CLI Commands

The CodeRadius CLI (cr) is the primary interface for analyzing architectural data, evaluating impact, running governance checks, and managing infrastructure. All commands are available after installing the CLI globally.

curl -sSL https://cdn.coderadius.ai/install.sh | bash

Quick Start

# Start infrastructure
cr up

# Analyze your codebase architecture
cr analyze code ./services/*

# Open the Architecture Dashboard
cr ui

# Predict blast radius of code changes
cr blast

# Connect coding agents to the graph
cr mcp configure

Global Usage

cr [command] [subcommand] [options]
cr --version
cr --help

Command categories:

Init

Initializes the CodeRadius workspace for the current directory or user environment.

What it does:

1. Creates ~/.coderadius/config/settings.json with LLM provider configuration (Google Vertex AI, Google AI Studio, Anthropic, OpenAI, or Ollama)
2. Creates ~/.coderadius/config/credentials.json (chmod 600) for API keys
3. Interactively generates a .crignore file using AI analysis of the current directory tree to exclude frontend noise, vendored dependencies, and generated files
4. Optionally installs shell autocompletion for cr

cr init

This command is interactive. It requires no flags but walks you through several prompts.

Example session:

  ◆ Which LLM provider would you like to use?
  │  ● Google Vertex AI (GCP project required)
  │  ○ Google AI Studio (API key, simplest)
  │  ○ Anthropic Claude
  │  ○ OpenAI
  │  ○ Ollama (local, no API key needed)

  ◆ Google Cloud Project ID: my-gcp-project

  ◆ Default Model: gemini-3.1-flash-lite

  ◆ Do you want to run the AI now to generate a .crignore?
    Yes / No

{
    "ai": {
        "default": "vertex/gemini-3.1-flash-lite",
        "chat": "vertex/gemini-3.1-pro",
        "embedding": "openai/text-embedding-3-small"
    }
}

Architecture Analysis

Commands for analyzing codebases and building the architectural graph. All analysis commands are subcommands of cr analyze.

Analyze Code

The primary analysis command. Analyzes source code directories, parses configuration files, extracts tainted functions, and upserts all results into the Memgraph graph database. The --depth flag controls analysis depth.

cr analyze code [paths...] [options]

Arguments:

Options:

Depth Levels

Examples:

# Analyze the current directory (default: semantic depth)
cr analyze code

# Analyze multiple service roots
cr analyze code ./services/payments ./services/identity ./services/notifications

# Analyze all repos in a directory (glob)
cr analyze code ./repos/*

# Structure-only scan (no LLM, fast)
cr analyze code ./repos/* --depth structure

# Full data contract extraction
cr analyze code ./services/* --depth contracts

# Force complete re-analysis (no cache)
cr analyze code ./services/* --force

# CI mode: output JSON telemetry to stdout
cr analyze code --source-strategy ci --json

# Increase LLM parallelism for faster extraction
cr analyze code ./services/* --llm-concurrency 10

Telemetry Output:

After a successful analyze code run, the CLI prints a funnel report showing:

• Total repositories discovered
• Functions found by language
• Functions after taint filtering
• Functions sent to LLM for semantic extraction
• New nodes/edges written to the graph
• Total LLM token consumption and estimated cost

Analyze Traces

Analyzes runtime telemetry (distributed traces) from Datadog or Jaeger exports. Overlays the trace topology on top of the static graph, validating the static architecture against real runtime behavior.

cr analyze traces --file <path> [options]

Options:

Example:

# Analyze a Datadog traces export
cr analyze traces --file ./traces/datadog-export.json

# Analyze a Jaeger export
cr analyze traces --file ./jaeger-traces.json

Analyze Vuln

Scans all package dependencies in the graph for known vulnerabilities (CVEs) by querying the OSV.dev public database. Creates Vulnerability nodes and links them to affected Package nodes with version-aware edges.

This command can also run inline during cr analyze code via the --vuln flag.

cr analyze vuln [options]

Options:

Privacy: only public package names and versions are sent to OSV.dev. Source code, file paths, and repository metadata never leave the machine.

