the agent harness for structural code quality
Topos measures complexity, coupling, risky data flows, and agent cognitive load, then gives your agent a concrete target—from SLOP to PLATINUM.
Install · What it checks · Under the hood · Docs · Issues
Why Topos
Coding agents produce working code quickly. The harder question is whether the result is still easy to understand, safe to change, and well-fitted to the rest of the repository. Quality is the new currency.
Topos computes that signal from program structure—not from an LLM review or a style opinion—and returns concrete failure locations and next actions. It is fast enough to sit inside the agent loop: measure, edit, verify, repeat.
Tests check behavior. Topos checks whether the implementation is built to keep changing.
Grounded in category theory, written in Rust.
Install and Quick Start
One binary. Every supported agent harness. A clean way back out.
1. Install the CLI
Use the verified release installer:
curl -fsSL https://docs.krv.ai/topos/install.sh | bash
Or install with Homebrew:
brew install krv-labs/tap/topos
On Homebrew 6+, that fully qualified one-liner auto-taps and trusts only this formula. If you brew tap krv-labs/tap first, run brew trust --formula krv-labs/tap/topos before brew install topos.
2. Connect your coding agents
topos install detects every supported MCP harness and lets you configure any—or all—of them from one interactive checklist:
topos install
┌ Which agent integrations do you want to configure?
│
│ ↑↓ move · space toggle · a all · enter confirm · esc cancel
│
│ ❯ ○ Claude Code (detected)
│ ○ Claude Desktop (detected)
│ ● Codex CLI (✓ active)
│ ● Gemini CLI (✓ active)
│ ○ GitHub Copilot CLI (detected)
│ ○ Cursor (detected)
│ ○ VS Code (detected)
│ ○ Google Antigravity (detected)
│ ○ pi (detected)
└
Restart the agents you configured, then ask:
"Use Topos to find this repository's worst structural problem, make one focused improvement, and verify the result."
See the agent setup guide for permissions, manual configuration, and troubleshooting.
3. Evaluate from the terminal
topos evaluate . -r
Topos discovers Python, Rust, JavaScript, TypeScript, C++, and Go automatically. Pass --language only when you want to narrow the run.
See Installation for platform support and alternative install paths.
What Topos checks
Every file gets four independent verdicts:
- SIMPLE — avoids unnecessary complexity using AST entropy and control-flow complexity.
- COMPOSABLE — limits a file's outward dependency burden; broader coupling and stability metrics remain available for diagnosis.
- SECURE — avoids dangerous API reachability and taint paths in the code property graph.
- NAVIGABLE — stays shallow enough for an agent to read and change in one pass, using depth-weighted nesting divergence over the AST scope tree.
Those verdicts roll up into one memorable quality medal without hiding which pillar failed:
| Medal | Criteria |
|---|---|
| 🏆 PLATINUM | Passes all 4 |
| 🥇 GOLD | Passes 3 of 4 |
| 🥈 SILVER | Passes 2 of 4 |
| 🥉 BRONZE | Passes 1 of 4 |
| ❌ SLOP | Passes 0, or fails to parse |
See the full metrics reference. Refactor guidance also surfaces control-flow cycles, load-bearing dependency edges, and process bottlenecks.
How the medal system is derived
The four pillars are pairwise incomparable and form a sixteen-element evaluation lattice (a 4-cube); PLATINUM is their intersection. Labels below abbreviate the pillars as Simple, Composable, Sc = Secure, Navigable.
Under the hood
Topos is a self-contained Rust CLI and MCP server. Analysis runs locally; your source code is not sent to an external model or hosted analysis service.
| Component | Role |
|---|---|
| tree-sitter | Parses six languages and powers the native AST, CFG, CPG, PDG, and UAST representations. |
| GitNexus | Supplies the repository dependency graph scored by COMPOSABLE (topos depgraph generate). Requires npm install -g gitnexus@1.6.8. |
| Sighthound | Embedded in the MCP server for supplementary security findings; native CPG probes remain the SECURE scoring source. |
The result is one agent-facing contract over several structural lenses: one score to optimize, explicit evidence for each failure, and a verification loop that can tell a real improvement from cosmetic churn.
