Skip to main content

depmesh

depmesh is a CLI tool for making relationships between project files and artifacts an explicit part of your architecture.

Instead of leaving coding agents to infer context from filenames, source code, search results, or embeddings, define those relationships explicitly in depmesh.toml: tests that verify a module, specifications that govern it, artifacts affected by a document, import chains, or any project-specific relation that matters to development.

Agents and developers can then query those relations through a single stable interface to find related artifacts, inspect change impact, locate tests or specifications, and follow the project structure in a unified, deterministic way. So no dependency, no constraint, and no project-specific convention is forgotten or overlooked.

Example

Before changing a CLI module, ask depmesh for the specifications and tests connected to it:

The human protocol is the default:

depmesh dependencies -r governed_by -r tested_by @/depmesh/cli/application.py
relation: governed_by

Specifications that apply to the artifact.

- @/specs/architecture/entities.md
- @/specs/architecture/errors.md
- @/specs/architecture/modules_layout.md
- @/specs/architecture/naming.md
- @/specs/architecture/tests.md
- @/specs/behavior/cli.md

relation: tested_by

Tests that verify the artifact.

- @/depmesh/cli/tests/test_application.py

For more structured output, use depmesh -p llm dependencies ... or depmesh -p automation dependencies ....

Rationale

Coding agents often need to answer practical questions before editing:

  • Which tests should be read before changing this file?
  • Which specifications govern this module?
  • Which files import this shared helper?
  • Which artifacts are affected by this specification change?

depmesh answers those questions through configured relations.

For example, a project can define relations such as:

  • tested_by — tests that verify an artifact.
  • governed_by — specifications that apply to an artifact.
  • imports — Python files imported by an artifact.
  • imported_by — Python files that import an artifact.

Features

  • Unified queries — One interface for discovering project dependencies.
  • Configurable discovery — Use path patterns, fixed lists, CLI commands, or project-specific scripts behind the scenes.

Quick Usage

List available relations first:

depmesh relations

Query dependencies for an artifact:

depmesh dependencies ./src/app.py

Query selected relations:

depmesh dependencies --relation governed_by --relation tested_by ./src/app.py

Query several artifacts together:

depmesh dependencies @/src/app.py @/src/service.py

Results are merged across inputs, deduplicated within each relation, and sorted by relation and dependency. Run separate queries when you need to know which input produced each dependency.

Initialize a starter configuration:

depmesh init

Read detailed agent-oriented usage:

depmesh skill usage

Other built-in docs:

depmesh skill configuration
depmesh skill initialization

The CLI specification describes the complete command interface.

Output protocols

Select the output protocol with the global -p option before the subcommand:

  • human — Compact terminal text for people.
  • llm — Framed cells for coding agents.
  • automation — JSON Lines for programs.

For example:

depmesh -p llm dependencies @/src/app.py

Without -p, skill uses llm and other commands use human. Human and LLM dependency output groups paths by relation; automation emits one record per dependency.

Ordinary results appear after successful command completion. Warnings appear after results or reported errors. Expected failures discard pending results and exit nonzero. All output cells, including errors, go to stdout; framework argument-parsing diagnostics may still use stderr.

Installation

Install depmesh from PyPI in the environment where your agent or tools run:

uv tool install depmesh

# or
pip install depmesh

Then initialize a starter configuration in the project root:

depmesh init

The starter depmesh.toml is valid, but it is only a starting point. Edit it so it describes the dependency relations that matter in your project.

Tell agents to use depmesh by adding a short note to AGENTS.md:

Use `depmesh` to discover dependencies between project artifacts.
Agents MUST use `depmesh` for dependency types supported by its configuration.
At the start of each work session, run `depmesh skill usage`.

You can ask a coding agent to help fill the configuration. A good prompt is:

Inspect this project and update depmesh.toml with useful dependency relations.
Start by reading output of `depmesh skill initialization` and `depmesh skill configuration`.

This repository uses depmesh for its own dependency mapping. See depmesh.toml for a real configuration example.

Configuration

depmesh is useful only when the project has a meaningful depmesh.toml.

Without --config, Depmesh searches upward from the current working directory for depmesh.toml. The directory containing the selected file is the project root. Use a global --config PATH to select a file explicitly:

depmesh --config /path/to/project/depmesh.toml relations

The configuration declares:

  • relations that can be queried.
  • rules that match queried artifacts.
  • sources that produce dependency artifacts.

Minimal relation example:

version = 1

[[relations]]
id = "tested_by"
description = "Tests that verify the artifact."

[[rules]]
relation = "tested_by"
input = { type = "glob", pattern = "./src/{**package_path}/{*module}.py" }
output = { type = "files", pattern = "./src/{package_path}/tests/test_{module}.py" }

This defines one relation named tested_by. The rule matches source files like ./src/cli/app.py, captures cli as package_path and app as module, and looks for ./src/cli/tests/test_app.py as the dependency.

Configured relative paths and patterns use the configuration directory as their base; relative CLI artifact paths use the invocation's current working directory. Prefer root-anchored paths such as @/src/app.py when a reference should be independent of the current directory.

Run depmesh skill configuration for the agent-oriented configuration guide.

For the full configuration contract, see the configuration specification.

Specifications

Project behavior and architecture are specified in ./specs. Start with ./specs/intro.md when looking for the source of truth.

Development

Development commands run through Docker:

./bin/dev-tests.sh
./bin/dev.sh uv run -- depmesh relations

Build development containers only after approved Docker or dependency changes:

./bin/dev-build-containers.sh

Metadata

Release files for depmesh 0.2.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for depmesh 0.2.0
File Size Uploaded Provenance
depmesh-0.2.0.tar.gz 45.2 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for depmesh 0.2.0
File Interpreter ABI Platform
depmesh-0.2.0-py3-none-any.whl Python 3 none any Details

Total release size: 117.3 kB

Release files / depmesh-0.2.0.tar.gz

Download URL depmesh-0.2.0.tar.gz
Size 45.2 kB
Tags Source
SHA-256 checksum
How to use checksums
e1dd7e94eb9a6f6fd7e2a859464882e6a847af116277d0a29af3a626c26a9226
BLAKE2b-256 checksum
How to use checksums
e3d7f4b1cb5a63b79ca9a40eb698c81218d06d3ee112dd9bf69f8ad1ef67f5b3
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.

Transparency log

Release files / depmesh-0.2.0-py3-none-any.whl

Download URL depmesh-0.2.0-py3-none-any.whl
Size 72.1 kB
Tags Python 3
SHA-256 checksum
How to use checksums
4689cc5304fa8c8733e97de18a7c9221ff00d4c17cb96df949f35ad049cce8b4
BLAKE2b-256 checksum
How to use checksums
a3456436e46ebe8ba3f3f7d7ad7c09483ddcdaafca574d4994c9a9644855f514
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.

Transparency log

Security for depmesh 0.2.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for depmesh-0.2.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 21, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page