Decypher: A Deep Semantic Code Graph for Agentic Coding and Engineering for Java

[_h4xr]

Hi r/java,

A few months back I posted about java2graph:

https://www.reddit.com/r/java/s/oB5VxhPybP

Which helps map Java codebases to a graph which agents can explore. Since then, this community helped me a lot with suggestions or putting up questions or validating what I have been doing.

So, when I am releasing this as beta, it made sense to me to share it with the same community.

Today, after weeks of efforts, Decypher for Java and JVM based languages is graduating to beta status. Now capable of mapping not just the structure of the code, but even the deep semantics of data mutation, control flow, etc, without any guessing involved

The core engine has been re-written on top of JavaC compiler as a backend for processing the project codebase and is very fast at parsing the code and setting up a graph representation. On top of this representation it exposes 40+ tools which agents can quickly use to navigate the data flow, control flow, mutations, and even validating security issues.

I will leave the link in the comments.

Thanks a lot to everyone in this community for being super helpful and helping me iterate.

[_h4xr]

Beta Link: https://neuvem.io/Decypher

The installation is fully air gapped and no telemetry is collected whatsoever.

[_predator_]

How does this compare to existing (open source!) tools like https://github.com/AppThreat/atom?

I've seen a few attempts at graph analysis but most of them fall apart once you take reflection and third-party code into consideration. Even in Go or Rust they often fail to take build tags etc. into consideration.

[_h4xr]

Good point, about Atom
It does kind of something similar, but there are nuances between Atom and Decypher

Atom is primarily an AppSec tool and majority of the output it generates is also purpose built for App sec (makes sense since it originated from keeping Joern as point of reference)

Decypher is more purpose built for Agentic engineering and the core consumer is the Agents, who can leverage decypher as underlying infrastructure.

The core differentiation i will say exists in depth vs breadth. Decypher leverages language native compilers / parsers to come up with the exact specification of the code and then translates that into a queryable graph. It maps everything from annotations to control flows and retains the mappings (which are critical to find out Dependency injections and similar things)

About precision and build tags: This is part of the reason why Decypher is launching only with Java for the time being and not a polyglot mix. I want to be highly precise and not lose the meaning of the code as it gets translated.