Features
Fourteen capabilities.
One thing underneath.
Each one exists because the graph is typed.
Your system, typed — not a picture of it
Every box gets a type and a file. Every arrow gets a rule something can check.
- Screens, APIs, services, tables
- Auto-layout at 200 nodes
- Edit it directly
- Knows what it inferred
Find out the day the drawing stops being true
Every node records a content hash. So we can answer: is this still what your code does?
- In sync · changed · gone · unbuilt
- Accept or rebuild
- Runs nightly
- Works on imported code
Five nodes claim a file in this repo.
Press Check sync to hash every one of them against the code that is actually on disk right now.
Check the whole thing without uploading your code
One command scans the repo where it already lives, and answers with an exit code.
- Source never uploads
- Exit 0 · 1 · 2
- Watch mode
- Fires on every commit
Point it at a repo that already exists
Folder, git URL or upload. The same typed graph comes out.
- Next.js · FastAPI · Flask
- Prisma · SQLAlchemy · SQL
- Real edges, not just files
- Re-import merges
You do not have to start from a drawing.
Point it at a repository that already exists (a local folder, a git URL, or an upload) and the same graph comes out the other side.
One task, one scope, green or reverted
The agent gets its nodes and an allowlist of their files. Nothing else.
- Edges become acceptance criteria
- Out-of-scope edits fail
- Must report node → file
- Never left broken
Sketch → shapes
deterministic
Shapes → typed nodes
model
Infer what wasn't drawn
model
Graph → ordered work
deterministic
One task, then stop
model
Green or reverted
deterministic
Drawing still true?
deterministic
› 6 shapes, 5 arrows, 6 labels recovered from the board
Turn “payments must go through auth” into a check
The rule in someone's head becomes the rule that fails a build.
- protected_by
- only_via
- no_direct_edge
- layer_boundary
- gate_not_wired
Auth check exists but nothing calls it
lib/auth.ts → app/api/payments/route.ts
- stub_shortcut
Refund handler returns success without refunding
app/api/refunds/route.ts
- duplicate_endpoint
Two handlers answer POST /api/checkout
app/api/checkout/route.ts
- orphan_file
Nothing imports this module
lib/legacy-cart.ts
- isolated_node
Receipts is drawn but connects to nothing
graph node · service:receipts
Hypotheses until an agent pass confirms them. A scanner that overstates its confidence gets ignored.
A change that breaks the architecture fails the build
Drift and violations come back as annotations on the files that caused them.
- Inline on the diff
- No bot to install
- Works on forks
- Blocks the merge
Risk located by shape, not by grep
The graph knows what each part is, so it knows which defects are even possible there.
- 9 defect kinds
- 227 rules, platform-keyed
- Leaked secrets
- Ships its own false positives
- criticalidorapi:getOrder
reads a table keyed by a client-supplied id, with no ownership edge
- highssrfservice:webhookRelay
fetches a URL that arrives in the request body
- highauthz_bypassapi:deleteUser
no protected_by edge, unlike every sibling route
- mediumsecrets_in_logservice:mailer
logs the full request object on failure
Watch the journey you drew actually run
Replayed against the code as it is. A step with no code path doesn't light up.
- Derived, not authored
- Drawn vs built
- Narrated per step
- No diff to read
- 1Loginscreen
user submits credentials
- 2Authservice
verifies and issues a session
- 3Dashboardscreen
renders with the session
- 4Paymentsapi
charges via Stripe
- 5Receiptsserviceno code path
emails the receipt
Replayed against the graph re-read from your code. You drew it; you get to watch it run.
A connector, not another window
Drive the whole thing from the coding agent you already use.
- No second app
- Your own subscription
- Export any time
- No proprietary format
No prompt. No template. No prose.
Argue about the box, not the diff
Approve a node or ask for changes on it, with the conversation attached to the thing itself.
- Comment on any node
- Approve · request changes
- See who is on it now
- Four roles, enforced
Payments
api · charges.ts
Maya
This talks to the users table directly. Should it go through Auth?
Alex
Agreed — adding a contract so it fails if it happens again.
Find out it drifted before the next person does
Re-run drift and the defect scan nightly, and send the result where your team already looks.
- Nightly re-check
- Rules you set
- Webhooks out
- Email when it matters
Nightly check
Drift + defect scan · 02:00
- Today, 02:003 nodes drifted
- Yesterday, 02:00in sync
- Sat, 02:00in sync
Tell
Everything the board does, over HTTP
Issue a key, call the same endpoints the product calls, wire it into whatever you already run.
- Scoped to your org
- Shown once, hashed at rest
- Revoke instantly
- Same API as the app
- Revoke
CI — main
gl_live_••••••••••••7f21
- Revoke
Staging runner
gl_live_••••••••••••b904
Shown once, at creation. Only a hash is stored — a leaked database holds no working key.
curl -H "Authorization: Bearer $KEY" \
https://graphlit.co/v1/projectsSee it against your own codebase
Point it at a repo you know. Compare its map to yours.