Back to All Suites Hub
DevSecOps & IDEv1.4.1Live2,500+ installations

StrataMetriq Architecture Intelligence & DevSecOps

Full-stack polyglot AST graphs, vertical API traces, and 13-point safety audits inside VS Code & CLI.

v1.4.1 Enterprise Specification

1. Full-Stack Enterprise Polyglot Architecture Support

StrataMetriq natively parses ASTs (Abstract Syntax Trees) and framework semantics across modern multi-language enterprise repositories without requiring external interpreters, running backend servers, or heavy IDE plugins.

Supported Languages (11+)

Full tokenization and syntax diagnosis across Python (`.py`), Java (`.java`), Kotlin (`.kt`), Go (`.go`), C# (`.cs`), JavaScript/TypeScript (`.js, .ts, .jsx, .tsx`), Ruby (`.rb`), PHP (`.php`), Rust (`.rs`), C++ (`.cpp`), and C (`.c`).

Enterprise Backend Frameworks

Natively detects API routes and ORM entities across Python FastAPI / Django, Java & Kotlin Spring Boot / JPA, C# ASP.NET Core / Entity Framework, and Go Gin / Echo / GORM. Traces frontend calls directly into backend decorators (`@GetMapping(...)`, `@app.get(...)`, `r.GET(...)`).

2. Automated 13-Point Pre-Deployment DevSecOps Safety Audit

Before deploying your application, StrataMetriq scans 100% of your codebase in seconds to ensure no debugging artifacts, credentials, or insecure patterns leak into production. Displays a glowing ✅ Ready for Production badge or a high-alert ⛔ DO NOT DEPLOY banner.

🔑 Hardcoded Secrets & Credentials

Detects API keys, JWT tokens, AWS secrets, passwords, and hardcoded connection strings with Zero False-Positive precision.

💉 SQL Injection & Raw Concatenation

Identifies dangerous raw SQL string concatenation (`query = "SELECT * FROM users WHERE id = " + userId`) inside database queries.

🔓 Insecure Cryptography

Flags usage of obsolete hashing algorithms (`MD5`, `SHA1`) and recommends modern `SHA-256 / Argon2` implementations.

🐞 Active Debug Statements

Identifies active `console.log`, `print()`, `System.out.println()`, `fmt.Println()`, `debugger;`, and `alert()` statements before merge.

🚧 Temporary Code & TODO Notes

Highlights developer hack annotations (`// WIP`, `// HACK`, `// TEMP`, `TODO`, `FIXME`) across your workspace.

💬 Large Commented Code Blocks

Flags commented-out logic blocks (reported as informational without penalizing your Project Health Score).

⚰️ Dead Code & Unused Imports + SARIF 2.1.0 Export

Flags unreachable statements after return/throw, dead branches, and unused development dependencies. Outputs standard OASIS SARIF 2.1.0 reports (`--sarif results.sarif`) so your security team can ingest architectural risks directly into GitHub Advanced Security or GitLab Security Center PR tabs.

3. Dynamic API Request Lifecycle Visualizer

Click any API endpoint in your project (e.g., `GET /role/:name`, `GET /vendors`, or `POST /api/users`) to generate an instant vertical trace of the request flow across your full-stack architecture. Powered by our Dynamic Entity Keyword Matching Engine (`role`, `vendor`) to prevent false-positive utility matches:

1React Component: UI component triggering the call (e.g., RoleList.jsx)
2HTTP Request: Network layer (Axios or fetch)
3Route Handler: Express or Next.js API Router endpoint
4Controller: Request validation & routing (RoleController.js)
5Middleware: Security, CORS & auth verifiers (authMiddleware)
6Service Layer: Core business logic execution (RoleService.js)
7Repository Layer: ORM queries & data access (RoleRepository.js)
8Database Table: SQL / NoSQL storage table (🛢️ roles_table)
9HTTP Response: JSON payload serialization (200 OK)
10React UI Update: DOM mutation and state re-rendering

4. Most Complex Modules & Intelligent Ripple Impact Analysis

StrataMetriq automatically evaluates code complexity (`cyclomatic complexity`, `nested conditional depth`, `AST token density`) and ranks source files to highlight tight coupling. When modifying existing code, our "Why & How Are These Affected?" guide categorizes risk:

[Direct Importer]

Direct Importers vs Transitive

Distinguishes files that directly import your module from downstream files further away in the ripple chain (`[Transitive]` badge).

[API Contract & UI Tree]

Contract & UI Re-Renders

Identifies backend endpoints coupled to the file and warns against breaking response schemas or causing unexpected React hook re-renders.

[Adding vs Modifying]

Adding vs Modifying Rule

Adding new endpoints or functions carries 0 ripple risk (non-breaking), whereas modifying existing signatures carries high ripple risk.

