Skip to main content

Topos

the agent harness for structural code quality

Topos measures complexity, coupling, risky data flows, and agent cognitive load, then gives your agent a concrete target—from SLOP to PLATINUM.

Topos self-evaluation: SIMPLE, COMPOSABLE, SECURE, NAVIGABLE results for the core crates Install Topos MCP in VS Code PyPI License Topos MCP server ClawHub

Install · What it checks · Under the hood · Docs · Issues


Why Topos

Coding agents produce working code quickly. The harder question is whether the result is still easy to understand, safe to change, and well-fitted to the rest of the repository. Quality is the new currency.

Topos computes that signal from program structure—not from an LLM review or a style opinion—and returns concrete failure locations and next actions. It is fast enough to sit inside the agent loop: measure, edit, verify, repeat.

Tests check behavior. Topos checks whether the implementation is built to keep changing.

Grounded in category theory, written in Rust.

Install and Quick Start

One binary. Every supported agent harness. A clean way back out.

1. Install the CLI

Use the verified release installer:

curl -fsSL https://docs.krv.ai/topos/install.sh | bash

Or install with Homebrew:

brew install krv-labs/tap/topos

On Homebrew 6+, that fully qualified one-liner auto-taps and trusts only this formula. If you brew tap krv-labs/tap first, run brew trust --formula krv-labs/tap/topos before brew install topos.

2. Connect your coding agents

topos install detects every supported MCP harness and lets you configure any—or all—of them from one interactive checklist:

topos install
┌  Which agent integrations do you want to configure?
│
│  ↑↓ move · space toggle · a all · enter confirm · esc cancel
│
│ ❯ ○ Claude Code          (detected)
│   ○ Claude Desktop       (detected)
│   ● Codex CLI            (✓ active)
│   ● Gemini CLI           (✓ active)
│   ○ GitHub Copilot CLI   (detected)
│   ○ Cursor               (detected)
│   ○ VS Code              (detected)
│   ○ Google Antigravity   (detected)
│   ○ pi                   (detected)
│   ○ OpenCode             (detected)
└

Restart the agents you configured, then ask:

"Use Topos to find this repository's worst structural problem, make one focused improvement, and verify the result."

See the agent setup guide for permissions, manual configuration, and troubleshooting.

3. Evaluate from the terminal

topos evaluate . -r

Topos discovers Python, Rust, JavaScript, TypeScript, C++, and Go automatically. Pass --language only when you want to narrow the run.

Reviewing a pull request instead? topos pr-recap 5 gives a structural before/after card and debt ledger for the PR's changed files — no LLM, fully reproducible, with presets calibrated across 1,609 open-source pull requests (PR Recap calibration · lab notes).

See Installation for platform support and alternative install paths.

What Topos checks

Every file gets four independent verdicts:

  • SIMPLE — avoids unnecessary complexity using AST entropy and control-flow complexity.
  • COMPOSABLE — limits a file's outward dependency burden; broader coupling and stability metrics remain available for diagnosis.
  • SECURE — avoids dangerous API reachability and taint paths in the code property graph.
  • NAVIGABLE — stays shallow enough for an agent to read and change in one pass, using depth-weighted nesting divergence over the AST scope tree.

Those verdicts roll up into one memorable quality medal without hiding which pillar failed:

Medal Criteria
🏆 PLATINUM Passes all 4
🥇 GOLD Passes 3 of 4
🥈 SILVER Passes 2 of 4
🥉 BRONZE Passes 1 of 4
❌ SLOP Passes 0, or fails to parse

See the full metrics reference. Refactor guidance also surfaces control-flow cycles, load-bearing dependency edges, and process bottlenecks.

How the medal system is derived

The four pillars are pairwise incomparable and form a sixteen-element evaluation lattice (a 4-cube); PLATINUM is their intersection. Labels below abbreviate the pillars as Simple, Composable, Sc = Secure, Navigable.

The full evaluation lattice — SLOP at the bottom, four single-pillar BRONZE states, six two-pillar SILVER states, four three-pillar GOLD states, and IDEAL (PLATINUM) at the top.

Measures · Category-theory foundations

Under the hood

Topos is a self-contained Rust CLI and MCP server. Analysis runs locally; your source code is not sent to an external model or hosted analysis service.

