Modules
Program Dependence Graph for Elixir and Erlang.
Shared helpers for working with Elixir AST.
Shared analysis helpers for project-wide queries.
Runs structural validation and change-safety checks.
Explains one function, module, file, or line.
Shows a project-level map of modules, coupling, hotspots, depth, effects, boundaries, and data-flow summaries.
Shows GenServer state machines, missing message handlers, and hidden coupling.
Concurrency patterns — Task.async/await pairing, process monitors, spawn_link chains, and supervisor topology.
Analyze code with Reach and generate an interactive dependency graph.
Traces data flow, taint paths, and forward/backward slices.
Traces data flow from sources to sinks. Detects taint paths where untrusted input reaches dangerous operations.
Program slicing — finds the minimum set of statements that affect a value.
Builds call graph edges between function definitions.
Validates .reach.exs architecture policies against project structure.
Builds advisory normalization candidates from fixed external-data boundary evidence.
Struct for an advisory refactoring candidate with confidence and proof.
Generates graph-backed refactoring candidates from cycles, effects, and pure regions.
Analyzes changed functions for risk, impact, and clone siblings.
Detects changed hunks that replace strict map contracts with lenient reads.
Assessment coverage for changed-code analysis.
A persistent evidence fact that moved instead of being resolved.
Compares stable evidence identities across changed-code snapshots.
A parameter map-shape entropy increase in changed code.
Struct for a changed function with risk metadata.
Represents old- and new-side line counts for a changed diff hunk.
Struct for changed-code analysis results.
Detects parameter map-shape entropy increases across source revisions.
Describes a changed-code erosion from strict to lenient map access.
Compares source suppression directives across changed hunks.
Summarizes source suppression changes in a diff.
Selects deterministic canonical functions for exact project clone families.
Finds dead code — pure expressions whose values are never used.
Struct for a dead code finding.
Promotes exact project-to-dependency clone evidence into advisory refactoring candidates.
Builds advisory candidates for modules dominated by public pass-through functions.
Builds source-backed fix templates for implicit map-contract candidates.
Runs structural and performance smell checks over a loaded project.
Struct for an architecture policy violation.
Detects concurrency patterns (Task, spawn, GenServer calls).
Parses and normalizes .reach.exs architecture policy configuration.
Normalized thresholds and output limits for advisory candidates.
Computes control dependence from CFG and post-dominators.
Translates IR nodes into control flow graph vertices and edges.
Computes data dependence (def-use chains) from IR.
Summarizes function dependencies (callers, callees, shared state).
Immediate dominator/post-dominator trees and dominance frontiers.
Effect classification for IR nodes.
Reusable evidence providers consumed by smells, checks, and refactoring candidates.
Shared AST helpers for evidence providers.
Normalizes evidence that code reimplements an available capability.
Process-dictionary-cached clone detection dispatcher.
Struct for a clone family (a group of similar code fragments).
ExDNA-backed clone detection provider.
Struct for a single code fragment within a clone family.
Filters generic evidence emitted from source ranges with reinterpreted DSL semantics.
Collects decoded external values crossing storage or process boundaries.
A decoded external value observed crossing a storage or process boundary.
Decoder source and line retained while tracking external-data provenance.
Collects module-level evidence about public APIs that only forward calls.
Aggregated forwarding and boundary evidence for one module.
A reusable evidence fact emitted by evidence providers.
Reusable call-graph impact evidence for target-local analyses and checks.
Collects evidence for maps that behave like implicit contracts.
Collects nil-capable parameter uses and their dominating non-nil guards.
Evidence that a nil-capable parameter can reach a strict use.
Collects map-shape variation flowing into function parameters.
Observed fixed-map shape variants for one function parameter.
One fixed-map argument observed at a resolved call site.
Runs ExAST patterns for evidence providers.
Behaviour for source-AST evidence providers discovered by Reach and plugins.
Collects near-equivalent struct and bare-map representations across modules.
Shape-overlap evidence joining a struct with a bare map.
A bare-map construction and its observed shape and provenance.
A source-declared struct and its field shape.
Collects terminal return-shape evidence across clauses and branches.
Observed and declared terminal return shapes for one function.
Collects evidence of ad-hoc code that bypasses standard library helpers.
Collects Enum standard-library bypass evidence.
Collects Map standard-library bypass evidence.
Collects Path/URI standard-library bypass evidence.
Collects private domain parsers whose catch-all returns an accepted domain value.
Evidence about a closed-domain parser with an accepted-value fallback.
Registry dispatching source files to language-specific frontends.
