{
  "markdown": "<div align=\"center\">\n  <h1>Flyto2 Indexer</h1>\n  <p><strong>Know what breaks. Prove the fix.</strong></p>\n  <p>\n    <a href=\"https://github.com/flytohub/flyto-indexer/actions\"><img src=\"https://github.com/flytohub/flyto-indexer/workflows/CI/badge.svg\" alt=\"CI\"></a>\n    <a href=\"https://github.com/flytohub/flyto-indexer/actions/workflows/benchmark.yml\"><img src=\"https://github.com/flytohub/flyto-indexer/actions/workflows/benchmark.yml/badge.svg\" alt=\"Benchmark evidence\"></a>\n    <a href=\"https://github.com/flytohub/flyto-indexer/actions/workflows/public-proof.yml\"><img src=\"https://github.com/flytohub/flyto-indexer/actions/workflows/public-proof.yml/badge.svg\" alt=\"Public proof\"></a>\n    <a href=\"https://pypi.org/project/flyto-indexer/\"><img src=\"https://img.shields.io/pypi/v/flyto-indexer.svg\" alt=\"PyPI\"></a>\n    <a href=\"https://github.com/flytohub/flyto-indexer/blob/main/LICENSE\"><img src=\"https://img.shields.io/badge/license-Apache--2.0-blue.svg\" alt=\"License\"></a>\n    <a href=\"https://www.python.org/downloads/\"><img src=\"https://img.shields.io/badge/python-3.11%2B-blue.svg\" alt=\"Python 3.11+\"></a>\n  </p>\n  <p>\n    <a href=\"#installation-and-first-result\">Quick start</a> ·\n    <a href=\"#real-repository-proof-text-search-stops-indexer-keeps-going\">Real proof</a> ·\n    <a href=\"docs/README.md\">Documentation</a>\n  </p>\n</div>\n\nYour coding agent can edit a repository in seconds. The expensive mistakes come\nlater: a missed caller, a stale contract, an ignored repository rule, or\n“done” declared after the nearest test passes.\n\nFlyto2 Indexer gives any MCP-capable coding agent a local map before it edits\nand an evidence gate before it stops.\n\n- **Map the change:** see callers, dependents, tests, APIs, and cross-project\n  impact before touching code.\n- **Keep the intent:** carry repository rules, requirements, and decisions into\n  the actual diff.\n- **Prove the result:** close lint, tests, security, documentation, and change\n  conformance before the agent says it is finished.\n\nNo API key. No model lock-in. No source upload.\n\n## Who It Is For\n\nFlyto2 Indexer is most useful when:\n\n- you use AI on an existing codebase that no one holds entirely in their head;\n- a change can cross packages, services, or repositories;\n- several developers or coding agents must follow the same rules;\n- private, regulated, or air-gapped source must stay local.\n\nIt is not another code generator, IDE, or hosted dashboard. Keep the tools you\nalready trust; Flyto2 Indexer gives them a shared change map and finish gate.\n\n## Installation And First Result\n\n```bash\npip install flyto-indexer\nflyto-index setup .\nflyto-index verify . --strict\n```\n\n`setup` builds a local index and configures supported MCP clients. Then ask your\nagent:\n\n```text\nimpact(target=\"validateOrder\", change_type=\"rename\")\n```\n\n```text\n7 call sites · 3 projects · 2 test files\nRisk: high\nManual review: 1 unresolved dynamic reference\n```\n\nA text search finds the name. Flyto2 Indexer shows the change surface.\n\n## The Problems It Removes\n\n| Pain | What Flyto2 Indexer changes |\n| --- | --- |\n| “I changed one function and something unrelated broke.” | Shows callers, dependents, likely tests, and unresolved references before the edit. |\n| “The agent ignored our repository rules.” | Loads the instructions that apply to the target and blocks contradictory or stale guidance. |\n| “The ticket said five things; the diff only did three.” | Links requirements to planned steps, changed paths, and proof. |\n| “Tests passed, but the change still was not ready.” | Verifies the index, impact, security checks, documentation, policy, package state, and working tree together. |\n| “Frontend and backend drifted apart.” | Compares calls, routes, and contracts so missing connections are visible. |\n| “Our scanner is so noisy that nobody trusts it.” | Keeps evidence local, reports confidence and provenance, and supports baselines for accepted debt. |\n| “The AI keeps hitting the same bad warning or missing the same connection.” | Records