Tessera

Coding agents edit code they have only partly read. They grep, open a few files, change a function, and report success. The caller in another module that still passes the old arguments turns up later, in CI, in review, or in production.

Tessera gives the agent an exact local map of the code and checks its work against it:

• Before an edit: blast ranks every caller a change can affect and lists the tests to run. context returns the body, callers, and callees in one budgeted read instead of five file opens.
• After an edit: verify catches calls to names that do not exist, wrong argument counts, broken imports, and call sites a rename left behind. Hooks run it after every edit and hold the agent at "done" until the breakage is fixed, in Claude Code, Codex, Gemini CLI, Copilot, Cursor and more.
• Across services: map links HTTP routes, gRPC methods, GraphQL fields, Kafka topics, tables, and config keys to the code on both sides, in any language Tessera reads, so a changed endpoint shows the frontend code that calls it, and verify catches a removed route that a client still calls.
• On every pull request: the GitHub Action comments what the change breaks, who calls the changed code, and which tests to run.

The map is deterministic. tree-sitter parses, SQLite stores, and the same code always gives the same answer. No model builds it, and nothing leaves your machine.

Quick start

Install the binary (macOS, Linux, Windows; checksum-verified, from the GitHub release):

curl -fsSL https://raw.githubusercontent.com/iamsaquib8/tessera/main/install.sh | sh

Then, inside any repository:

tessera blast <symbol>

There is no setup step: the first query builds the index in .tessera/, and every later query refreshes only what changed. Then wire it into your agents:

tessera init

Once the npm package is published, the same commands run without installing anything: npx tessera-codegraph blast <symbol> and npx tessera-codegraph init.

init finds the agents you use (Claude Code, Codex, Gemini CLI, Cursor, Copilot and 16 more), shows the diff of every config change, and asks before writing. It adds the MCP server and, where the agent supports them, the edit-safety hooks. In Claude Code you can install the plugin instead:

/plugin marketplace add iamsaquib8/tessera
/plugin install tessera@tessera

Manual setup for every agent is in docs/integrations.md, and everything else is on the docs site.

cargo binstall tessera-codegraph                 # prebuilt via cargo-binstall
cargo install tessera-codegraph                  # from source, Rust 1.90+

Coming with the next release (the pipeline is built; publishing is pending):

npm i -g tessera-codegraph                       # Node 18+, prebuilt binary, no install scripts
brew install iamsaquib8/tessera/tessera          # macOS and Linux
docker run --rm -v "$PWD:/work" ghcr.io/iamsaquib8/tessera status

Prebuilt binaries for every platform are also on the releases page.

How it works

The queries are also MCP tools (tessera mcp). The tools are read-only, paginated, and return compact text so they cost few tokens. Every command takes --json. See the five-minute tour for real output.

See the impact

tessera ui --open

A local page on 127.0.0.1 shows what your uncommitted work touches: blocking problems, changed symbols, their callers ranked by impact, contracts with services on the other side, and the tests to run. The contract map draws services and the routes, gRPC methods, and topics between them, grouped by directory when there are many, and lists every contract with its tables; every symbol links to its definition, callers, and tests. Nothing loads from the network. tessera ui --export site/ writes the same page as a static site for a demo or an internal wiki.

On every pull request

# .github/workflows/tessera.yml
name: Tessera
on: pull_request
permissions:
  contents: read
  pull-requests: write
jobs:
  tessera:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: iamsaquib8/tessera/action@v1
        with:
          fail-on: blocking   # or `never` (default) to only comment

One comment per pull request, updated on every push: problems to fix, contracts the change touches, callers of the changed code, and tests to run. On forks it writes the job summary instead. The same report is tessera verify --diff <base> --format markdown for any other CI. action/README.md lists the inputs.

Works with every agent and every model

Tessera never calls a model, so Claude, GPT, Gemini, Grok, DeepSeek, Qwen, and local models all work. tessera init sets up each agent below.

Checks every edit means hooks that run verify after each edit and hold the agent at "done" while a break remains (docs/hooks.md). git hook is tessera init --git-hook: a pre-commit check that refuses a commit that breaks a call site or an import, for any agent and for people. --global agents keep MCP config only in the home directory. Config for each agent is in docs/integrations.md; the sourced matrix of hook capabilities is in docs/agents.md.

Languages

TypeScript, TSX/React, JavaScript (ESM and CommonJS), Java, Python, Go, Rust, C, C++, C#, Ruby, PHP.

Deep tier: TypeScript, TSX, JavaScript, and Java. References resolve through imports, re-exports, tsconfig paths, workspace packages, Java packages, declared types, and overloads, and every one carries a confidence. Against compiler ground truth on excalidraw, nest, Ghost, and two Spring applications, high-confidence results are right 99.7% of the time, and Tessera finds 99% of direct calls, 91% of calls on typed receivers, and 99% of type references in TypeScript/JavaScript (accuracy).

The other languages are at the standard tier: resolved within a file and by unique name, labelled when a match is only possible. Current limits are listed plainly.

Contracts between services are read in every language that has them: gRPC in Go, C#, Node, Python, Java and C++; HTTP in Express, Fastify, NestJS, Next.js, Spring and their clients; Kafka; SQL, JPA, TypeORM, Sequelize and Prisma (docs/contracts.md).

FAQ

Why not just run tsc or use an LSP? Run them too. Tessera checks only the changed code against an index of the whole repository, so it fits in an agent's edit loop. It works the same way in all twelve languages, including JavaScript, Python, and Ruby projects that have no type checker, and it covers breaks between services that no compiler sees. An LSP answers one editor's questions about one project; Tessera keeps one index for the whole repository, or a workspace of repositories, that any agent can query.

Does my code leave my machine? No. The index is a SQLite file in .tessera/, gitignored automatically. Tessera makes no network calls, and blast --diff runs only a local git diff.

Is it accurate? Measured, not claimed: on public TypeScript, JavaScript, and Java repositories, 99.7% of high-confidence references match the compiler's ground truth (accuracy). Weaker matches are labelled, never silent. The benchmark and its ground truth are public, so you can check the numbers yourself.

Will it slow my agent down? Through the MCP server, lookups take milliseconds: the server keeps the index fresh in the background as files change. A CLI query first checks that the index is fresh, a stat walk of the repository. Perf budgets run in CI: freshness check under 100 ms and lookups under 50 ms at p95 on 10,000 files. Indexing is incremental.

Can I build on it? Yes. Commands, flags, --json fields, MCP tool schemas, hook replies, and exit codes are stable for 1.x, and a test suite pins them (docs/stability.md).

Roadmap

See ROADMAP.md for each theme and what proves it done.

Contributing

New languages, framework packs, and agent adapters are small, self-contained pull requests with fixtures. CONTRIBUTING.md explains each one. Issues labelled good first issue are scoped for a first PR.

If Tessera saves your agent from a bad edit, a star helps other people find it.

License

Apache-2.0. See LICENSE.