AST-Free Static Analysis & Knowledge Graph Engine

The blAST (Bypassing LLMs and ASTs) engine is a custom-made knowledge graph engine that resolves repositories at the function level. It scores each function based on 50 unique metrics, rolls that data up to score the file, and finally summarizes the entire repository.

Scanning Apollo-11 with the blAST Engine

By utilizing a custom engine, we retain full control over the search space. We built it to be exceptionally fast, capable of assessing your entire repository without requiring compilable code—a fundamental limitation of standard Abstract Syntax Trees (ASTs). ASTs are great for finding missing commas and memory overflows, but they miss the forest for the trees when generating knowledge graphs. LLMs, on the other hand, suffer from hallucination during large context windows and yield probabilistic, fluctuating answers.

The blAST engine solves this. Because all programming languages utilize keywords and functions, our engine treats code files as text, scanning for these structural anchors to build a deterministic 3D knowledge graph. It seamlessly handles mid-file language switching, assesses the architectural ratio of test files to logic, and extracts invaluable project structure data that ASTs ignore.

Every assumption our system makes has been abstracted into over 300 tunable variables. Think of GitGalaxy as a highly calibrated telescope. You can query the number of active API network nodes, isolate unique external imports, or highlight functions exhibiting extreme cognitive load—all adjusted via custom whitelists and blacklists to eliminate false-positive fatigue. Field-tested on over 1,000 repositories spanning 50+ languages and 250+ extensions, the engine comes equipped with smart defaults ready for immediate deployment.

Core Codebase Mapping Technology

• Bypasses LLMs and rigid ASTs.
• Doesn't require code to compile (AST-free).
• Produces full function-to-function call chains.
• Deterministically maps code by 60+ keyword regex profiles (Structural markers, I/O intents, state mutations).
• Regex keyword profiles allow us to classify functions, files, classes, folders and repos.
• Eliminates LLM architectural hallucinations and context window limits.
• Scans 50+ languages, 250+ extensions, fully folder-aware. (How to add a language in 1 minute and 1 prompt)

Enterprise Scale & Performance Metrics

• 100,000 LOC/sec code analysis.
• 0.07 GB/sec raw log ingestion.
• Full-system scans in minutes without data sampling.
• 100% daily system coverage.

Methodology & Comparative Benchmarks GitGalaxy is backed by an academic-grade thesis detailing the equations powering the blAST engine.

• Optimum Search Strategies Evolve: AST-free mapping. Outperforms rigid parsers and LLM context windows.
• Languages are getting easier to regex for meaning and intent: Quantifies linguistic opacity. Assigns mathematical "trust dampeners" to implicit languages.
• All languages have keywords that roughly do the same thing, these can be grouped to make cross-language keyword maps: Standardizes 50+ languages into a single universal physical framework.
• Cross-Language Comparisons of over 1000 repos: Deterministic 1:1 benchmarking of distinct syntax architectures.
• Universal File Archetypes by k-means clustering: ML isolation of files into K-means clusters (e.g., "The God Nodes," "Declarative Glue").
• Mainframe Proven: 100% CI/CD Translation Success Rate: Flawless architectural translation of 27 distinct legacy COBOL repositories (including IBM CICS benchmark apps) into compiling Java Spring Boot environments.

Data Privacy & On-Premise Deployment

• 100% air-gapped execution.
• On-premise deployment with zero IP exfiltration risk.
• Zero-trust processing model.

Installation & Usage

• Python-based: pip install gitgalaxy
• CLI execution
• Outputs forensic JSONs (optimized for AI-agent summary reports) and a native SQLite3 database for robust querying and storage.

📖 Official Documentation: Read the full technical specifications, architecture blueprints, and the Taxonomical Equivalence Map at squid-protocol.github.io/gitgalaxy.

Quickstart Guide

1. Install

pip install gitgalaxy

2. Scan a Repository

Point the GalaxyScope at any local repository or ZIP archive. The engine runs entirely on your local machine—zero data is transmitted.

galaxyscope /path/to/your/local/repo

3. GitHub Actions CI/CD Integration

GitGalaxy can be integrated directly into your GitHub Actions pipeline for automated DevSecOps auditing, Zero-Trust SBOM generation, or Pre-Commit firewalls.

Create a file in your repository at .github/workflows/gitgalaxy-scan.yml:

name: GitGalaxy Security Audit

on:
  pull_request:
    branches: [ "main" ]

jobs:
  gitgalaxy-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repository
        uses: actions/checkout@v4

      - name: Run GitGalaxy Supply Chain Firewall
        uses: squid-protocol/gitgalaxy@main
        with:
          tool: 'supply-chain-firewall' # Options: galaxyscope, zero-trust-sbom, pii-leak-hunter, etc.
          target: '.'