the problem locally, groups repeats, and turns them into a reviewable improvement backlog. |\n| “I switched AI tools and had to explain the whole task again.” | Keeps one local task state that any client can resume, and reminds you only when unfinished work needs a handoff. |\n| “A large repository overwhelms the agent.” | Returns bounded, relevant context instead of dumping the whole codebase. |\n\n## Real Repository Proof: Text Search Stops, Indexer Keeps Going\n\nOn the pinned, public\n[`fastapi/full-stack-fastapi-template`](https://github.com/fastapi/full-stack-fastapi-template)\ncommit used by our reproducible case, a literal search for\n`render_email_template` returns four lines in one file. A depth-two impact query\nfinds four request handlers in three additional files above those direct calls.\n\n```text\ngit grep:  4 matching lines · 1 file\nimpact:    7 affected functions · 4 files · 0 scan errors\nmissed by literal search: 4 request handlers\n```\n\nRun the proof yourself:\n\n```bash\npython scripts/reproduce_impact_case.py --check-snapshot\n```\n\nRead the [method, pinned source, exact result, and limits](docs/CASE_STUDY_FASTAPI.md)\nor inspect the [machine-readable receipt](docs/evidence/fastapi-full-stack-0.10.0.json).\nThis proves static transitive discovery for the pinned case; it does not replace\nruntime tests.\n\n## Why It Fits Your Existing Workflow\n\nFlyto2 Indexer complements the tools you already use:\n\n| Keep using | What it already does well | What Flyto2 Indexer adds |\n| --- | --- | --- |\n| Your coding agent | Understands requests and applies edits | A local change map, scoped rules, and a finish gate |\n| IDE search or `grep` | Finds names and direct references quickly | Transitive impact, cross-project links, likely tests, and unresolved gaps |\n| Linters and test suites | Catch the failures they are configured to detect | Proof that the requested work, changed paths, and required checks still agree |\n| CI | Repeats commands on every change | One regression-aware repository and workspace verdict |\n\nYou do not need to replace your model or development workflow. Try it on one\nrisky refactor first.\n\n## Usage\n\nKeep daily work in one closed loop:\n\n```text\nfind → understand impact → plan → pass the gate → edit → validate → verify\n```\n\nThe public tool names are short:\n\n```text\nsearch → impact → task(plan) → task(gate) → edit → task(validate) → verify\n```\n\n- `search` finds the relevant code and concepts.\n- `impact` shows what a change can affect.\n- `task` keeps decisions, project rules, requirements, and proof connected.\n- `verify` checks whether the repository is actually ready to finish or merge.\n\nWhen a session exposes a weak rule, missing relationship, slow scan, or poor\nrecommendation, keep that evidence instead of losing it in chat history:\n\n```text\ntask(\n  action=\"feedback\",\n  feedback_action=\"record\",\n  feedback_category=\"framework_gap\",\n  feedback_summary=\"A lazy-loaded route was missing from impact analysis\"\n)\n```\n\nRepeated problems are grouped into a local improvement backlog. Feedback never\nuploads prompts or source code and cannot automatically weaken repository\npolicy. See [Learn from every AI miss](docs/FEEDBACK.md).\n\nWhen you switch between coding agents, the existing `task(plan)`, `task(gate)`,\nand `task(validate)` flow keeps a small resumable state under the ignored local\nindex. `structure(focus=\"profile\")` exposes that state to the next MCP client;\nno handoff file or extra MCP tool is created.\n\n```bash\nflyto-index task-status .\nflyto-index usage-record task-1 . --provider openai --model gpt-5 \\\n  --usage '{\"input_tokens\":1200,\"output_tokens\":300}'\nflyto-index usage-report . --task task-1 --format json\n```\n\nUsage evidence stores normalized counts, never prompts, responses, source, or\nraw provider payloads. A reduction is reported only for two verified runs with\nthe same model, commit, task fingerprint, tool policy, proof policy, and sample\ncount. See [Resume across AI tools](docs/TASK_CONTINUITY.md).