Most tools analyze code line-by-line. GitGalaxy maps the entire architectural ecosystem. By tracking the exact flow of information across network dependencies, identifying local folder constraints, and natively recognizing 50+ languages—even mid-file—GitGalaxy provides a deterministic, 10,000-foot view of your software's physical architecture.
Why we built a custom physics engine: Standard Abstract Syntax Trees (ASTs) are great for finding syntax errors, but they require compilable code and miss the forest for the trees when mapping massive-scale information flow. LLMs, on the other hand, suffer from severe hallucination when analyzing large context windows and yield probabilistic, fluctuating answers.
The blAST (Bypassing LLMs and ASTs) engine solves this. It reads code as raw structural text, scanning for semantic anchors to build a deterministic 3D knowledge graph of your entire repository. It instantly calculates the ratio of test boundaries to core logic, maps network blast radiuses, and extracts the vital project structure data that rigid linters ignore.
Think of GitGalaxy as a highly calibrated telescope for codebase risk. Every assumption the system makes is abstracted into over 300 tunable variables. You can query active API nodes, isolate supply chain threats, or highlight functions exhibiting extreme cognitive load—all adjusted via custom shields to eliminate false-positive fatigue. Field-tested on over 1,000 repositories, the engine comes equipped with enterprise-grade defaults ready for immediate CI/CD deployment.
Core Codebase Mapping Technology
- Bypasses LLMs and rigid ASTs.
- Doesn't require code to compile (AST-free).
- Produces full network mapping via imports with generlized function calls per file.
- Deterministically maps code by 60+ keyword regex profiles (Structural markers, I/O intents, state mutations).
- Regex keyword profiles allow us to classify functions, files, classes, folders and repos.
- Eliminates LLM architectural hallucinations and context window limits.
- Scans 50+ languages, 250+ extensions, fully folder-aware. (How to add a language in 1 minute and 1 prompt)
Enterprise Scale & Performance Metrics
- Active Pipeline Integration: Over 11,000 PyPI downloads, driven heavily by automated CI/CD security sweeps and zero-trust DevSecOps workflows.
- Production Tested: Backed by an active early-adopter community on GitHub driving real-world issue resolution, architectural forks, and continuous engine hardening.
- 100,000 LOC/sec code analysis.
- 0.07 GB/sec raw log ingestion.
- Full-system scans in minutes without data sampling.
- 100% daily system coverage.
Methodology & Comparative Benchmarks GitGalaxy is backed by an academic-grade thesis detailing the equations powering the blAST engine.
- Optimum Search Strategies Evolve: AST-free mapping. Outperforms rigid parsers and LLM context windows.
- Languages are getting easier to regex for meaning and intent: Quantifies linguistic opacity. Assigns mathematical "trust dampeners" to implicit languages.
- All languages have keywords that roughly do the same thing, these can be grouped to make cross-language keyword maps: Standardizes 50+ languages into a single universal physical framework.
- Cross-Language Comparisons of over 1000 repos: Deterministic 1:1 benchmarking of distinct syntax architectures.
- Universal File Archetypes by k-means clustering: ML isolation of files into K-means clusters (e.g., "The God Nodes," "Declarative Glue").
- Mainframe Proven: 100% CI/CD Translation Success Rate: Flawless architectural translation of 27 distinct legacy COBOL repositories (including IBM CICS benchmark apps) into compiling Java Spring Boot environments.
Data Privacy & On-Premise Deployment
- 100% air-gapped execution.
- On-premise deployment with zero IP exfiltration risk.
- Zero-trust processing model.
Installation & Usage
- Python-based:
pip install gitgalaxy - CLI execution
- CI/CD Integration: Native GitHub Action available for zero-trust DevSecOps pipelines.
- Outputs forensic JSONs (optimized for AI-agent summary reports) and a native SQLite3 database for robust querying and storage.
📖 Official Documentation: Read the full technical specifications, architecture blueprints, and the Taxonomical Equivalence Map at squid-protocol.github.io/gitgalaxy.
pip install gitgalaxyPoint the GalaxyScope at any local repository or ZIP archive. The engine runs entirely on your local machine—zero data is transmitted.
galaxyscope /path/to/your/local/repoGitGalaxy can be integrated directly into your GitHub Actions pipeline for automated DevSecOps auditing, Zero-Trust SBOM generation, or Pre-Commit firewalls.
🚀 View the Full GitHub Action Integration Guide
Check out our comprehensive guide to set up the "Golden Path" Pipeline (Parallel Enforcement & Autonomous Reporting). It covers all available Sentinel tools, AI guardrails, and advanced configuration options like our hyper-sensitive --paranoid threat-hunting mode.