BEAM bytecode frontend for analyzing compiled .beam files.
Translates Elixir AST into Reach IR nodes.
Translates Erlang abstract forms into Reach IR nodes.
Gleam source frontend — parses .gleam files into Reach IR.
Adjacency-list graph data structure with vertex and edge operations.
Graph traversal algorithms (BFS, DFS, reachability, SCC).
Resolves higher-order function references to concrete callees.
Internal Representation tree utilities.
Monotonic ID counter for IR node construction.
Utility functions for IR node inspection and traversal.
A node in the internal representation.
Finds advisory graph-backed refactoring candidates for one target function.
Builds agent-readable context bundles for a single target function.
Builds target-local data-flow summaries for mix reach.inspect.
Struct for a cross-function data flow edge summary.
Struct for a data flow node summary.
Struct for data inspection results.
Struct for a variable flow summary.
Builds dependency summaries for one target function.
Builds impact summaries for a target function.
Finds and explains relationship paths between two targets.
Struct for a single relationship path with evidence.
Struct for why-path query results.
Source-level facts for macro and DSL declarations.
Computes project-wide summaries including modules, hotspots, coupling, effects, depth, and data flow.
Struct for functions with multiple distinct side-effect kinds.
Struct for module coupling metrics including afferent, efferent, and instability.
Struct for a module dependency cycle with its components.
Struct for a function with cross-function data flow edges.
Struct for a cross-function data flow summary.
Struct for control nesting depth metrics of a function.
Struct for a call site with its classified effect.
Struct for a per-function effect classification row.
Struct for project-wide effect distribution.
Struct for complexity × callers hotspot metrics.
Struct for per-module coupling detail.
Struct for per-module complexity metrics.
Struct for project-level summary statistics.
Struct for a call with unresolved effect classification.
Struct for a cross-function reference edge.
Entry point for OTP analysis, covering GenServer, gen_statem, and supervisor patterns.
Analyzes GenServer and gen_statem state machines from IR to extract behaviours, state transforms, and missing handlers.
Struct representing a detected OTP behaviour with its callbacks and state transforms.
Struct representing a missing GenServer or gen_statem handler finding.
Struct holding the combined results of an OTP analysis run.
Struct representing a state transformation performed within an OTP callback.
Struct representing extracted supervisor child specifications.
Detects concurrency patterns such as tasks, spawns, monitors, and supervisors across project functions.
Struct holding the results of a concurrency pattern analysis.
Detects hidden coupling across modules via shared ETS tables, process dictionary keys, and message patterns.
Analyzes cross-process data dependencies by tracing effects through GenServer call/cast boundaries.
Detects GenServer.call sites where the reply value is discarded.
Extracts GenServer state access patterns, callbacks, and reply semantics from module IR.
Extracts gen_statem states, transitions, and event handlers from module IR.
Behaviour for library-specific analysis plugins.
Plugin for Ash framework action and resource semantics.
Plugin for Ecto query DSL, Repo calls, and schema semantics.
Detects money-like Ecto fields and columns declared as :float.
Detects Ecto queries that use multiple from generators instead of explicit joins.
Detects string interpolation in Ecto SQL fragments and raw queries.
Detects loading all rows before filtering or aggregating in Elixir.
Detects Repo calls inside enumerable loops that can cause N+1 queries.
Detects unpinned local variables in Ecto query comparisons.
Plugin for ExUnit test-suite semantics.
Detects async ExUnit modules that mutate global process/application state.
Plugin for GenStage producer/consumer semantics.
Shared helpers for plugin callback implementations.
Plugin for Jason effect classification and JSON encoder smells.
Collects evidence of manual JSON encoding that Jason can own.
Promotes calibrated hand-rolled JSON encoder evidence to smell findings.
Plugin for Jido action, signal, and tool semantics.
Plugin for LiveView and HEEx template semantics.
Plugin for NimbleOptions schema declarations.
Plugin for Nx.Defn numerical-definition DSL semantics.
Plugin for Oban worker and job semantics.
Detects Oban perform/1 callbacks that pattern match atom keys in job args.
Detects non-portable Oban job args at enqueue time.
Plugin for OpenTelemetry span and context propagation.
Plugin for Phoenix conn, LiveView, and channel semantics.
Detects LiveView async callbacks that capture the socket.
Detects assign_new/3 for assigns that usually need refreshing inside LiveView mount/3.
Detects direct Repo work in LiveView mount/3 without a connected?/1 guard.
Detects LiveView mount/3 subscriptions that are not guarded by connected?/1.
