Coming soonOpen-source release on GitHub
A Claude Code plugin · multi-language · MIT
DeepMap searches your code three ways at once: graph (how code connects), vector (what code means)
and full-text (names and keywords, with fuzzy matching for typos and spelling). It fuses the three into
one ranked list. Then Claude reasons over it, with a file:line on every result and a confidence
label on every link.
At a glance
you ask“Find the code that retries failed uploads.”
symbolfile:lineone-line summary
What DeepMap does
Graph + Vector + FTS, fused into one ranked list.
A bundled skill tells Claude to follow the links and read the cited code.
A file:line on every result, a confidence label on every link.
How it retrieves
One call to deepmap_search runs all three at once and merges their rankings. You never pick a mode.
Your code as nodes and links in Neo4j, a graph database. In search, code with more callers ranks higher. For “what breaks”, DeepMap walks the links backwards, up to 3 hops, across calls and framework wiring.
“Who calls this? What depends on the User model?”
Each function, method and class gets a one-line intent summary. A local model on your CPU turns it into an embedding: a list of numbers that captures meaning. Vector search then finds code by what the code does, even when your words don't appear in it.
“Find the code that retries failed uploads.”
Full-text search (FTS) matches your words against names and summaries, the way a search engine does, and ranks the hits by relevance. It is fuzzy: a typo or a different spelling still finds the name.
“retry_faild_charges” still finds retry_failed_charges.
Reciprocal Rank Fusion (RRF), a standard way to combine ranked lists, merges the three rankings into one. A result that several modes agree on rises to the top.
Class.method name.The problem
Text search is perfect for finding a name. But “what breaks if I change this?” is about connections, and many never appear as text. Vector search alone finds similar code. It cannot follow a call chain.
“What breaks if I change charge_card()?” in a six-file example app with a checkout API and a background job.
$grep -rn "charge_card(" .
./billing/payments.py:4:def charge_card(order, amount):
./jobs/retries.py:12: return charge_card(order, amount_due)
./shop/cart.py:8: return charge_card(order, total)
./tests/test_payments.py:6: assert charge_card(order, 0)
$grep -rn "place_order(" .
./admin/tools.py:4:def place_order(form):
./api/orders.py:12: return place_order(order)
./shop/cart.py:5:def place_order(order):
$grep -rn "create_order" .
./api/orders.py:10:def create_order(order: dict):
$grep -rn "retry_failed_charges" .
./jobs/retries.py:10:def retry_failed_charges(order, amount_due):
$grep -rn "@app." .
./api/orders.py:9:@app.post("/orders")
./jobs/retries.py:9:@app.taskFive searches, and only if you know to look for the decorators.
›/deep-map:impact "charge_card"
6 dependent(s) of 'charge_card' (reverse reachability; hop · via · confidence):
Note: 2 edge(s) are AMBIGUOUS (the name maps to multiple symbols, or a reflective/dynamic hop) — verify by reading the source.
Computed by DeepMap, not drawn. These rows were produced by its own extraction and
link grading on this example app. Each row: confidence label · hops away (1h is a direct caller) · kind of link ·
dependent → what you asked about · file:line.
Changing charge_card() reaches six places within 3 hops:
place_order (shop/cart.py:5), retry_failed_charges (jobs/retries.py:10) and one test.retry_failed_charges is registered as a Celery task, so it also runs outside any web request.POST /orders → create_order → place_order. DeepMap marked that path
AMBIGUOUS because two functions are named place_order, so I opened api/orders.py:12 and confirmed that it calls the one in shop/cart.py.Update the three callers, then re-run the order and billing tests.
In a real codebase most call links are AMBIGUOUS (known limits). Claude's answer is an illustration written by us.
Why it's more than retrieval
DeepMap ships a reasoning skill with the tools: a set of instructions Claude Code loads with the plugin. It tells Claude how to use the graph, and when not to.
What the skill tells Claude
file:line before answering. A result is a lead to confirm.Every result points to a file:line you can open. Every link in the graph carries one of three confidence labels.
Declaration and target in the same file, like a route decorator above its handler. Import lines too. Solid.
