StrataMetriq Architecture Intelligence & DevSecOps
Full-stack polyglot AST graphs, vertical API traces, and 13-point safety audits inside VS Code & CLI.
- 1. Polyglot Language & AST Support
- 2. 13-Point Pre-Deployment Safety Audit
- 3. Dynamic API Request Lifecycle Trace
- 4. Ripple Impact & Complexity Ranking
- 5. Interactive Dependency Tree & Loops
- 6. Headless CLI & CI/CD Pipeline Gates
- 7. Custom Governance & OpenTelemetry
- 8. Market Comparison vs Legacy Tools
- 9. Installation & Building From Source
1. Full-Stack Enterprise Polyglot Architecture Support
StrataMetriq natively parses ASTs (Abstract Syntax Trees) and framework semantics across modern multi-language enterprise repositories without requiring external interpreters, running backend servers, or heavy IDE plugins.
Supported Languages (11+)
Full tokenization and syntax diagnosis across Python (`.py`), Java (`.java`), Kotlin (`.kt`), Go (`.go`), C# (`.cs`), JavaScript/TypeScript (`.js, .ts, .jsx, .tsx`), Ruby (`.rb`), PHP (`.php`), Rust (`.rs`), C++ (`.cpp`), and C (`.c`).
Enterprise Backend Frameworks
Natively detects API routes and ORM entities across Python FastAPI / Django, Java & Kotlin Spring Boot / JPA, C# ASP.NET Core / Entity Framework, and Go Gin / Echo / GORM. Traces frontend calls directly into backend decorators (`@GetMapping(...)`, `@app.get(...)`, `r.GET(...)`).
2. Automated 13-Point Pre-Deployment DevSecOps Safety Audit
Before deploying your application, StrataMetriq scans 100% of your codebase in seconds to ensure no debugging artifacts, credentials, or insecure patterns leak into production. Displays a glowing ✅ Ready for Production badge or a high-alert ⛔ DO NOT DEPLOY banner.
Detects API keys, JWT tokens, AWS secrets, passwords, and hardcoded connection strings with Zero False-Positive precision.
Identifies dangerous raw SQL string concatenation (`query = "SELECT * FROM users WHERE id = " + userId`) inside database queries.
Flags usage of obsolete hashing algorithms (`MD5`, `SHA1`) and recommends modern `SHA-256 / Argon2` implementations.
Identifies active `console.log`, `print()`, `System.out.println()`, `fmt.Println()`, `debugger;`, and `alert()` statements before merge.
Highlights developer hack annotations (`// WIP`, `// HACK`, `// TEMP`, `TODO`, `FIXME`) across your workspace.
Flags commented-out logic blocks (reported as informational without penalizing your Project Health Score).
Flags unreachable statements after return/throw, dead branches, and unused development dependencies. Outputs standard OASIS SARIF 2.1.0 reports (`--sarif results.sarif`) so your security team can ingest architectural risks directly into GitHub Advanced Security or GitLab Security Center PR tabs.
3. Dynamic API Request Lifecycle Visualizer
Click any API endpoint in your project (e.g., `GET /role/:name`, `GET /vendors`, or `POST /api/users`) to generate an instant vertical trace of the request flow across your full-stack architecture. Powered by our Dynamic Entity Keyword Matching Engine (`role`, `vendor`) to prevent false-positive utility matches:
4. Most Complex Modules & Intelligent Ripple Impact Analysis
StrataMetriq automatically evaluates code complexity (`cyclomatic complexity`, `nested conditional depth`, `AST token density`) and ranks source files to highlight tight coupling. When modifying existing code, our "Why & How Are These Affected?" guide categorizes risk:
Direct Importers vs Transitive
Distinguishes files that directly import your module from downstream files further away in the ripple chain (`[Transitive]` badge).
Contract & UI Re-Renders
Identifies backend endpoints coupled to the file and warns against breaking response schemas or causing unexpected React hook re-renders.
Adding vs Modifying Rule
Adding new endpoints or functions carries 0 ripple risk (non-breaking), whereas modifying existing signatures carries high ripple risk.
6. Headless CLI & CI/CD Pipeline Gates (`@stratametriq/cli`)
Run StrataMetriq directly in your terminal, Docker container, or CI/CD workflow (GitHub Actions, GitLab CI, Jenkins) to automatically block pull requests containing high-severity security vulnerabilities (`--fail-on-high`) or circular loops (`--fail-on-circular`).
# Interactive setup: create a default .stratametriqrc.json configuration file
npx @stratametriq/cli init
# Scan the current directory locally
npx @stratametriq/cli scan .