Examples:

# Scan all packages in the graph for vulnerabilities
cr analyze vuln

# Force refresh from OSV (bypass 24h cache)
cr analyze vuln --refresh

# Offline mode: use only cached vulnerability data
cr analyze vuln --offline

# Inline during code analysis
cr analyze code ./services/* --vuln

Graph impact:

Example Cypher query (which services have critical CVEs in production deps):

MATCH (v:Vulnerability)<-[hv:HAS_VULNERABILITY]-(p:Package)<-[dep:DEPENDS_ON]-(s:Service)
WHERE v.severity = 'CRITICAL' AND dep.isDev = false
  AND dep.installedVersion IN hv.vulnerableInstalledVersions
RETURN s.name, p.name, v.osvId, v.cvssScore

Impact Evaluation

Predicts the architectural blast radius of a code change in memory, without modifying the production graph. Returns a structured finding report at three severity levels (DANGER, WARNING, INFO) and emits a semantic exit code so CI / agents can branch without parsing the text output.

cr blast [path] [options]

The repo path is a positional argument and defaults to the current directory, matching the cr analyze convention. Pass an explicit path to evaluate a different workspace.

Exit codes:

Options:

Examples:

# Standard usage (current directory, default base origin/main)
cr blast

# Analyze a sibling repo
cr blast ../orchestrator

# Override base / head refs
cr blast --base main --head feature/redis-auth

# Describe the intent for better LLM context
cr blast -m "Migrate auth module to Redis"

# Output markdown for CI comment injection
cr blast --format markdown > report.md

# Analyze specific files without git
cr blast --files "src/payments/PaymentController.php"

# Advisory mode (never blocks CI)
cr blast --advisory

See Impact Evaluation for full integration instructions for GitHub Actions, GitLab CI, and Bitbucket Pipelines.

Governance Policy Check

Runs governance rules defined in YAML against the architecture graph. Returns violations at configurable severity levels.

cr check [options]

Options:

Examples:

# Run all rules in a directory
cr check --rules ./policies/

# Output as SARIF (for IDE integration)
cr check --rules ./policies/ --output sarif --out results.sarif

# Fail on warnings too
cr check --rules ./policies/ --fail-on warning

# Only run rules tagged "security"
cr check --rules ./policies/ --tag security

# Write evaluation results into the graph for dashboard visualization
cr check --rules ./policies/ --output graph

Architecture Dashboard

Generates the Architecture Dashboard — a unified view of organizational AI tooling observability, package dependencies, data gravity, governance alerts, and impact topology.

cr ui [options]

Options:

Example:

# Generate the dashboard and auto-open it
cr ui

# Generate with a timestamped filename
cr ui --out ./reports/health-$(date +%Y-%m-%d).html

# Focus the dashboard exclusively on the blast radius/impact topology
cr ui --focus impact

# Output raw JSON for CI pipelines
cr ui --json

See Architecture Dashboard for a full explanation of the dashboard domains and components.

Docs

Commands for generating and managing architecture documentation. All doc commands are subcommands of cr docs.

Generate Specifications

Generates a comprehensive ARCHITECTURE.md for a target service, including C4 diagrams and architectural risk analysis. Uses the LLM configured during cr init.

cr docs generate [options]

Options:

Example:

# Interactive service selection
cr docs generate

# Target a specific service
cr docs generate --target payments-service

# Generate for a specific service, output to a custom path
cr docs generate --target orders-api --output ./docs/architecture/orders.md

# Skip risk analysis (faster)
cr docs generate --target payments-service --skip-risk

The generated document includes:

• C4 Context and Container diagrams (Mermaid format)
• List of inbound consumers and outbound dependencies
• Architectural risk metrics: Blast Radius Score, downstream services impacted, critical data dependencies
• LLM-generated narrative describing the service's purpose, responsibilities, and risk profile

Agentic Chat

Opens an interactive terminal chat session with the CodeRadius Architect Agent — an LLM-powered agent with full access to your architectural graph via MCP tools.

cr ask

You can ask the agent questions like:

• "Which services consume the payments queue?"
• "What would break if I rename the customerId field in the orders table?"
• "Which teams have the highest SPOF exposure in the architecture?"

MCP Server

Commands for managing the Model Context Protocol (MCP) server integration with IDE agents.

Start Server

Starts the CodeRadius MCP server on stdio for IDE agent integration.

cr mcp start

Configure IDE

Interactive wizard that auto-detects installed IDE environments (Cursor, Windsurf, Claude Desktop, Claude Code, Gemini CLI, Antigravity) and injects the MCP server configuration automatically.

cr mcp configure

Infrastructure Management

Commands for managing the local infrastructure (Memgraph graph database).