GitGalaxy Core Analysis Engine

The central blAST engine. It bypasses rigid ASTs using mathematical heuristics to map O(N) multi-dimensional relationships across 50+ languages, managing signal processing, spatial layout, and high-speed SQLite telemetry recording.

Enterprise Codebase Tools & Use Cases

GitGalaxy operates on a modular Hub-and-Spoke architecture. While the core engine provides the overarching physics and cartography, our specialized toolsets leverage that deterministic graph to execute enterprise-grade operations.

Automated Legacy Migration: COBOL to Java Spring Boot

A deterministic, high-fidelity translation pipeline. It converts legacy COBOL into fully compiling, modern Spring Boot architectures, mapping memory exactly and scaffolding JPA entities, REST controllers, and Maven builds before utilizing AI to translate isolated business logic.

• Proven Metric: Achieved a perfect 27/27 Maven compile success rate across a batch test of distinct legacy repos.
• Verify for Yourself: Inspect the raw outputs of the IBM CICS Application Translation here.

Mainframe Refactoring: COBOL & JCL Optimization

A mathematical x-ray suite for sanitizing mainframe monoliths. It safely neutralizes legacy lexical traps, extracts dead "Graveyard" memory, maps topological DAG execution orders, and generates Zero-Trust JCL configurations for modern cloud deployments.

• Proven Metric: The Graveyard Reaper engine extracted over 6,700 lines of dead execution blocks and orphaned variables from the standard IBM CICS benchmark app in seconds.

Software Supply Chain Security & Pre-Commit Firewalls

Extreme-velocity pre-commit firewalls. Instead of trusting manifest files, it scans physical internals to block steganography, sub-atomic XOR decryption loops, homoglyph typosquatting, and exposed cryptographic vaults before they ever enter your CI/CD pipeline.

Zero-Trust SBOM Generation & Dependency Auditing

A Zero-Trust Software Bill of Materials (SBOM) generator. It refuses to blindly trust package.json or requirements.txt files, instead locating the physical dependencies on disk, mathematically verifying their entropy and linguistic identity, and generating strict CycloneDX 1.4 JSON reports.

• Proven Metric: Successfully mapped and mathematically verified the physical internals of 170 unique Go modules inside the local Kubernetes repository.

API Security & Shadow API Detection

A deterministic mapping tool that hunts undocumented vulnerabilities. It uses structural regex to find active physical routing logic (Express, Spring Boot, FastAPI) and applies set theory against official OpenAPI/Swagger documentation to isolate critical Shadow APIs and outdated Ghost APIs.

High-Speed PII Detection & Log Analysis

Unindexed, tactical log analysis operating at 0.07 GB/sec. It streams massive database dumps to deterministically hunt and mask PII (Credit Cards, SSNs, AWS Keys) and uses static architecture maps to prove exact runtime execution frequencies with ASCII time-series histograms.

AI Agent Guardrails & Codebase Protection

Specialized keyword sensors protecting both your application and your codebase. The AppSec Sensor detects weaponized LLM features (RCE funnels, exfiltration risks), while the Dev Agent Firewall evaluates token mass and blast radius to restrict autonomous coding agents from modifying dangerous over context token-draining files. Helps identify which files need to be chunked to reduce context overload.

Local Browser-Based 3D Codebase Visualization

If you prefer visual analytics, we've built a non-numerical dashboard where each file represents a star, sized and colored according to specific risk metrics.

Simply drag and drop your generated your_repo_GPU_galaxy.json file (or a .zip of your raw repository) directly into GitGalaxy.io. All rendering and scanning happens entirely in your browser's local memory.

Zero-Trust Data Security

Your code never leaves your machine. GitGalaxy performs 100% of its scanning and vectorization locally.

• No Data Transmission: Source code is never transmitted to any API, cloud database, or third-party service.
• Ephemeral Memory Processing: Repositories are unpacked into a volatile memory buffer (RAM) and are automatically purged when the browser tab is closed.
• Privacy-by-Design: Even when using the web-based viewer, the data remains behind the user's firewall at all times.

License & Copyright

Copyright (c) 2026 Joe Esquibel

GitGalaxy is released under the PolyForm Noncommercial License 1.0.0. It is completely free for personal use, research, experiment, testing, and hobby projects. Use by educational or charitable organizations is also permitted.

Any commercial use or integration into commercial SaaS products or corporate CI/CD pipelines requires a separate commercial license. Please reach out via gitgalaxy.io to discuss commercial integration.