Only one function, method or class has that name, so the link points there. Likelier, but still a name match: a call on another object with that name can land on it.
The name matches more than one symbol. A lead, not a fact: open the file:line and verify.
Setup reports a verdict too. It ends READY, DEGRADED or FAILED, and DEGRADED names the
gap. /deep-map:status compares the graph with your latest commit.
The wiring frameworks hide
A URL runs a handler. A service is injected. A job is scheduled. A delete cascades. None of that is written as a call. DeepMap reads these declarations in 6 ecosystems and stores each as a typed link Claude can follow. This layer is DeepMap's own, added on top of the parsed code graph; every other language still gets calls and imports.
Find your stack. A dash marks a link DeepMap doesn't read yet.
| Ecosystem | Routes | Injected dependencies | Jobs & schedules | Events & signals | Hooks & callbacks | Cascading deletes | Model relations | View renders |
|---|---|---|---|---|---|---|---|---|
| Python | Flask, FastAPI, Django URLconfs, click commands | FastAPI Depends |
Celery, APScheduler | Django signals | Flask and FastAPI hooks | SQLAlchemy cascade, ondelete; Django on_delete |
SQLAlchemy (classic and Mapped[...]), Django |
- not read |
| Ruby on Rails | routes.rb |
- not read | - not read | - not read | model callbacks | dependent: |
ActiveRecord | .erb views and partials |
| C# / .NET | ASP.NET Core attributes, minimal APIs (named handlers) | constructor parameters, service registrations | - not read | - not read | - not read | EF Core OnDelete |
EF Core | - not read |
| Java | Spring MVC | constructor, @Autowired |
@Scheduled |
@EventListener |
- not read | JPA cascade |
JPA | - not read |
| Go | Gin, Echo, Fiber, Chi, net/http | constructor functions | - not read | - not read | - not read | GORM OnDelete |
GORM | - not read |
| TypeScript / JavaScript | NestJS, Express, Fastify, koa-router, Hono, Next.js route handlers, Angular (named handlers) | NestJS and Angular constructors, @Inject; tsyringe, InversifyJS, TypeDI |
NestJS @Cron, @Interval, @Timeout; Bull @Process |
NestJS @OnEvent, microservice and WebSocket handlers |
NestJS guards, interceptors, pipes, filters, middleware; TypeORM entity listeners; Angular route guards | TypeORM onDelete, MikroORM deleteRule, a remove cascade |
TypeORM, MikroORM | - not read |
Not read yet: in Python, Django REST framework routers and SQLModel models; in TypeScript and JavaScript, GraphQL resolvers, Prisma and Sequelize models, Next.js middleware and server actions, and Vue or React Router tables; and any framework wiring in Rust.
Pattern-based readers, each with committed tests. A link a reader can't resolve is dropped, never invented.
Cascades live in model declarations, not calls. DeepMap follows them hop by hop in Rails, Django, SQLAlchemy, EF Core, JPA, GORM and TypeORM.
›/deep-map:impact "Customer"
4 dependent(s) of 'Customer' (reverse reachability; hop · via · confidence):
Rows read right to left, as in the chain. They are INFERRED because a cascade target is matched to its model class by name. Computed by DeepMap on a five-model Rails example.
Works for cascades declared in model code (EF Core: an explicit
OnDelete only). A set-null rule is recorded as a cascade link too, so open the declaration to check.
Not read yet: ON DELETE rules that live only in migrations or the database.
