depgraph loads AI-written code into Neo4j to flag hidden debt

The tool was built around a specific observation about AI coding agents: code they write compiles, type-checks, lints and passes tests, yet the repository gradually degrades. The patterns named are concrete — a function rewritten under a new name instead of being searched for, exports orphaned mid-refactor, lower layers importing upper ones, and a shared package everything depends on. None of these produce an error, because go vet, tsc --noUnusedLocals and eslint look inside a single file or package.

Choosing a graph database follows from the shape of the problem. Dependencies are nodes and relationships, so the rules become queries; the god-package rule, for instance, adds a condition that the package also depends on three or more in-repo packages, so stable domain models that many packages import but that import nothing are not flagged. The cycle rule was rewritten from enumerating all cycles of length 2 to 8, whose runtime grows exponentially on dense graphs, to finding one shortest return path per import edge, and the new query was checked against the old one on 25 random graphs.

Two design choices show how the tool is meant to be used. Neo4j is started and torn down by depgraph itself, with a watchdog child process that removes the container whether the parent exits normally, panics, or is killed with SIGKILL; integration tests verify this on real container runtimes in CI on both Docker and Podman. And through claude-hook-gate, depgraph fails a session that added findings compared with the session-start baseline, so an agent cannot finish while it has increased debt. The author reports that scanning depgraph's own repository surfaced a genuine duplicate between the import-resolution and parsing layers, which was extracted into a shared package.