🔍 repo-xray

X-ray any codebase in seconds.

---

A fast, local CLI tool that analyzes any Git repository — local or public GitHub — and gives you an instant overview of the codebase. No accounts, no cloud, no telemetry. Just point it at a repo and get answers.

✨ What you get

🔍 REPO XRAY
────────────────────────────────────────

📊 CODEBASE
Files:           312
Lines of code:   18,492
Languages:
  Python         71%  ██████████████░░░░░░
  JavaScript     19%  ████░░░░░░░░░░░░░░░░
  Other          10%  ██░░░░░░░░░░░░░░░░░░

🐘 LARGEST FILES
82.1 MB   data.json
41.3 MB   model.pkl
1.2 MB    src/generated.py

📦 DEPENDENCIES
42 dependencies found
requirements.txt
pyproject.toml
package.json

⚠️  POSSIBLE ISSUES
14 TODO/FIXME comments
3 empty exception handlers
4 unpinned Python dependencies
2 source files over 2,000 lines

🔐 POSSIBLE SECRETS
.env found
config.py:18 — API_KEY = "sk-****91x"

🧹 JUNK
__pycache__ directories: 14
.DS_Store files: 3
*.pyc files: 31

────────────────────────────────────────
X-Ray completed in 1.4s

📦 Installation

pip install repo-xray

Requires Python 3.10+.

🚀 Usage

Analyze a local project

repo-xray .
repo-xray /path/to/project

Analyze a public GitHub repository

repo-xray https://github.com/user/repo

The repository is cloned to a temporary directory, analyzed, and cleaned up automatically.

Options

repo-xray . --largest 20      # Show top 20 largest files
repo-xray . --no-secrets      # Skip secret detection
repo-xray . --json            # Machine-readable JSON output
repo-xray . --verbose         # Verbose output
repo-xray --version           # Show version

🔧 Features

Codebase Analysis

• Total files and lines of code
• Language breakdown with percentages
• Largest files and largest source files
• Deepest directory paths

Dependency Detection

• Recognizes requirements.txt, pyproject.toml, Pipfile, package.json, Cargo.toml, go.mod, Gemfile, and more
• Counts dependencies where parsing is straightforward
• Flags unpinned Python dependencies

Code Smell Detection

• TODO, FIXME, HACK, XXX, WORKAROUND comments
• Python except: pass patterns
• Source files over 2,000 lines
• Empty source files
• Duplicate filenames across directories

Secret Detection

• .env files
• Private key headers (-----BEGIN RSA PRIVATE KEY-----)
• API keys, tokens, passwords
• AWS access keys, GitHub tokens, Bearer tokens
• All values are masked — never printed in full

Junk Detection

• .DS_Store, Thumbs.db, desktop.ini
• .pyc files, __pycache__ directories
• Log files
• Unusually large files (> 5 MB)

Output Formats

• Rich terminal output with colors, bars, and tables
• JSON mode (--json) for piping into other tools

🔒 Privacy & Security

repo-xray runs 100% locally. Your code never leaves your machine.

• No accounts or authentication required
• No telemetry or analytics
• No data uploaded anywhere
• Secret detection only shows masked values — full secrets are never displayed
• GitHub URL cloning uses --depth 1 and cleans up temporary files immediately

Important: Secret detection finds possible secrets based on patterns. These are not confirmed vulnerabilities — always verify findings manually.

🗺️ Roadmap

• Cyclomatic complexity estimation
• Git history analysis (contributor count, commit frequency)
• License detection
• Framework detection (Django, React, FastAPI, etc.)
• Custom ignore patterns via CLI flag
• Export reports to HTML/Markdown
• Pre-commit hook integration

🤝 Contributing

Contributions are welcome! Here's how to get started:

git clone https://github.com/user/repo-xray.git
cd repo-xray
python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
pip install -e ".[dev]"

Run tests:

pytest

Run against the repo-xray codebase itself:

repo-xray .

Guidelines

• Keep it fast — no heavy dependencies or network calls during analysis
• Low false-positive rate — prefer missing an edge case over spamming the user
• Clean terminal UX — output should be scannable in under 5 seconds
• Simple, maintainable Python — no over-engineering

📄 License

MIT — see LICENSE.