Orihime
A cross-repository code knowledge graph for Java/Kotlin/JavaScript/TypeScript codebases. Orihime indexes your source code into an embedded KuzuDB graph database using tree-sitter and exposes the graph through an MCP server (for AI assistants), a local web UI, and a CLI.
Mythology: Orihime (織姫) is Vega — the weaving princess who weaves the fabric of the cosmos. She weaves connections. The tool that weaves your codebase into a single graph.
What It Does
- Call graph across repositories — who calls what, across service boundaries, including REST calls resolved to the endpoint they target
- Cross-repo taint analysis — track user-controlled data from HTTP/Kafka/JMS entry points through the call graph to dangerous sinks (SQL injection, path traversal, XXE, deserialization, SSRF, log injection, …)
- Security reports — OWASP Top 10, CWE, PCI DSS, STIG frameworks; second-order injection detection; custom sources/sinks via YAML
- Entry-point reachability filtering — suppress false positives from dead code; only surface findings reachable from real entry points (HTTP handlers,
@KafkaListener,@Scheduled,@JmsListener,@RabbitListener) - Complexity hints — static O(n²) loop detection, N+1 JPA risk, unbounded queries, recursive calls — no profiler needed
- Performance correlation — ingest Gatling/JMeter load test results; correlate with the call graph to find confirmed hotspots and Little's Law capacity ceilings per endpoint
- License compliance — scan Maven/Gradle dependencies against SPDX identifiers; flag GPL/AGPL/LGPL in commercial projects
- Incremental re-index — git blob-hash-based skip; only changed files are re-parsed on subsequent runs
- Multi-language — Java, Kotlin, JavaScript, TypeScript (Next.js, Express, React)
