A trending open-source tool reverse-engineers messy repositories into business workflows, connected code maps, and evidence-backed risk findings.
- UnvibeCode reverse-engineers repos into workflows, connected-code maps, and evidence-backed risk findings.
- Install via PyPI , run one CLI command, no API key required.
- Supports Python, JS, TS, Rust, PHP, Ruby, Go, and HTML/CSS with varying depth.
- Distinguishes supported risk findings from insufficient-evidence cases, avoiding hallucinated issues.
- Positions itself against Aider, Repomix, Qodo PR-Agent, and CodeQL for different workflows.
- Apache 2.0 repo but PyPI package contains proprietary analysis assets with redistribution restrictions.
UnvibeCode reverse-engineers a software repository into linked views of business workflows, code relationships, risk findings, and exportable context for further AI analysis. It addresses a common failure mode in heavily LLM-generated codebases: teams can ship code faster than they can document its behavior, dependencies, and business effects.
The Python project has more than 1,500 GitHub stars, publishes its repository under Apache 2.0, and distributes its CLI through a PyPI package. After installation, a single review command accepts a local repository path and starts the analysis.
Four views, one repository #
UnvibeCode traces execution paths across files, symbols, imports, decisions, and state changes. It organizes the results into four connected artifacts:
- Business Workflow Map: Reconstructs workflows from source code and links each step to its decisions, dependencies, state changes, and implementation.
- Connected Code Map: Displays an interactive graph of files, imports, and symbols. Reviewers can select nodes and export focused source context.
- Business Risk Findings: Reports implementation defects with source evidence, affected workflows, likely impact, and remediation guidance.
- Complete Repository Context: Packages normalized repository content into a ZIP file for analysis by another LLM.
Findings with a paper trail #
Each risk finding connects a claimed defect to source evidence, affected workflows, expected impact, and remediation guidance. The analyzer can also record that available evidence is insufficient, and the documentation warns that some repositories produce no confirmed findings. Reviewers can inspect the cited code before accepting or rejecting each result.
This story is for Pro members #
You've reached the end of the free preview. Upgrade to AlphaSignal Pro to read the full article - and everything else behind the paywall.