A repository can tell you a lot about a system. It cannot tell you everything about the system running in production.
I built Codelit's GitHub analysis to shorten the distance between unfamiliar code and a useful first architecture discussion. The output is an editable hypothesis, not a certified map of the deployment.
Start with evidence
The analyzer reads a bounded sample of the repository tree, selected configuration and manifest files, and a small set of source excerpts. The current route samples up to 500 tree paths and eight source files rather than reading the entire repository.
| Evidence | Useful inference | Remaining question |
|---|---|---|
| Package manifest | Frameworks and installed clients | Which dependencies run in production? |
| Compose or infrastructure files | Declared services and relationships | Is this configuration deployed? |
| Selected source excerpts | Calls and application boundaries | What falls outside the sample? |
| Directory structure | Possible service or package ownership | Is this a runtime boundary or a code boundary? |
A Redis dependency is a clue. It is not proof of a deployed cache or its traffic pattern.
Keep inference editable
The sampled evidence goes into the architecture-generation flow. The resulting nodes and relationships give the user something concrete to inspect and correct.
Missing evidence should become a question, not a confident edge. Runtime configuration, managed services, private dependencies, and deployment drift can all change the real system without being obvious in the sampled files.
The implementation article covers the sampling and normalization in more detail.
Permissions are a separate boundary
Public and private repository access follow different paths. Private access requires a GitHub connection with the appropriate authorization.
The analysis operation reads repository data, but that does not make the OAuth grant read-only. Codelit's connection flow currently requests GitHub's broad repo scope. Review the permission screen and organization policy before connecting a private repository. Do not infer least-privilege access from the word “analysis.”
Source excerpts can also enter an AI request. Repository authorization and permission to send code to a model provider are separate decisions.
The outcome I care about
A useful import helps an engineer find the next file to inspect and the next assumption to verify. It should leave the diagram easier to challenge, not harder.
Start with a repository you are authorized to analyze at codelit.io. Then review the graph in the interactive canvas, and test its assumptions before using it for infrastructure export.