6. Headless CLI & CI/CD Pipeline Gates (`@stratametriq/cli`)

Run StrataMetriq directly in your terminal, Docker container, or CI/CD workflow (GitHub Actions, GitLab CI, Jenkins) to automatically block pull requests containing high-severity security vulnerabilities (`--fail-on-high`) or circular loops (`--fail-on-circular`).

Bash / Terminal Commands
# Interactive setup: create a default .stratametriqrc.json configuration file
npx @stratametriq/cli init

# Scan the current directory locally
npx @stratametriq/cli scan .

# Run downstream BFS impact analysis on a specific file ("what breaks if I edit this?")
npx @stratametriq/cli impact src/services/UserService.ts

# Git PR Mode: Scan only modified files in your branch/PR against origin/main
npx @stratametriq/cli scan . --diff origin/main --fail-on-high

# Dead code & dependency pruning: Report unused npm packages and orphaned modules
npx @stratametriq/cli scan . --prune

# Standalone interactive offline HTML dashboard report
npx @stratametriq/cli scan . --html architecture-report.html

# Live watch mode for local development (automatically re-scans on file save)
npx @stratametriq/cli scan . --watch

🚦 Available CLI Flags & Quality Gates

FlagDescriptionCI/CD & Pipeline Behavior
initCreates default `.stratametriqrc.json` configuration file.Configures ignore rules, custom risk thresholds, and default report paths.
scan [dir]Target directory to scan (defaults to current directory).Outputs colored ANSI tables of stats & risks.
impact <file>Runs downstream BFS ripple analysis on a specific target file.Categorizes downstream affected files, API routes, database tables, and UI widgets.
--diff <ref>Git PR mode: Compares against Git branch or commit reference.Evaluates security risks and circular loops strictly within modified files.
--pruneDead code and dependency cleanup report.Identifies unreferenced `package.json` dependencies and orphaned module code.
--fail-on-highEnforces DevSecOps quality gate.Exits with Exit Code 1 (fails pipeline) if any HIGH severity risk is detected.
--fail-on-circularEnforces architectural health gate.Exits with Exit Code 1 if any circular dependency loops are detected.
--sarif / --json / --mdExport formats for executive audits.OASIS SARIF 2.1.0 for GitHub Security, JSON for SBOMs, Markdown for `gh pr comment`.

7. Enterprise Custom Governance (`stratametriq.config.yml`)

Enforce organizational architecture standards across your monorepo or layered application. Define forbidden import boundaries in a root `stratametriq.config.yml` file. Any violation is automatically flagged with red diagnostic squiggles in VS Code and breaks CI/CD gating:

stratametriq.config.yml
version: 1
rules:
  - name: "UI layer cannot import Database layer directly"
    source: "src/ui/**"
    forbiddenTarget: "src/db/**"
    severity: "HIGH"
    message: "UI components must go through src/services/ or API endpoints."
  - name: "Domain models must remain framework agnostic"
    source: "src/domain/**"
    forbiddenTarget: "src/infrastructure/**"
    severity: "HIGH"
    message: "Domain entities cannot depend on database or HTTP adapters."

8. Market Comparison: Why StrataMetriq?

In a typical engineering organization, developers must piece together 3 to 4 separate, expensive tools (`Datadog`, `CodeScene`, `GitGuardian`, `Madge`) to get what StrataMetriq delivers natively out of the box inside your IDE:

Feature DomainStandard VS CodeTraditional Market ToolsStrataMetriq (Our USP)
Pre-Deployment Audits❌ None. Allows deploying debug code & secrets.GitGuardian / TruffleHog / SonarLint: Fragmented per-file checks.✅ All-in-One 13-Point Audit with instant line jumping & zero false positives.
API Lifecycle Tracing❌ Manual file hunting across layers.Datadog / Dynatrace / New Relic: Expensive runtime APM ($100+/mo).✅ Static Pre-Deployment API Tracing right inside your IDE before deployment.
Dependency Graphs❌ No visual tree graph view.Madge / Dependency-Cruiser: Static SVG image exports via terminal.✅ Interactive Glassmorphic Webview synced right with open editor tabs (`[Open]`).
Risk Impact Analysis❌ Flat text via "Find All References".CodeScene / Understand: Desktop software ($1,000+/year per seat).✅ Instant Downstream Ripple Analysis across APIs, controllers, and tables.

9. Building From Monorepo Source (`extension/`, `dashboard/`, `scanner/`, `cli/`)

To compile and package the `stratametriq-extension-1.3.0.vsix` bundle directly from source:

Monorepo Build Script
# 1. Install dependencies across all monorepo packages
npm install

# 2. Build the AST scanner engine
cd scanner && npm run build

# 3. Build the Vite React dashboard webview bundle
cd ../dashboard && npm run build

# 4. Compile the extension backend and package the VSIX bundle
cd ../extension && npm run build
# Output: stratametriq-extension-1.3.0.vsix inside extension/