Parses source code into Abstract Syntax Trees for accurate symbol extraction without regex
Parses source code into Abstract Syntax Trees for accurate code analysis. Provides reliable symbol extraction, variable flow tracing, and code structure understanding without LLM hallucination risks from regex-based parsing.
Implementation Note: This skill uses AST parsing techniques (language-aware parsing through the agent's code understanding capabilities) to analyze code structure.
Core Principle: AST parsing is more reliable than regex for code analysis.
Parse source code into a structured tree representation:
Extract code symbols with 100% accuracy:
Trace where variables are:
Understand code structure:
| Language | File Extensions |
|---|---|
| TypeScript | .ts, .tsx |
| JavaScript | .js, .jsx |
| Python | .py |
| Go | .go |
| Rust | .rs |
| Java | .java |
| C/C++ | .c, .cpp, .h |
Extract symbols from files to build accurate context maps:
Input: src/auth.ts
Output:
- class AuthService
- method login(email, password)
- method logout()
- method refreshToken(token)
- interface User
- const TOKEN_EXPIRY: number
Trace user input flow to dangerous sinks:
Input: req.body.name
Flow: → validateInput() → sanitize() → db.query()
Result: Safe (sanitized before use)
Find all dependencies of a module:
Input: src/api/users.ts
Dependencies:
- src/services/auth.ts (AuthService)
- src/models/user.ts (User)
- src/utils/validation.ts (validateEmail)
### 📋 Symbol Analysis: src/auth.ts
**Exports:**
- `AuthService` (class)
- `login(email: string, password: string): Promise<User>`
- `logout(): void`
- `refreshToken(token: string): Promise<string>`
- `User` (interface)
- `TOKEN_EXPIRY` (constant): number
**Imports:**
- `bcrypt` from 'bcrypt'
- `jwt` from 'jsonwebtoken'
- `User` from './models/user'
**Internal Functions:**
- `hashPassword(password: string): string`
- `verifyToken(token: string): DecodedToken`
### 🔍 Variable Flow: userInput
**Definition:** Line 15 - `const userInput = req.body.name;`
**Usages:**
- Line 18: Passed to `validateInput(userInput)`
- Line 22: Passed to `sanitize(userInput)`
- Line 25: Passed to `db.query('...', [sanitizedInput])`
**Result:** userInput is sanitized before database query ✅
Used by:
Related Skills:
code-analyzer: Uses AST for complexity metricssecurity-scanner: Uses AST for vulnerability pattern detectiontoken-tracker: Uses AST for context compression| Situation | Action |
|---|---|
| Unsupported language | Fall back to regex-based extraction |
| Parse error | Report error, suggest manual review |
| Large file | Parse in chunks or extract summary |
| Malformed code | Report syntax errors, skip file |