\n\nWhen a gate fails, it explains what is missing. Complete those actions and run\nthe same gate again. A failed gate pauses the unsafe step; it does not abandon\nthe task.\n\n## When The Task Is Still Vague\n\nUse the optional Decision Grill before planning. It resolves facts from the\nrepository first, then asks one high-value question at a time. Once the\nimportant decisions are settled, it freezes them into the plan so the final\ndiff can be checked against what was agreed.\n\n```text\ntask(action=\"grill\", grill_action=\"start\", description=\"Add robot adapter\")\ntask(action=\"grill\", grill_action=\"freeze\", grill_session_id=\"grill_...\")\ntask(action=\"plan\", grill_session_id=\"grill_...\", ...)\n```\n\nIf there is no real product or architecture choice to make, skip Grill and go\nstraight to `task(plan)`.\n\n## API And Integration Surfaces\n\nMost users need only the five short MCP tools: `search`, `impact`, `task`,\n`audit`, and `structure`. The CLI adds local setup, reports, and CI verification\nwithout requiring a hosted account. A loopback HTTP bridge is available for\nclients that need a persistent process, but it stays on the local machine by\ndefault.\n\nAll public contracts are generated from the current source, so an integration\ndoes not have to trust a hand-maintained command list. Start with the\n[MCP guide](docs/MCP.md), [CLI guide](docs/CLI.md), or the\n[source-backed reference](docs/reference/README.md).\n\n## The Main Questions It Can Answer\n\n| Tool | Question |\n| --- | --- |\n| `search` | Where is the relevant code? |\n| `impact` | What could break if this changes? |\n| `task` | Are the decisions, rules, requirements, and proof complete? |\n| `audit` | Where are the most important quality and security risks? |\n| `structure` | How is this project connected? |\n| `verify` | Is this repository ready to finish or merge? |\n\nFocused checks also cover secrets, unsafe data flow, dependencies, licenses,\nsoftware inventory, architecture boundaries, documentation, pull-request risk,\nand multi-repository verification. The exact tool contracts live in the\n[generated MCP reference](docs/reference/mcp-tools.md).\n\n## What “Verified” Means\n\n`verify` combines checks that are usually scattered across several commands:\n\n- Is the local index current and internally consistent?\n- Can the requested context and impact path be reproduced?\n- Did secret, unsafe-data-flow, and repository-policy checks pass?\n- Are documentation, package metadata, and generated files in sync?\n- Is the working tree clean enough for the requested gate?\n\nIt does not pretend static analysis proves runtime behavior. Browser, service,\nintegration, race, container, security, and deployment checks remain\nproject-owned. Their local results can be attached as content-addressed,\noptionally attested proof receipts; only fresh trusted receipts satisfy a\nrequired runtime-proof gate.\n\n## CLI\n\n```bash\nflyto-index scan . --full\nflyto-index impact useAuth --path .\nflyto-index context --path . --query \"auth routes query keys\"\nflyto-index task plan --description \"Refactor auth\" --target src/auth.py\nflyto-index verify . --strict\nflyto-index verify-workspace . --changed-only --base origin/main\nflyto-index research-priority . --top 20\n```\n\nThe same guarded `task` workflow is available through the CLI when an MCP\nclient has a stale long-running process.\n\n### Research priority\n\n`research-priority` answers a different question from the rest of the audit:\nnot \"is this codebase healthy\" but \"which code paths are worth a security\nresearcher's next hour\". It ranks functions by fusing taint reachability, sink\nseverity, entry-point exposure, complexity, git churn, test gaps, and swallowed\nerror handling, returns one candidate per function, and prints why each one\nplaced where it did.\n\nIt is a triage aid, not a verdict. Three properties keep it honest:\n\n- **Evidence tiers are labelled.** A proven source-to-sink flow outranks an\n  unproven lead, and the tier is printed with every candidate. Use\n  `--proven-only` to drop the unproven tiers entirely.\n- **Unmeasurable signals are reported, not zeroed.