Skip to main content

ghostrefs

Find code kept alive only by tests.

Features

  • Finds production symbols whose only known consumers are tests
  • Follows transitive dependencies, including test → helper → target
  • Uses language server references to build a usage graph
  • Explains findings with reference locations and test chains
  • Supports custom production entry points and ignore patterns
  • Written in Rust, currently supports Python via Pyright

Installation

Currently supports Python projects only, using pyright-langserver from your PATH.

With Python 3.10+ and a published wheel for your platform, install from PyPI:

npm install -g pyright
pip install ghostrefs

Wheels contain the compiled executable, so Rust is not needed to install them. Pyright requires Node.js and npm and is installed separately. If pip builds from a source distribution instead, Rust with Cargo is also required.

Alternatively, install from crates.io with Rust and Cargo:

npm install -g pyright
cargo install ghostrefs

Example

From a checkout of this repository, run against the included sample project:

ghostrefs --root . --source fixtures/python/project --tests fixtures/python/tests
TestOnly …/main.py:6:5 test_only_used_func (Function)
TestOnly …/main.py:14:7 TestOnlyUsedClass (Class)
TestOnly candidates: 2 (6 production symbols analyzed)

For your own project, set --root to the directory matching your Python imports. The --source and --tests paths are relative to that root.

Add --verbose to see why a symbol was flagged, or --graph to inspect the usage graph. Configure ignore patterns, production entry points, and Pyright settings in ghostrefs-lsp.json at the project root.

Findings are candidates for review: dynamic imports, reflection, and external consumers may be invisible to the language server.

Documentation

Start with Getting started, then explore the CLI reference, configuration, and analysis model.

See the development guide to build the searchable HTML documentation locally, and the publishing guide to build and release the PyPI distributions.

Metadata

Release files for ghostrefs 0.0.4

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for ghostrefs 0.0.4
File Size Uploaded Provenance
ghostrefs-0.0.4.tar.gz 23.5 kB Without provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for ghostrefs 0.0.4
File Interpreter ABI Platform
ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl Python 3 none macOS 11.0+ ARM64 Details

Total release size: 1.4 MB

Release files / ghostrefs-0.0.4.tar.gz

Download URL ghostrefs-0.0.4.tar.gz
Size 23.5 kB
Tags Source
SHA-256 checksum
How to use checksums
19aa04a93dac32f40de203d4b9d410c09170a756fd11d10079e84b933d4d7b4a
BLAKE2b-256 checksum
How to use checksums
91ee9036f15d338528ba8ba4176a7513bdef51deb51aeaa1ff9302d26fb4d499
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.14.7

Release files / ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl

Download URL ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl
Size 1.4 MB
Tags Python 3 macOS 11.0+ ARM64
SHA-256 checksum
How to use checksums
a46322200e086050886465440f4775d08bc8214b67d869df7f6bb9730bb7d126
BLAKE2b-256 checksum
How to use checksums
0756b1c0a61dbf30cbde2ab4d881404c077e064b0593b4787f398c46080a22cb
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via twine/6.2.0 CPython/3.14.7

Security for ghostrefs 0.0.4

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

No provenance found

None of the files in this release were uploaded with provenance metadata.

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Release history Release notifications | RSS feed

This release

0.0.4 This release

2 release files No provenance

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page