Know your code before you touch it.

Paste any GitHub repo. Get a deterministic map of risk, complexity, and structural debt — in under a minute. No LLM guesses, just 17 grounded signals across 7 languages.

What you'll find

things GitHub Insights doesn't show

Blast radius

Click any file or function. See what breaks if you change it — three hops deep across the call graph.

Repo health

Red / yellow / green verdict grounded in 17 deterministic signals — complexity, churn, coverage, dependencies. No AI hallucination.

Architecture canvas

Folder frames + file cards laid out as a packed map. Time-scrub to watch the codebase evolve commit-by-commit.

Untested hotspots

Most-complex production functions with zero test caller. Computed by walking the call graph from test files into production code.

Near-duplicates

Structural AST hashing finds 36 copies of one ARM rewrite pattern in golang/go src/cmd. Across 7 languages.

PR-bot · new

Install the GitHub App. Every PR gets one grounded review comment from the same signal layer. Zero LLM cost, deterministic-only.

Tree-sitter AST across JS/TS, Python, Go, Java, C#, PHP, Ruby. Kotlin via regex fallback (imports only). Big monorepos? Paste a deep-link to a subdirectory to scope the analysis.

Real findings

actual signals from our analysis of famous repos
golang/go·Near-duplicates

Near-duplicates found 36 copies of one ARM register-shift rewrite pattern across src/cmd/compile — canonical SSA-rewrite family.

django/django·Untested hotspots

_alter_field has cyclomatic complexity 91 — the schema migration's most complex single method. Two test callers, zero direct tests.

pallets/flask·PR-bot · complexity delta

load_dotenv grew +4 cyclomatic complexity between 3.0.3 and 3.1.0 — no tests changed in the same module. Caught at PR time by our rules engine.

spring-projects/spring-petclinic·Call graph

Type-aware call resolution resolved 8 ambiguous validate() call-sites to the right overload. Unresolved list is now exclusively stdlib + Spring.

Two surfaces, one signal layer

same deterministic pipeline, two ways to consume it
Workspace · repobaron.com

Map an entire repo

Paste a URL. Get an explorable canvas, blast radius, untested hotspots, near-duplicates, dependency health, and a red / yellow / green verdict grounded in 17 deterministic signals — all under one workspace.

17 signals · scored across 6 dimensions
Activity
Code
PR flow
Team
Dependencies
Hygiene

Free account · public repos · sessions saved as JSON · works on monorepo subdirectories

PR-bot · GitHub App

Review every PR

Install the GitHub App on a public repo. On every PR, get one grounded review comment with the top verification signals from the diff — linked back to the workspace for the deep dive.

repobaron-prbot7m ago
CRITICALload_dotenv grew +4 complexity. No tests changed.
WARNING_path_is_relative_to removed. Verify callers.
INFOSizeable PR — 23 files, 109 changes.
View on workspace

Private beta · zero LLM cost · find-or-update on every synchronize

Architecture

See your codebase as a class diagram — automatically.

RepoBaron extracts classes, interfaces, and method relationships from your repo's AST and renders them as a navigable Mermaid diagram. No manual UML, no plugins, no setup — just paste a URL and explore.

  • Filter unconnected classes, search by name, scope by folder
  • Export Mermaid source — paste into README or mermaid.live
  • JavaScript & TypeScript today, more languages rolling out
Auto-generated class diagram from a RepoBaron analysis

Roadmap

what we shipped, what's coming next
What's new
  • May 2026
    Accounts + workspaceSign up with email or GitHub. Sessions tied to your account, accessible from any device. Connect GitHub from /account to link both sign-in methods.
  • May 2026
    RepoBaron PR-botOne grounded review comment on every PR. Same signal layer as the workspace, zero LLM cost.
  • May 2026
    Architecture diagramsClass diagrams auto-generated from your repo's AST. Across 7 languages, no manual UML, no setup.
  • May 2026
    Near-duplicate detectionAST-hash structural matching. Caught 36 ARM-rewrite copies in golang/go src/cmd.
What's coming
  • Next
    Email verificationVerify your email + recover forgotten passwords via Resend. GitHub OAuth currently works as the recovery path.
  • Soon
    Pre-PR self-reviewSame signals, on your local branch, before the diff goes public. "Check this before you push."
  • Soon
    Cross-PR trend analyticsComplexity, coverage, and hotspot trends across snapshots — see where your codebase is drifting.
  • Planned
    Private reposAnalyze private repos via per-account GitHub permissions. Auth layer is in place; permission model is the missing piece.