** No git repository, no\n  index, or a non-Python file makes a signal `null`; scoring renormalizes over\n  what was actually measured, so a repository without history is not penalized.\n- **Truncation is visible.** When a scan hits its caps, the output says so —\n  \"found nothing\" and \"stopped looking\" must not look alike.\n\n## CI\n\n```yaml\n- run: pip install flyto-indexer\n- run: flyto-index scan . --full\n- run: flyto-index verify . --strict\n- run: flyto-index check . --threshold medium --base main\n```\n\nProjects can keep an accepted baseline and fail only newly worse findings:\n\n```bash\nflyto-index verify . \\\n  --baseline .flyto-baselines/flyto-indexer.json \\\n  --regression-only\n```\n\n## Designed To Stay Lean\n\n- The public MCP surface stays at 20 tools instead of growing one tool per\n  scanner.\n- Normal analysis is local and works without a hosted service.\n- Generated data stays under `.flyto-index/` and can be deleted at any time.\n- Task continuity is one bounded local SQLite file: terminal history is kept\n  for at most 90 days and capped at 1,000 runs.\n- Flyto2 Indexer reports evidence; it does not auto-edit, auto-commit, or take\n  over the coding agent.\n- Optional precision adapters remain optional. The default install keeps one\n  runtime dependency.\n- Large results are bounded and pageable so they do not flood the agent's\n  context.\n\nFor clients that need a persistent local connection, an optional loopback-only\nHTTP bridge can keep one MCP process warm and restart it after a failure. See\nthe [MCP guide](docs/MCP.md).\n\n## Languages\n\nBuilt-in indexing covers Python, TypeScript and JavaScript, Vue, Go, Rust,\nJava, Dart, and C/C++. Local language servers and SCIP data can improve\nreference precision when available; the built-in index remains the fallback.\nPrecision is not presented as identical across languages. The\n[language evidence matrix](docs/LANGUAGE_EVIDENCE.md) separates indexing,\nrelationship analysis, security depth, committed positive/negative cases, and\nknown limits.\n\n## Evidence, Privacy, And Limits\n\nTarget repositories are treated as untrusted input. Static checks do not\nintentionally import or execute the code being analyzed. Findings include\nconfidence and trace evidence without retaining raw secrets.\n\nThe committed offline benchmark covers positive, negative, sanitized, and\ncross-file cases across Python, JavaScript, TypeScript, and Go. It gates\naccuracy, false positives, scan errors, and latency on every release. See the\n[reproducible benchmark](benchmarks/README.md) and\n[security model](docs/SECURITY_MODEL.md).\n\nIgnored production Ruff and dependency-isolated, Linux-targeted mypy findings\nare also held to an exact baseline.\nThey can decrease through reviewed cleanup, but CI blocks new debt and requires\nevery improvement to tighten the baseline immediately.\n\n## Documentation\n\n- [Choose a guide by your pain](docs/README.md)\n- [Problems and capabilities](docs/FEATURES.md)\n- [CLI guide](docs/CLI.md)\n- [MCP setup and runtime](docs/MCP.md)\n- [Configuration](docs/CONFIGURATION.md)\n- [Verification](docs/VERIFICATION.md)\n- [Learning from AI development problems](docs/FEEDBACK.md)\n- [Technical whitepaper](docs/WHITEPAPER.md)\n- [Real-repository impact case](docs/CASE_STUDY_FASTAPI.md)\n- [Language evidence and limits](docs/LANGUAGE_EVIDENCE.md)\n- [Generated references](docs/reference/)\n\nThe [design references](docs/DESIGN_REFERENCES.md) explain what was borrowed\nfrom Spec Kit, OpenSpec, Gemini CLI, Serena, Grillme, and other projects—and\nwhat was deliberately left out to avoid bloat.\n\n## Contributing\n\n```bash\npython -m ruff check .\npython -m pytest\npython benchmarks/evaluate.py --check\nflyto-index verify . --strict\n```\n\nSecurity reports: `security@flyto2.com`.\n\n## License\n\n[Apache License 2.0](LICENSE). See [NOTICE](NOTICE).\n\n<!-- mcp-name: io.github.flytohub/flyto-indexer -->\n",
  "bytes": 15909,
  "sha": "b2a00063e6cdf02989c1ef51ff488b66ff7b5e6873a13c0b4bd839063232ed4a",
  "repo_slug": "flytohub/flyto-indexer",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_flytohub_flyto_indexer_92a6d9fc/readme"
}