More ways to use Topos
- OpenClaw / ClawHub:
openclaw skills install @Krv-Labs/topos - Hermes:
hermes skills tap add Krv-Labs/toposthenhermes skills install Krv-Labs/topos/topos - Agent Plugins: point a compatible client at
agent-plugin/(spec) - MCP Registry name:
io.github.Krv-Labs/topos - CLI reference: docs.krv.ai/topos/cli
Distribution
Topos ships four ways:
- GitHub Releases — the
toposCLI binary (macOS/Linux), viainstall.shor a direct release download. - PyPI —
topos-mcp, a thinbin-wheel bundling the MCP server binary (pip install topos-mcp/uvx topos-mcp), zero Python runtime. - VS Code Marketplace — the Topos extension, bundling platform binaries.
- Docker — a container image for Glama and other MCP-registry hosting.
Crate layout and adapter details: docs.krv.ai/topos/architecture.
Contributing
Topos is used internally at Krv Labs to manage AI-agent code output. We welcome bugs, ideas, and contributions.
- Bug? Open an issue
- Idea? Start a discussion or open a PR
- Collaborate? team@krv.ai
Full documentation · Measures and metrics · Engineering notes
Release files for topos-mcp 0.6.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Built distributions (wheels)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| topos_mcp-0.6.0-py3-none-manylinux_2_34_x86_64.whl | Python 3 | none | Linux glibc 2.34+ x86-64 | Details |
| topos_mcp-0.6.0-py3-none-manylinux_2_34_aarch64.whl | Python 3 | none | Linux glibc 2.34+ ARM64 | Details |
| topos_mcp-0.6.0-py3-none-macosx_13_0_arm64.whl | Python 3 | none | macOS 13.0+ ARM64 | Details |
Total release size: 37.4 MB
Release files / topos_mcp-0.6.0-py3-none-manylinux_2_34_x86_64.whl
| Download URL | topos_mcp-0.6.0-py3-none-manylinux_2_34_x86_64.whl |
|---|---|
| Size | 13.9 MB |
| Tags | Linux glibc 2.34+ x86-64 Python 3 |
|
SHA-256 checksum How to use checksums |
b617470dec741e40e24aa3649260dfe19c69c9be3416b27a890df641b62cce40
|
|
BLAKE2b-256 checksum How to use checksums |
0bb1a3cf8696d33614bdbad2b2822a87e9fe26d538798693f4960e4f46e0f261
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logRelease files / topos_mcp-0.6.0-py3-none-manylinux_2_34_aarch64.whl
| Download URL | topos_mcp-0.6.0-py3-none-manylinux_2_34_aarch64.whl |
|---|---|
| Size | 13.4 MB |
| Tags | Linux glibc 2.34+ ARM64 Python 3 |
|
SHA-256 checksum How to use checksums |
598ab11aaae263f3dcf1414446e1f6f0ed6d97311d3378cb7ee9dc617b2e368a
|
|
BLAKE2b-256 checksum How to use checksums |
2cfd8fe02f358fc26fa0bffba3a05d19433c0bd55178423cc4f0e24b2cc13cb1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency logRelease files / topos_mcp-0.6.0-py3-none-macosx_13_0_arm64.whl
| Download URL | topos_mcp-0.6.0-py3-none-macosx_13_0_arm64.whl |
|---|---|
| Size | 10.1 MB |
| Tags | Python 3 macOS 13.0+ ARM64 |
|
SHA-256 checksum How to use checksums |
b098a806d12e00d44990e66b3d5a6ba4ebc6b9ad33454d499a635bb3973cfd6d
|
|
BLAKE2b-256 checksum How to use checksums |
16b69df88fb3554553d2571ba1b7b2282d48498869e2b53d1d83ee8e9c36b289
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.14
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Sep 16, 2026.
Transparency log