Skip to content

Plumbgraph v1.0.0

Choose a tag to compare

View all tags
@grloper grloper released this 10 Oct 07:59
· 10 commits to main since this release
v1.0.0
98f17c1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Plumbgraph v1.0.0

Source-only GitHub release. Not published to crates.io.

Know your code. Verify the change. Plumbgraph is a local code-intelligence and pre-submit verification tool for AI coding agents (CLI plumb, MCP server over stdio).

Highlights

  • plumb verify: one verdict over dead code, hallucinated/undeclared dependencies, test weakening, diagnostics, semgrep and ast-grep, diffed against plumb-baseline.json so only new findings fail. External tools run only with --run.
  • plumb map (PageRank-ranked, hard token budget) and plumb impact (transitive callers, tests to run).
  • Languages: Python, JavaScript, TypeScript/TSX, Rust, Go, Java, C# (tier-0, tree-sitter); SCIP overlay for compiler-grade references where you have an index.
  • MCP: 13 tools and 3 resources; tested with the official TypeScript SDK and the MCP inspector CLI.
  • Provider orchestration (plumb doctor, plumb enrich), plumb init for agent config.
  • Every finding carries source and confidence; deps allow-list entries require a written reason.

Since the v1.0 candidate (this release PR)

  • Version 1.0.0 everywhere (plumb --version).
  • Dead-code false-positive fixes found by hand review of chi and gson: Rust {NAME} format captures, Java main/C# Main, Java serialization hooks, annotation-driven framework methods; app-mode hint to use --lib for libraries. The index cache rebuilds automatically on upgrade.
  • [[deps_allow]] in .plumbgraph/allow.toml (path glob, optional package, mandatory reason). plumb verify . on plumbgraph itself now passes.
  • plumb verify --fail-on none reports REPORT-ONLY instead of FAIL.
  • New logo, social preview, README, demo recordings generated from real runs, architecture and MCP docs.

Validated end to end (see docs/VALIDATION.md)

  • Real repos: requests, express, ripgrep, cobra, gson, Newtonsoft.Json, kubernetes (13,558 of 31,421 tracked files were source files and got indexed, in 41 s, no OOM), vscode (14.6k files; 60 s), Wraith, classroom-archiver.
  • Fixed from that testing: large-repo memory and speed, weakening detection for Go/Java/C#, alias-import false positives, bounded check-deps/verify output, MCP map token cost, closed-pipe crashes.
  • Seeded weakening recall 12/12 on Python, JS, Rust, Go and C#; Java skips and deletions 4/4 each, loosened assertions untested.

Known limitations (read before relying on it)

  • Name-based analysis without a SCIP index; dead-code precision on libraries in app mode was 1/40 on chi (use --lib); recall on real code is unmeasured. See docs/EVALUATION.md.
  • scip-go/scip-java/scip-dotnet/rust-analyzer SCIP were not run; no Windows testing; MCP agent hosts not tested; no prompts capability.
  • Distribution is source-only: no binaries, no crate.

Full changelog: CHANGELOG.md.

Assets 2
Loading