Skip to main content

grimp-tools

Dependency analysis, coupling enforcement, and architectural contract visualization for Django/Python projects.

Reads configuration from the consumer project's pyproject.toml. Zero config needed if you already use import-linter.

Installation

uv add --dev grimp-tools

Requires Python 3.11+.

Prerequisites

Your project must have import-linter configured with root_packages:

# pyproject.toml
[tool.importlinter]
root_packages = ["api", "game", "engine", "authentication"]

Commands

analyze

Module and app-level dependency analysis with cycle detection.

grimp-tools analyze
grimp-tools analyze --exit-on-cycles          # exit 1 if cycles found (CI)
grimp-tools analyze --history docs/deps.log   # append timestamped report
grimp-tools analyze --skip migrations,admin   # override skip modules
grimp-tools analyze --extra-packages celery   # add packages beyond root_packages

snapshot

Save and compare dependency snapshots over time.

grimp-tools snapshot save                     # save to docs/deps-snapshot.json
grimp-tools snapshot diff                     # compare current vs saved
grimp-tools snapshot diff --ref master        # compare current vs snapshot at git ref
grimp-tools snapshot summary                  # print metrics without saving

Track docs/deps-snapshot.json in git to see how dependencies evolve across commits.

focus-graph

Focused Mermaid graph showing only what changed between two git refs. Uses worktrees for clean builds.

grimp-tools focus-graph                              # HEAD vs HEAD~1
grimp-tools focus-graph --new main --old main~1      # specific refs
grimp-tools focus-graph -o docs/focus-graph.md       # save .md + .html

app-graph

Doughnut graph for a single app: detailed module-to-module edges inside the focal app, and aggregated cross-app counts (in / out) on the outer ring. Useful for per-app architectural review.

grimp-tools app-graph contest                          # mermaid → stdout
grimp-tools app-graph contest -o docs/graphs/contest.md
grimp-tools app-graph dressage --format dot --top 5    # 5 most coupled apps
grimp-tools app-graph dressage --no-external           # only internal subgraph
grimp-tools app-graph story --exclude tests,factories  # extra parts to skip

Example output (mermaid):

graph LR
  subgraph "contest (focal app)"
    contest_models["models"]
    contest_views["views"]
    contest_views --> contest_models
  end

  videos -.->|3| contest
  contest -.->|2| videos

contracts-graph

Visualize import-linter contracts as Mermaid diagrams.

grimp-tools contracts-graph                          # print to stdout
grimp-tools contracts-graph -o docs/contracts.md     # save .md + .html

check-names

Validate that Python files follow naming conventions.

grimp-tools check-names                              # check all tracked .py files
grimp-tools check-names --ref master                 # only files changed vs ref

Coupling contract (import-linter plugin)

A custom import-linter contract that enforces coupling thresholds as a ratchet: coupling can decrease (warns to update config) but not increase (breaks the contract).

# pyproject.toml
[tool.importlinter]
contract_types = [
  "coupling_metrics: grimp_tools.coupling_contract.CouplingMetricsContract",
]

[[tool.importlinter.contracts]]
id = "coupling"
name = "Coupling metrics"
type = "coupling_metrics"
skip_modules = "migrations,admin,apps,management"
top_n = 30
exact_edges = 42
exact_cross_app_edges = 18

Run with lint-imports --verbose to see the full coupling report.

Configuration

All configuration is optional. If [tool.grimp-tools] is absent, defaults are used.

# pyproject.toml
[tool.grimp-tools]
# Modules to skip in analysis (default: migrations, admin, apps, management)
skip_modules = ["migrations", "admin", "apps", "management"]

# Snapshot output path (default: docs/deps-snapshot.json)
snapshot_path = "docs/deps-snapshot.json"

# File naming conventions for check-names
standard_names = [
  "models", "managers", "views", "serializers", "services", "urls",
  "admin", "apps", "forms", "signals", "tasks", "choices", "fields",
  "widgets", "middleware", "decorators", "exceptions", "types",
  "perms", "filters", "queries", "factories", "report", "adapters",
  "validators", "defaults", "enums", "mixins", "contexts", "caches",
  "actions", "tags", "pagination", "storage", "config", "help_texts",
  "conftest", "router", "settings", "wsgi", "manage",
]

exempt_dirs = [
  "migrations", "management", "commands", "scripts", "docs",
  "templatetags",
]

Makefile integration

deps:
	grimp-tools analyze --history docs/deps-history.log

snapshot:
	grimp-tools snapshot save

focus-graph:
	grimp-tools focus-graph --new main --old main~1 -o docs/focus-graph.md

check:
	lint-imports
	grimp-tools check-names

Releasing

Publishing is automated via GitHub Actions with Trusted Publishers (OIDC, no tokens needed).

To publish a new version:

  1. Update version in pyproject.toml
  2. Commit and push to main
  3. Create a git tag: git tag v0.2.0 && git push origin v0.2.0
  4. Go to GitHub > Releases > "Draft a new release", select the tag, and click "Publish release"

The workflow (.github/workflows/publish.yml) builds and uploads to PyPI automatically via Trusted Publishers.

Metadata

Release files for grimp-tools 0.4.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for grimp-tools 0.4.0
File Size Uploaded Provenance
grimp_tools-0.4.0.tar.gz 81.2 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for grimp-tools 0.4.0
File Interpreter ABI Platform
grimp_tools-0.4.0-py3-none-any.whl Python 3 none any Details

Total release size: 123.2 kB

Release files / grimp_tools-0.4.0.tar.gz

Download URL grimp_tools-0.4.0.tar.gz
Size 81.2 kB
Tags Source
SHA-256 checksum
How to use checksums
ab45b0e31ab836ff46515a2c1b2bbc60b3fbd9adfce3d9a8816bf4dc416cf1f3
BLAKE2b-256 checksum
How to use checksums
0e754190ee1467568a444338a5d4879375b57537dac040baf19dab531c6d7080
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.13

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Apr 27, 2026.

Transparency log

Release files / grimp_tools-0.4.0-py3-none-any.whl

Download URL grimp_tools-0.4.0-py3-none-any.whl
Size 42.0 kB
Tags Python 3
SHA-256 checksum
How to use checksums
74919314c4581b5702c58eb6346c8494bb68a0914a48ae22101827034ca37e10
BLAKE2b-256 checksum
How to use checksums
354a86685675b7434036835d490086edbcde2d7b981a26ea0b17a5ebdafa6e6e
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.13

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Apr 27, 2026.

Transparency log

Security for grimp-tools 0.4.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for grimp_tools-0.4.0.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Apr 27, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page