Getting Started

Analyze a GitHub or GitLab repository to explore its structure, file dependencies and detected security findings. Analysis time and coverage depend on the repository.

Quickstart

Authentication

Xolvyn uses OAuth-based authentication through Auth.js. You can sign in using your GitHub or GitLab account — no separate password required.

Supported Providers

How It Works

Private Repositories

Analyzing private repositories requires authentication. When you log in via GitHub or GitLab, Xolvyn stores your OAuth token and uses it to authenticate git clone operations.

How Private Cloning Works

Private cloning uses authorized provider credentials supplied to the server-side clone operation. The examples below omit credentials:

# Public repo (no token needed)
git clone --depth 1 https://github.com/owner/repo

# Private repo (authorized credentials supplied separately)
git clone --depth 1 https://github.com/owner/private-repo

Data Handling

Dependency Graph

The dependency graph maps resolved imports between supported source files. It is a structural view of the analyzed revision, not a call graph or runtime trace.

Node Colors (Layers)

Interactions

Click any node to inspect it in the Auditor Panel. Use the minimap to navigate large graphs. Toggle fullscreen mode with the expand button. Zoom and pan are fully supported via mouse or trackpad.

Security Audit

Available checks analyze supported files and dependencies. Review which checks completed; no findings does not mean the repository is secure.

What We Scan For

Scoring

The analysis displays a grade and a score alongside the assessed maximum. The score reflects completed checks; it is not a security certification.

AI Mentor (@mentor)

The @mentor is an AI assistant using repository analysis as context. Its answers are interpretations; check important claims against the linked files.

How to Use

Example Prompts

In the workspace file reader, Explain from source is a separate, optional action. Choose an excerpt, review the source-sharing notice, then explicitly send it to Google Gemini. It uses the same message limits and AI-credit rules as @mentor. Source is not added to chat history or saved by Xolvyn. Generated interpretations and your corrections remain in tab memory until reload and can be included in an explicit area-brief export. Citation ranges are checked, not the reasoning; confirm provider-retention terms before sharing private code.

PR Impact Analysis

PR impact views highlight changed files and their import dependents. Review these as potential structural impact, not a prediction that execution will fail.

Status Labels

VS Code Extension

A VS Code extension is in development and will ship with Pro.

API Reference

Xolvyn exposes a single REST endpoint for programmatic analysis.

POST /api/analyze

Analyzes a GitHub or GitLab repository and returns a dependency graph plus an audit report.

curl -X POST https://your-domain.com/api/analyze \
  -H "Content-Type: application/json" \
  -d '{"repo_url": "https://github.com/expressjs/express"}'

Request Body

Response

{
  "dependency_graph": {
    "nodes": [{ "id": "src/app.ts", "layer": "core" }],
    "edges": [{ "from": "src/app.ts", "to": "src/routes.ts" }],
    "stats": { "total_modules": 47 }
  },
  "audit_report": {
    "summary": {
      "score": 82,
      "grade": "A",
      "total_files": 47,
      "security_issues": 2,
      "style_violations": 5,
      "scan_duration": "1.2s"
    }
  },
  "persisted": true
}

Error Codes

Credits & Billing

Xolvyn uses a credit-based system. Each analysis costs 1 credit.

Credit Allocation

Check the pricing page for current plan allowances and your dashboard for available credits. Limits differ by plan and analysis type.

How Credits Are Deducted

1 credit is deducted after a successful analysis. If the analysis fails (e.g., timeout, clone error), no credit is deducted. You can view your balance on the Dashboard.

FAQ