Minimal Example (Running a single Sentinel):
name: GitGalaxy Security Audit
on:
pull_request:
branches: [ "main" ]
jobs:
gitgalaxy-scan:
runs-on: ubuntu-latest
steps:
- name: Checkout Repository
uses: actions/checkout@v4
- name: Run GitGalaxy Supply Chain Firewall
uses: squid-protocol/gitgalaxy@main
with:
tool: 'supply-chain-firewall' # View the Integration Guide for the full tool directory
target: '.'The central blAST engine. It bypasses rigid ASTs using mathematical heuristics to map O(N) multi-dimensional relationships across 50+ languages, managing signal processing, spatial layout, and high-speed SQLite telemetry recording.
GitGalaxy operates on a modular Hub-and-Spoke architecture. While the core engine provides the overarching physics and cartography, our specialized toolsets leverage that deterministic graph to execute enterprise-grade operations.
A deterministic, high-fidelity translation pipeline. It converts legacy COBOL into fully compiling, modern Spring Boot architectures, mapping memory exactly and scaffolding JPA entities, REST controllers, and Maven builds before utilizing AI to translate isolated business logic.
- Proven Metric: Achieved a perfect 27/27 Maven compile success rate across a batch test of distinct legacy repos.
- Verify for Yourself: Inspect the raw outputs of the IBM CICS Application Translation here.
A mathematical x-ray suite for sanitizing mainframe monoliths. It safely neutralizes legacy lexical traps, extracts dead "Graveyard" memory, maps topological DAG execution orders, and generates Zero-Trust JCL configurations for modern cloud deployments.
- Proven Metric: The Graveyard Reaper engine extracted over 6,700 lines of dead execution blocks and orphaned variables from the standard IBM CICS benchmark app in seconds.
Extreme-velocity pre-commit firewalls. Instead of trusting manifest files, it scans physical internals to block steganography, sub-atomic XOR decryption loops, homoglyph typosquatting, and exposed cryptographic vaults before they ever enter your CI/CD pipeline. Deploy directly via our GitHub Action.
A Zero-Trust Software Bill of Materials (SBOM) generator. It refuses to blindly trust package.json or requirements.txt files, instead locating the physical dependencies on disk, mathematically verifying their entropy and linguistic identity, and generating strict CycloneDX 1.4 JSON reports.
- Proven Metric: Successfully mapped and mathematically verified the physical internals of 170 unique Go modules inside the local Kubernetes repository.
A deterministic mapping tool that hunts undocumented vulnerabilities. It uses structural regex to find active physical routing logic (Express, Spring Boot, FastAPI) and applies set theory against official OpenAPI/Swagger documentation to isolate critical Shadow APIs and outdated Ghost APIs.
Unindexed, tactical log analysis operating at 0.07 GB/sec. It streams massive database dumps to deterministically hunt and mask PII (Credit Cards, SSNs, AWS Keys) and uses static architecture maps to prove exact runtime execution frequencies with ASCII time-series histograms.
Specialized keyword sensors protecting both your application and your codebase. The AppSec Sensor detects weaponized LLM features (RCE funnels, exfiltration risks), while the Dev Agent Firewall evaluates token mass and blast radius to restrict autonomous coding agents from modifying dangerous over context token-draining files. Helps identify which files need to be chunked to reduce context overload.
If you prefer visual analytics, we've built a non-numerical dashboard where each file represents a star, sized and colored according to specific risk metrics.
Simply drag and drop your generated your_repo_GPU_galaxy.json file (or a .zip of your raw repository) directly into GitGalaxy.io. All rendering and scanning happens entirely in your browser's local memory.
Mapping 3.2 Million Lines of C++ in 11 Seconds | OpenCV
Visualizing Architectural Risk | Ruby on Rails 
Your code never leaves your machine. GitGalaxy performs 100% of its scanning and vectorization locally.
- No Data Transmission: Source code is never transmitted to any API, cloud database, or third-party service.
- Ephemeral Memory Processing: Repositories are unpacked into a volatile memory buffer (RAM) and are automatically purged when the browser tab is closed.
- Privacy-by-Design: Even when using the web-based viewer, the data remains behind the user's firewall at all times.
Copyright (c) 2026 Joe Esquibel
GitGalaxy is distributed under the PolyForm Noncommercial License 1.0.0.
We are deeply committed to the open-source and academic communities. If you are using GitGalaxy for personal projects, academic research, or non-commercial development, the engine is 100% free to use.
To suppress the commercial licensing delays in your terminal or personal CI/CD pipelines, simply set the following environment variable:
export GITGALAXY_LICENSE_KEY="COMMUNITY_FREE_TIER"Running GitGalaxy in corporate environments, proprietary codebases, or commercial CI/CD pipelines requires an enterprise license. Unlicensed corporate pipelines will experience intentional execution friction, and attempting to use the Community Free Tier key in a corporate environment will trigger explicit non-compliance warnings in your audit logs.
To acquire a zero-trust commercial key for your organization and ensure clean compliance logs, please contact: joe@gitgalaxy.io