| Link | Meaning | In the default walk |
|---|---|---|
CALLS | One function calls another (matched by name) | Yes |
ROUTES_TO | An HTTP route or CLI command runs this handler | Yes |
DEPENDS_ON | The framework injects this dependency | Yes |
SCHEDULED_AS | A background or scheduled job | Yes |
TRIGGERS | An event or signal fires this listener | Yes |
HOOKS | A lifecycle hook or callback runs this | Yes |
INHERITS | A class extends another (in Go, struct embedding) | Yes |
CASCADES | Deleting the owner deletes or nullifies this | Yes |
RENDERS | A Rails view renders a partial | Yes |
HAS_MANY · REFERENCES | Model relations: ORM associations and foreign keys | Opt-in (DEEPMAP_IMPACT_PROFILE=orm) |
IMPLEMENTS | A class implements an interface | No |
DISPATCHES | A reflective call (always labeled AMBIGUOUS) | No |
IMPORTS | A module imports another | No |
Languages
A multi-language tree-sitter engine parses all 25 into the same code graph (functions, classes, calls, imports), and all three search modes cover every one. Of these, 8 also have their own end-to-end test suites, built from real extractor output, and 6 ecosystems get DeepMap's own framework wiring on top.
All 25 programming languages
| Language | Graph + Vector + FTS | Own end-to-end tests | Search, proven end-to-end | Framework wiring |
|---|---|---|---|---|
| 8 languages with their own end-to-end test suites | ||||
| Python | ✓ yes | ✓ yes | ✓ yes | ✓Flask, FastAPI, Celery; Django URLs, signals and models; SQLAlchemy |
| JavaScript | ✓ yes | ✓ yes | - not yet | ✓Express, Fastify, koa-router, Hono, Next.js |
| TypeScript | ✓ yes | ✓ yes | ✓ yes | ✓NestJS, Express, Fastify, koa-router, Hono, Next.js, TypeORM, MikroORM, Angular |
| Go | ✓ yes | ✓ yes | ✓ yes | ✓Gin, Echo, Fiber, Chi, net/http, GORM |
| Rust | ✓ yes | ✓ yes | ✓ yes | - none |
| Java | ✓ yes | ✓ yes | - not yet | ✓Spring MVC, JPA |
| Ruby | ✓ yes | ✓ yes | - not yet | ✓Rails, ActiveRecord, .erb views |
| C# | ✓ yes | ✓ yes | - not yet | ✓ASP.NET Core, EF Core |
| 17 more through the same engine and pipeline; Pascal/Delphi also has its own test suite | ||||
| C | ✓ yes | - not yet | - not yet | - none |
| C++ | ✓ yes | - not yet | - not yet | - none |
| PHP | ✓ yes | - not yet | - not yet | - none |
| Kotlin | ✓ yes | - not yet | - not yet | - none |
| Scala | ✓ yes | - not yet | - not yet | - none |
| Swift | ✓ yes | - not yet | - not yet | - none |
| Lua | ✓ yes | - not yet | - not yet | - none |
| Elixir | ✓ yes | - not yet | - not yet | - none |
| Objective-C | ✓ yes | - not yet | - not yet | - none |
| Julia | ✓ yes | - not yet | - not yet | - none |
| Bash | ✓ yes | - not yet | - not yet | - none |
| PowerShell | ✓ yes | - not yet | - not yet | - none |
| Groovy | ✓ yes | - not yet | - not yet | - none |
| Zig | ✓ yes | - not yet | - not yet | - none |
| Fortran | ✓ yes | - not yet | - not yet | - none |
| Verilog | ✓ yes | - not yet | - not yet | - none |
| Pascal/ | ✓ yes | ✓ yes | - not yet | - none |
Call coverage varies. Calls on objects (order.save()) are mostly missing in every
language we tested, and so are Python module.func() calls (known limits).
Get started
Three steps, all inside Claude Code. No terminal, no API key, no Docker.
Coming soon: The public repository opens shortly. These commands work as soon as it is live.
Needs Claude Code, Python 3.10+ and Java 17 or 21. Tested on Windows 11 and Linux; macOS not verified yet.
In Claude Code:
/plugin marketplace add deepfusionlabs/deep-map
/plugin install deep-map@deepfusionlabsIn Claude Code, with your project open:
/deep-map:setupThe first run installs DeepMap's own Python environment, downloads the embedding model and Neo4j, builds the graph and starts the local servers. Your own Python is never touched.
A new session connects the tools. Then ask in plain English:
The first setup on a machine downloads about 1 GB once (3–11 minutes in our runs). On a busy machine, setup
took 12–14 minutes on projects of about 700–1,300 symbols. To add another project, run
/deep-map:setup inside it.
