ghostrefs
Find code kept alive only by tests.
Features
- Finds production symbols whose only known consumers are tests
- Follows transitive dependencies, including
test → helper → target - Uses language server references to build a usage graph
- Explains findings with reference locations and test chains
- Supports custom production entry points and ignore patterns
- Written in Rust, currently supports Python via Pyright
Installation
Currently supports Python projects only, using pyright-langserver from your PATH.
With Python 3.10+ and a published wheel for your platform, install from PyPI:
npm install -g pyright
pip install ghostrefs
Wheels contain the compiled executable, so Rust is not needed to install them. Pyright requires Node.js and npm and is installed separately. If pip builds from a source distribution instead, Rust with Cargo is also required.
Alternatively, install from crates.io with Rust and Cargo:
npm install -g pyright
cargo install ghostrefs
Example
From a checkout of this repository, run against the included sample project:
ghostrefs --root . --source fixtures/python/project --tests fixtures/python/tests
TestOnly …/main.py:6:5 test_only_used_func (Function)
TestOnly …/main.py:14:7 TestOnlyUsedClass (Class)
TestOnly candidates: 2 (6 production symbols analyzed)
For your own project, set --root to the directory matching your Python imports.
The --source and --tests paths are relative to that root.
Add --verbose to see why a symbol was flagged, or --graph to inspect the usage graph.
Configure ignore patterns, production entry points, and Pyright settings in
ghostrefs-lsp.json at the project root.
Findings are candidates for review: dynamic imports, reflection, and external consumers may be invisible to the language server.
Documentation
Start with Getting started, then explore the CLI reference, configuration, and analysis model.
See the development guide to build the searchable HTML documentation locally, and the publishing guide to build and release the PyPI distributions.
Metadata
Release files for ghostrefs 0.0.4
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| ghostrefs-0.0.4.tar.gz | 23.5 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl | Python 3 | none | macOS 11.0+ ARM64 | Details |
Total release size: 1.4 MB
Release files / ghostrefs-0.0.4.tar.gz
| Download URL | ghostrefs-0.0.4.tar.gz |
|---|---|
| Size | 23.5 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
19aa04a93dac32f40de203d4b9d410c09170a756fd11d10079e84b933d4d7b4a
|
|
BLAKE2b-256 checksum How to use checksums |
91ee9036f15d338528ba8ba4176a7513bdef51deb51aeaa1ff9302d26fb4d499
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.7
|
Release files / ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl
| Download URL | ghostrefs-0.0.4-py3-none-macosx_11_0_arm64.whl |
|---|---|
| Size | 1.4 MB |
| Tags | Python 3 macOS 11.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
a46322200e086050886465440f4775d08bc8214b67d869df7f6bb9730bb7d126
|
|
BLAKE2b-256 checksum How to use checksums |
0756b1c0a61dbf30cbde2ab4d881404c077e064b0593b4787f398c46080a22cb
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.14.7
|
Security for ghostrefs 0.0.4
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.