Start Database

Starts the Memgraph graph database container using Docker and initializes the database schema.

cr up

What it does:

1. Runs preflight checks (Docker installed, daemon running, workspace initialized, port available)
2. Creates or restarts the Memgraph container on bolt://localhost:7687
3. Initializes the database schema and vector indexes

Stop Database

Stops the Memgraph container. Data is persisted in Docker volumes by default.

cr down [options]

Example:

# Stop, preserving data
cr down

# Stop and wipe all data
cr down --clean

State Management

Export and import architecture graph snapshots. Useful for sharing state between environments, version-controlling your graph, or disaster recovery.

State Export

Dumps the architecture graph to a .cypherl snapshot file (one Cypher statement per line, Git-diffable).

cr state export [options]

Example:

# Export to default file
cr state export

# Export to a specific path
cr state export --out ./backups/graph-$(date +%Y%m%d).cypherl

State Import

Restores the architecture graph from a .cypherl snapshot. By default, the existing graph is wiped before importing.

cr state import <file> [options]

Example:

# Restore from a snapshot (wipes current graph)
cr state import ./state.cypherl

# Additive import (layer on top of existing graph)
cr state import ./second-env.cypherl --no-wipe

# CI mode (no confirmation)
cr state import ./state.cypherl --force

Data Pruning

Destructive operations for removing data from the graph or cache. Use with caution — these operations cannot be undone.

Prune Graph

Permanently deletes all nodes, relationships, and indexes from the Memgraph database. Requires explicit confirmation.

cr prune graph [options]

After pruning, run cr analyze code to repopulate the graph.

Prune Cache

Clears all local caches (embeddings, classifiers, OSV, datastore assignments) and downloaded repositories. The next analysis run will re-analyze everything from scratch.

cr prune cache [options]

Prune All

Wipes the graph database AND deletes all local caches in a single operation.

cr prune all [options]

Grounding Review

Read-only commands for inspecting the trust attribution of entities in the graph. See the Grounding & Trust Tiers guide for the conceptual model.

Review Pending

Lists every inferred entity flagged with needsReview = true, grouped by node label. The engine flags entities when it cannot decide between competing signals, when a sanitizer fallback fires on a weak source, or when a mutation runs without a grounding argument (defensive catch).

cr review pending [options]

The command is read-only: it prints the triage list and exits. To act on a flagged entity, either accept the engine's inference (no action), tighten the source code so a static extractor catches it, or declare the entity in coderadius.yaml to override the tier with a declared source.

# All pending entities
cr review pending

# Only flagged MessageChannels
cr review pending --label MessageChannel

# Only LLM-inferred entities with quality medium or above
cr review pending --quality-at-least medium --source llm

# LLM-inferred OR heuristic-inferred (anything not from AST or composite)
cr review pending --source llm --source heuristic

Diagnostic Coverage Dump

The diagnostic script scripts/diag-graph-coverage.ts dumps every inferred entity in the graph with its grounding columns. Useful for sanity-checking an analysis, comparing two ingestion runs, or finding stale entities filtered by source.

bun run scripts/diag-graph-coverage.ts [options]

# Production-trust baseline: only what the AST extractor verified directly
bun run scripts/diag-graph-coverage.ts --source ast

# Trust above the noise floor
bun run scripts/diag-graph-coverage.ts --quality-at-least high

# Find what the LLM inferred for a single repo (so you can sanity-check it)
bun run scripts/diag-graph-coverage.ts --repo my-repo --source llm

Configuration

Commands for managing settings, team aliases, and shell completion.

Show Config

Displays the current resolved configuration — showing the merged result of global settings (~/.coderadius/config/settings.json), local .env file, and environment variables. Shows resolved provider and model per action context (default, ingest, chat, doc, mcp).

cr config show [options]

Team Alias Management

Manages AI-proposed team identity aliases. During analysis, CodeRadius may detect that multiple repository-level organization names refer to the same logical team. These proposals are surfaced as "phantom teams" that can be approved or rejected.

# List all pending team alias proposals
cr config team-alias list
cr config team-alias list --pending  # Only pending

# Approve a phantom team alias
cr config team-alias approve "platform-payments"

# Reject a phantom team alias
cr config team-alias reject "platform-payments-old"

Shell Completion

Manages shell autocompletion for the cr CLI.

# Install autocompletion into your shell profile (.bashrc / .zshrc)
cr config completion --setup

# Remove autocompletion from your shell profile
cr config completion --cleanup

After running --setup, restart your terminal or source your profile file. Tab completion will then work for all cr commands and subcommands.

Legacy Command Aliases

For backward compatibility, the following old command names are still supported as hidden aliases. They delegate to the new canonical commands:

Environment Variables

CodeRadius reads the following environment variables, either from your shell, a local .env file, or the global ~/.coderadius/config/credentials.json: