Guardrails for AI-assisted code

Know what code is risky before your AI agent edits it.

AI coding agents are fast, but they do not always know which parts of your codebase are fragile, widely used, or poorly documented. GapMap scans your repo, ranks the risky parts, generates context for them, and surfaces the rules an edit should not break.

Get started See how it works

Works with the tools developers already use

Cursor

Claude Code

Codex

Copilot

Windsurf

Cursor

Claude Code

Codex

Copilot

Windsurf

Cursor

Claude Code

Codex

Copilot

Windsurf

✦ Risk map

Find the code that can break things

GapMap builds a map of your repo using imports, function calls, file size, git history, and ownership signals. Instead of showing you everything, it shows you the parts of the codebase that deserve extra care.

Get started

Risk leaderboard

1cache.py::persist_analysis_cache2,176CRIT

2analysis.py::analyze980HIGH

3export.py::build_audit_payload742HIGH

4graph.py::resolve_calls514HIGH

5cli.py::audit388MED

Safety profileCRITICAL

PaymentRouter.route_payment

Role · Routes payment requests to the correct processor

Callers · 23 upstream functions

Depends on · auth.check_token, ledger.record

Behavior to preserve

• preserve public method signature
• keep rollback behavior unchanged
• update tests for payment failure paths

✦ Guardrails

Turn important context into guardrails

For high-risk functions and classes, GapMap creates a short safety profile: what the code does, who calls it, what depends on it, and what behavior should stay the same. AI agents can read this context before making changes.

Get started

✦ Documentation

Document the risky code first

Most teams do not have time to document everything. GapMap helps you start where it matters: the code with many callers, recent churn, missing docs, or unclear ownership. When the source changes, GapMap can flag stale context so docs do not quietly rot.

Get started

Documentation gapsranked by risk

PaymentRouter.route_payment

23 callers · high churn · no docs

CacheManager.persist

18 callers · bus-factor · stale manifest

AuthMiddleware.verify

12 callers · missing docstring

Flags stale context when source changes

✦ MCP integration

Give AI agents repo-aware guardrails

Connect GapMap through MCP so tools like Cursor and Claude can ask what is risky before editing. When an agent touches critical code, GapMap can surface the callers, dependencies, and invariants it should preserve.

{
  "mcpServers": {
    "gapmap-shield": {
      "command": "uvx",
      "args": ["--from", "gapmap-ai[mcp]", "gapmap-mcp"]
    }
  }
}

Cursor · Claude Code · ~/.cursor/mcp.json

gapmap audit

$ gapmap audit --repo .
 
CRITICAL  PaymentRouter.route_payment
23 callers · high churn · no docs
 
Suggested guardrails:
 
• preserve public method signature
• keep rollback behavior unchanged
• update tests for payment failure paths

Get started

Run it locally in under a minute

GapMap runs on your machine. Your code does not need to leave your repo.

uvx gapmap-ai audit --repo .

Zero-install with uv. Or install permanently: pip install "gapmap-ai[all]"

See every command

uvx gapmap-ai --help

gapmap audit --help

Use gapmap after pip install, or uvx gapmap-ai before each run. Most commands accept --repo . and --refresh.

Typical workflow

Copy a command below, or scroll to the full command reference.

1
Audit the repo
gapmap audit --repo .
Rank undocumented high-risk code and write .gapmap/audit.json
2
Review the riskiest code
gapmap dashboard --repo .
Open the interactive dashboard (requires Node.js and a repo clone)
3
Generate safety profiles
gapmap generate --top 10 --repo .
Create context manifests for the worst documentation gaps
4
Connect your AI agent through MCP
uvx --from gapmap-ai[mcp] gapmap-mcp
Run the GapMap Shield MCP server for Cursor and Claude
5
Track stale docs and risky changes
gapmap stale --repo .
Find drifted manifests; use gapmap trend for coverage history

All CLI commands

Every command supports --repo PATH (default: current directory). Run gapmap COMMAND --help for flags.

Command	Example	Purpose
gapmap parse	gapmap parse --repo .	Files, LOC, imports, graph resolution breakdown
gapmap audit	gapmap audit --repo .	Top undocumented high-risk entities
gapmap ask	gapmap ask route_payment "why is this risky?" --repo .	Graph-grounded explanation for one entity
gapmap generate	gapmap generate --top 10 --repo .	Generate context manifest(s) under .gapmap/manifests/
gapmap report	gapmap report --repo . -o gapmap-report.html	Self-contained HTML report
gapmap dashboard	gapmap dashboard --repo .	Interactive risk UI
gapmap stale	gapmap stale --fix --repo .	Find manifests whose source has drifted
gapmap ownership	gapmap ownership --repo .	Knowledge-debt ownership and bus-factor
gapmap trend	gapmap trend --repo .	Documentation coverage over time
gapmap autodoc	gapmap autodoc --repo .	Batch-generate manifests for critical hubs

We've got answers

No. The core audit runs locally using static analysis and git history.

Most docs tools help you write or search documentation. GapMap starts with risk. It tells you which parts of the codebase need context first, then turns that context into guardrails for AI-assisted edits.

Context engines help agents find more information. GapMap focuses on the narrower question that matters before a change: what is dangerous to edit here, and what should not break?

GapMap supports Python today. More languages can be added as the parser layer expands.

Run gapmap --help for the full list, or gapmap audit --help (and so on) for a specific command. The install section on this page also lists every command with copy-paste examples. With uvx, use uvx gapmap-ai --help.