the grade — deterministically
- Same input, same survey — re-run it and diff the results
- Stamps every claim with a signal id you can follow to the evidence
- Writes the briefing — plain language over computed signals
- Cites only what the sweep measured — nothing invented
- Never scores, never decides, never overrides a signal
- Optional — the survey stands complete without it
Repos are cloned in memory, read once, and discarded — we keep the findings, never your files. Public repos are free; private repos run on paid plans.
Analyze a repoOne sweep. Four subscriptions.
| Capability | SonarQube | CodeScene | Snyk | CodeTrawl |
|---|---|---|---|---|
| Git-history forensics — hotspots, bus factor | no | yes | no | yes |
| AST structure — call graphs, import cycles | partial | partial | partial | yes |
| Dependency advisories across ecosystems | partial | no | yes | yes |
| Secrets & risky-execution patterns | yes | no | partial | yes |
| One synthesized grade for the whole repo | partial | partial | no | yes |
| Paste any public URL — no repo connection, no install, no CI | no | partial | no | yes |
Capability mapping from public product documentation, 2026 — point tools go deeper on their own gauge; none combines all four.
Run all four on your repoFree for public repositories. Paid plans unlock the full survey.
See pricing