~/.deepmap/venv, and every /deep-map command uses it. A
Python that already has them, from the terminal installers, is used as is. On Debian and Ubuntu, setup
needs the python3-venv package and names the command that installs it.install.sh and
install.ps1. They install the packages into the Python they find, download the model (about
0.6 GB, like setup), run setup and add the git hook./deep-map commands/deep-map:setup | Set up DeepMap for this project, or repair it. Safe to re-run. |
/deep-map:refresh | Update the graph after code changes. Re-embeds only what changed and removes deleted code. |
/deep-map:impact "<symbol>" | The impact report on demand. |
/deep-map:status | What's in the graph, whether it is behind your latest commit, and whether the servers are up. |
/deep-map:doctor | A full health check with a next step for anything that isn't OK. |
/deep-map:enrich | Opt-in: better summaries for undocumented code, written by Claude on your own plan. |
/deep-map:version | Which version is loaded right now. |
/deep-map:plugin-update | Updates DeepMap for you, then tells you how to load the new version. |
Architecture
Proven open-source parts in one local pipeline: a graph database, a vector index and a full-text index, with a reasoning skill on top.
deepmap_search (graph + vector + full-text, fused into one ranked list), deepmap_impact
(the backwards graph walk), deepmap_cypher (read-only Cypher for structure questions: list, count,
group, paths) and deepmap_embed (any text, embedded with the same model)./deep-map commands.file:line.http://127.0.0.1:7474 for your first project): sign in as neo4j with the
password deepmap, a local development password on a localhost-only port, and run your own Cypher,
Neo4j's query language, such as MATCH (a)-[r:ROUTES_TO]->(h) RETURN a, r, h LIMIT 25.deepmap_cypher, read-only: writes are refused, and each answer
is bounded in time, rows and size, without embedding vectors./deep-map:status lists every instance: running or stopped, its size, and when it was last used.Reliability engineering
Claude decides when to use a tool, and that decision can fail. A graph can fall behind your code. An outage can look like an empty answer. Seven layers cover these.
After a reboot, a hook revives this project's database and servers and tells Claude whether the graph is ready, stale or incomplete. If the code changed, it also refreshes the graph in the background.
Before a text search, a once-per-session reminder that the tools exist. Never blocks.
After an edit, a once-per-session note that the graph may be stale. Never blocks.
Each commit re-syncs the graph in the background.
The bundled skill's five rules, shown above.
An outage is reported as an error, never as an empty result. If the embedding model can't load, search falls back to keywords and says so.
A test fails if the ranking functions change, so the ranking formula can't change unnoticed between releases.
across 10 areas, from setup and search to hooks and failure modes.
each fix starts as a test that fails on the old code.
fuzz each of the Rails, C#, Java, Go and TypeScript framework readers.
AI test agents ran the cases on live database instances, two independent AI reviewers re-checked the findings of the main test runs, and a maintainer decides what ships (AI policy (available at launch)).
License, privacy and limits
By default nothing DeepMap builds leaves your machine. The database listens only on localhost.
DeepMap collects no telemetry, and setup switches off Neo4j's own usage reporting.
By default no LLM parses or summarizes your code. The embedding model runs on your CPU.
DeepMap is MIT-licensed. It runs on a local Neo4j Community Edition instance (GPLv3), which DeepMap downloads from the official source but does not redistribute or modify, and accesses over the standard Bolt protocol. DeepMap's own MIT-licensed code is independent of Neo4j's license. If you use DeepMap commercially, review Neo4j's licensing terms (or consult counsel) for your use of Neo4j Community.
run(), links to every function called run, so in a real codebase most call links are
AMBIGUOUS (83–98% in three measured codebases), and Claude is told to open the file:line and verify.
A stricter mode, DEEPMAP_PRECISE_CALLS=1, keeps the parser's exact target instead; it is opt-in.order.save(), are mostly missing from the graph, even when the code
declares the object's type; calls on self or this are kept. We saw this in Python,
TypeScript, Go, Rust and C#. In Python, module.func() calls and calls at module level are missing too.