Component Role
tree-sitter Parses six languages and powers the native AST, CFG, CPG, PDG, and UAST representations.
GitNexus Supplies the repository dependency graph scored by COMPOSABLE (topos depgraph generate). Requires npm install -g gitnexus@1.6.8.
Sighthound Embedded in the MCP server for supplementary security findings; native CPG probes remain the SECURE scoring source.

The result is one agent-facing contract over several structural lenses: one score to optimize, explicit evidence for each failure, and a verification loop that can tell a real improvement from cosmetic churn.

More ways to use Topos

Distribution

Topos ships four ways:

  • GitHub Releases — the topos CLI binary (macOS/Linux), via install.sh or a direct release download.
  • PyPI — topos-mcp, a thin bin-wheel bundling the MCP server binary (pip install topos-mcp / uvx topos-mcp), zero Python runtime.
  • VS Code Marketplace — the Topos extension, bundling platform binaries.
  • Docker — a container image for Glama and other MCP-registry hosting.

Crate layout and adapter details: docs.krv.ai/topos/architecture.

Contributing

Topos is used internally at Krv Labs to manage AI-agent code output. We welcome bugs, ideas, and contributions.


Full documentation · Measures and metrics · Engineering notes

Made by Krv Labs   Topos lattice verdict

Metadata

Release files for topos-mcp 0.14.0

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Built distributions (wheels)

Table of built distributions (wheels) for topos-mcp 0.14.0
File Interpreter ABI Platform Actions
topos_mcp-0.14.0-py3-none-manylinux_2_34_x86_64.whl Python 3 none Linux glibc 2.34+ x86-64 Details for topos_mcp-0.14.0-py3-none-manylinux_2_34_x86_64.whl
topos_mcp-0.14.0-py3-none-manylinux_2_34_aarch64.whl Python 3 none Linux glibc 2.34+ ARM64 Details for topos_mcp-0.14.0-py3-none-manylinux_2_34_aarch64.whl
topos_mcp-0.14.0-py3-none-macosx_13_0_arm64.whl Python 3 none macOS 13.0+ ARM64 Details for topos_mcp-0.14.0-py3-none-macosx_13_0_arm64.whl

Total release size: 40.4 MB

Release files / topos_mcp-0.14.0-py3-none-manylinux_2_34_x86_64.whl

Download URL topos_mcp-0.14.0-py3-none-manylinux_2_34_x86_64.whl
Size 14.9 MB
Tags Linux glibc 2.34+ x86-64 Python 3
SHA-256 checksum
How to use checksums
7758078f399ae75fc4857f5289aadebfc9833dfca098adbdb7d19b6a15a6a4a8
BLAKE2b-256 checksum
How to use checksums
1ab210e19e89f66dd08c41b28da898c60247df9d6055edfa4ff85e2f7e9cd9aa
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

Release files / topos_mcp-0.14.0-py3-none-manylinux_2_34_aarch64.whl

Download URL topos_mcp-0.14.0-py3-none-manylinux_2_34_aarch64.whl
Size 14.5 MB
Tags Linux glibc 2.34+ ARM64 Python 3
SHA-256 checksum
How to use checksums
8014d3c5da326c38a82c0aad976f83d16809831cfa7743554df30cd7eae7fff1
BLAKE2b-256 checksum
How to use checksums
4689e80f63ef810b4907eb7778e94845c3c62a8e4d3ade8a2c60c4f7b5925c53
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

Release files / topos_mcp-0.14.0-py3-none-macosx_13_0_arm64.whl

Download URL topos_mcp-0.14.0-py3-none-macosx_13_0_arm64.whl
Size 11.0 MB
Tags Python 3 macOS 13.0+ ARM64
SHA-256 checksum
How to use checksums
5677a25e159e119dcee26e4a09362d10562a8a8da8e2b88049a3dafeba979fb2
BLAKE2b-256 checksum
How to use checksums
246d29d1e55259554290b67afb9ea6c96c85a332a102ba298fec0d533f900df7
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/7.0.0 CPython/3.13.16

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

Security for topos-mcp 0.14.0

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 3 files in this release have been uploaded with provenance metadata.

Select from 3 files

Attestation for topos_mcp-0.14.0-py3-none-manylinux_2_34_x86_64.whl

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Oct 23, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

To learn more about protecting yourself from malicious actors, visit our package security documentation.

Release history Release notifications | RSS feed

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page