Detects explicit Phoenix.HTML.raw/1 with dynamic content.
Plugin for Poison effect classification.
Plugin for cross-language analysis of QuickBEAM (Elixir + JavaScript).
QuickBEAM JavaScript source frontend — parses .js files into Reach IR.
Plugin for Zoi schema declarations.
Multi-file project analysis.
Query API for filtering and searching project nodes and edges.
Behaviour and shared helpers for IR-based smell checks.
Shared behaviour for smell checks that scan source files with Sourceror AST.
Promotes one AST evidence provider into an explicitly registered smell check.
Macro DSL for source-backed smell checks.
Detects ++ [item] in recursive tail calls where prepend + reverse would be O(n) instead of O(n²).
Detects rescue clauses that catch every exception type.
Detects module groups sharing the same public callback set.
Detects broad map callback parameters with stable implementation shapes.
Detects broad map specs contradicted by strict, stable parameter access.
Detects structural drift across clone families.
Pattern-based detection of suboptimal collection operations.
Detects compile-time/runtime config phase mismatches.
Detects unnecessary conversion idioms such as one-shot tuple access and identity float coercion.
Detects decoded external maps crossing storage or process boundaries unchanged.
Detects conflicting explicit defaults for one map-contract key.
Detects mixed atom/string key access on the same map.
Detects repeated literal atom/string fallbacks and false-collapsing lookups.
Detects ETS wildcard matches over versioned tuple keys that may return arbitrary rows.
Detects standalone Map.new/0 calls.
Detects validation/check functions that turn error tuples into success-like values.
Detects repeated map literals that should be structs.
Detects non-idiomatic patterns such as guard equality and update-then-fetch.
Detects Keyword.get/2 calls with integer literal keys.
Detects O(n²) patterns in loops and recursive functions.
Detects lossy map-key normalization and representation churn.
Detects compile-time file reads without matching @external_resource declarations.
Detects multiple Enum.at/2 calls on the same variable with literal indices.
Detects Enum.member? nested inside another Enum traversal of the same variable.
Detects nil-capable parameters used without a dominating non-nil guard.
Detects domain parameters receiving divergent fixed map shapes.
Pattern-based detection of redundant pipeline operations.
Detects variables assigned then immediately returned as the last expression.
Detects duplicate pure calls within the same function.
Detects repeated Enum traversals on the same variable.
Detects incompatible terminal return contracts within one function.
Detects bare maps that duplicate an existing struct's entity shape.
Detects contradictions between schema declarations and observed map access.
Detects ad-hoc implementations that bypass standard library helpers.
Detects string concatenation where iolists are more efficient.
Detects private domain parsers that silently coerce invalid input to a valid value.
Detects pass-through API layers that only forward to another function.
Detects dynamic atom creation from non-literal input.
Detects unsafe binary_to_term calls without the :safe option.
Filters generic smell findings inside AST regions with reinterpreted DSL semantics.
Struct for smell check findings with location and evidence.
Shared helpers for smell checks including loop detection, statement pairs, and callbacks.
Shared promotion policy for absolute and changed parameter-shape entropy.
Auto-discovers and lists all smell check modules.
Filters smell findings using config and source-level suppressions.
Helpers for attaching source-origin metadata to lowered AST.
Locates AST ranges whose syntax has plugin-defined or configured DSL semantics.
Origin metadata for AST lowered from framework or template syntax.
Source span metadata used by lowered plugin AST and Reach IR nodes.
Parses source suppression directives and their justifications.
A parsed source-suppression directive and its effective scope.
Builds system dependence graph from per-function PDGs.
Taint and variable flow tracing through data dependence edges.
Struct for a single taint flow path.
Struct for flow trace results.
Plugin-dispatched trace matchers and named trace presets.
A named set of source-to-sink matcher routes for trace analysis.
Backward and forward program slicing from a source location.
Struct for program slice results.
Struct for a single statement in a program slice.
Generates interactive HTML reports from project analysis.
Decomposes CFG into visualization blocks and edges.
Serializes graph data to JSON for frontend rendering.
Shared helpers for source extraction and line mapping.
Extracts and highlights source code snippets for blocks.
Mix Tasks
Generates an interactive HTML report for Elixir/Erlang/Gleam/JavaScript source files.
Shows GenServer state machines, missing message handlers, and hidden coupling.
Explains one function, module, file, or line.
Shows a project-level map of modules, coupling, hotspots, depth, effects, boundaries, and data-flow summaries.
Traces data flow, taint paths, and forward/backward slices.
Runs structural validation and change-safety checks.