An opt-in, type-based call linker for Python, TypeScript and JavaScript
(DEEPMAP_TYPED_CALLS=python,typescript,javascript) links many of these calls by the object's
declared type. It is off by default: in our measurement it added no wrong links, but it has not yet passed
every check we set for it in advance.FAQ
It reports what it can trace; it is not a proof. Every link carries a confidence label, Claude is told to confirm AMBIGUOUS ones by reading the code, and the known limits say what the graph misses.
Yes. DeepMap is open source under the MIT license, with no new subscription or API key. You need Claude Code.
Not by default. The one opt-in exception is enrichment, which sends undocumented functions to Claude under your
own Claude Code login (/deep-map:enrich, off by default). That is the same place Claude Code already
sends your code. One network call you may see: a
sync started by the git hook lets the model library ask huggingface.co whether its files are current. It sends
nothing about your code, and HF_HUB_OFFLINE=1 turns it off.
A search takes about half a second (median). Two small hooks run before a Grep or Glob and after an Edit or
Write, 0.3–1.4 seconds per run, and one runs after each search, impact or Cypher call. The background refresh runs at low CPU
priority. DEEPMAP_NUDGE=0 and DEEPMAP_SYNC_FLAG=0 silence the first two hooks;
DEEPMAP_HOOKS=0 turns off every DeepMap hook, the session-start self-heal and background refresh
included.
About 2–3 GB of RAM per project while it runs: a Neo4j database process (Java heap capped at 512 MB by default)
and two local servers that keep the embedding model loaded. DeepMap's command-line tool can hibernate
idle projects' databases and stop a project's servers. Disk: about 2.5–3.2 GB, plus each project's graph.
When an interactive session starts and your code changed since the last build, DeepMap refreshes the graph in
the background: offline, at low CPU priority, at most once every 15 minutes for the same commit. It skips a
project whose sync takes more than 20 minutes (DEEPMAP_AUTO_SYNC_MAX_S raises the limit), and
/deep-map:status says why. Claude is told
that it is running and how it ended. It is not a file watcher, and it removes a deleted symbol only when it
re-read that file or the file is gone, so /deep-map:refresh is still the full clean-up and brings in this session's
edits at once; a refresh you start takes over. The optional git hook (setup prints the command) also re-syncs
after each commit, but only adds and updates. DEEPMAP_AUTO_SYNC=0 turns the background refresh
off.
Yes. Each project gets its own isolated Neo4j instance and ports from one shared install. There are no cross-repository queries. Already running Neo4j yourself? DeepMap leaves it alone and uses the next free port.
Use a language server too: it resolves calls by type, which DeepMap's default graph doesn't, and Claude Code can reach it through LSP plugins. Many tools now give AI agents a call graph, and some also combine graph, vector and keyword search. DeepMap's focus is the wiring frameworks hide from a call graph: routes, injected services, jobs, events, callbacks and cascading deletes, read in six ecosystems and walked together with calls in one impact query, with a confidence label on every link. It all lives in a real database on your machine, under the MIT license.
Not supported. DeepMap's tools run on standard MCP servers on your machine, so another MCP client could call them, but the skill, hooks, slash commands and setup are built for Claude Code, and nothing else is tested.
Update with /deep-map:plugin-update, then start a new session. There's no uninstall command yet, so
removal is manual. In each project, stop its servers and database and remove its git hook with DeepMap's
provisioner, build/provision.py (mcp-stop, stop,
git-hook --uninstall), or ask Claude to. Then remove the
plugin in Claude Code's /plugin menu and delete .deepmap/ and the two DeepMap entries in
.mcp.json. DeepMap's Python environment, the Neo4j download and every graph stay under
~/.deepmap, and the model in your Hugging Face cache, until you delete them.
Also from DeepFusion Labs
DeepInit writes the truth about your codebase into the context your agent reads before it starts: the real rules, the live database schema, the why, each claim checked against your code. See DeepInit →
Coming soonOpen-source release on GitHub
MIT, no API key. Install it once, then just ask.