# Run downstream BFS impact analysis on a specific file ("what breaks if I edit this?")
npx @stratametriq/cli impact src/services/UserService.ts
# Git PR Mode: Scan only modified files in your branch/PR against origin/main
npx @stratametriq/cli scan . --diff origin/main --fail-on-high
# Dead code & dependency pruning: Report unused npm packages and orphaned modules
npx @stratametriq/cli scan . --prune
# Standalone interactive offline HTML dashboard report
npx @stratametriq/cli scan . --html architecture-report.html
# Live watch mode for local development (automatically re-scans on file save)
npx @stratametriq/cli scan . --watch🚦 Available CLI Flags & Quality Gates
| Flag | Description | CI/CD & Pipeline Behavior |
|---|---|---|
| init | Creates default `.stratametriqrc.json` configuration file. | Configures ignore rules, custom risk thresholds, and default report paths. |
| scan [dir] | Target directory to scan (defaults to current directory). | Outputs colored ANSI tables of stats & risks. |
| impact <file> | Runs downstream BFS ripple analysis on a specific target file. | Categorizes downstream affected files, API routes, database tables, and UI widgets. |
| --diff <ref> | Git PR mode: Compares against Git branch or commit reference. | Evaluates security risks and circular loops strictly within modified files. |
| --prune | Dead code and dependency cleanup report. | Identifies unreferenced `package.json` dependencies and orphaned module code. |
| --fail-on-high | Enforces DevSecOps quality gate. | Exits with Exit Code 1 (fails pipeline) if any HIGH severity risk is detected. |
| --fail-on-circular | Enforces architectural health gate. | Exits with Exit Code 1 if any circular dependency loops are detected. |
| --sarif / --json / --md | Export formats for executive audits. | OASIS SARIF 2.1.0 for GitHub Security, JSON for SBOMs, Markdown for `gh pr comment`. |
7. Enterprise Custom Governance (`stratametriq.config.yml`)
Enforce organizational architecture standards across your monorepo or layered application. Define forbidden import boundaries in a root `stratametriq.config.yml` file. Any violation is automatically flagged with red diagnostic squiggles in VS Code and breaks CI/CD gating:
version: 1
rules:
- name: "UI layer cannot import Database layer directly"
source: "src/ui/**"
forbiddenTarget: "src/db/**"
severity: "HIGH"
message: "UI components must go through src/services/ or API endpoints."
- name: "Domain models must remain framework agnostic"
source: "src/domain/**"
forbiddenTarget: "src/infrastructure/**"
severity: "HIGH"
message: "Domain entities cannot depend on database or HTTP adapters."8. Market Comparison: Why StrataMetriq?
In a typical engineering organization, developers must piece together 3 to 4 separate, expensive tools (`Datadog`, `CodeScene`, `GitGuardian`, `Madge`) to get what StrataMetriq delivers natively out of the box inside your IDE:
| Feature Domain | Standard VS Code | Traditional Market Tools | StrataMetriq (Our USP) |
|---|---|---|---|
| Pre-Deployment Audits | ❌ None. Allows deploying debug code & secrets. | GitGuardian / TruffleHog / SonarLint: Fragmented per-file checks. | ✅ All-in-One 13-Point Audit with instant line jumping & zero false positives. |
| API Lifecycle Tracing | ❌ Manual file hunting across layers. | Datadog / Dynatrace / New Relic: Expensive runtime APM ($100+/mo). | ✅ Static Pre-Deployment API Tracing right inside your IDE before deployment. |
| Dependency Graphs | ❌ No visual tree graph view. | Madge / Dependency-Cruiser: Static SVG image exports via terminal. | ✅ Interactive Glassmorphic Webview synced right with open editor tabs (`[Open]`). |
| Risk Impact Analysis | ❌ Flat text via "Find All References". | CodeScene / Understand: Desktop software ($1,000+/year per seat). | ✅ Instant Downstream Ripple Analysis across APIs, controllers, and tables. |
9. Building From Monorepo Source (`extension/`, `dashboard/`, `scanner/`, `cli/`)
To compile and package the `stratametriq-extension-1.3.0.vsix` bundle directly from source:
# 1. Install dependencies across all monorepo packages
npm install
# 2. Build the AST scanner engine
cd scanner && npm run build
# 3. Build the Vite React dashboard webview bundle
cd ../dashboard && npm run build
# 4. Compile the extension backend and package the VSIX bundle
cd ../extension && npm run build
# Output: stratametriq-extension-1.3.0.vsix inside extension/