Skills / arch-visualize
arch-visualize
Map a project's architecture from its code and config and generate one interactive, offline web page that shows each component with its technology icon, animated request flows between them, and possible risks such as a single database or missing rate limiting. Use when the user asks to visualize, map or explain a system's architecture or request flow. Don't use for UI mockups, live production monitoring or code-level call graphs.
- Author
- agentsaisle
- Latest
- v0.1.1
- Aisle
- architecture, web
- Works with
- Claude Code, Codex, Cursor
- Source
- HazemSalah29/agentsaisle
- Stars
- 2
Install
Install arch-visualize
npx @agentsaisle/cli add arch-visualizeInstalls into your project's skills folder. Add --global to install it for every project.
See it on a real project
DevPath is a Next.js learning platform with MongoDB, Redis and a job queue, three AI providers (Anthropic, OpenAI and Gemini), a code-execution sandbox and Docker-based practice labs. The page below is exactly what /arch-visualize generated for it, not a mock-up. It shows how requests would travel according to the code, not live traffic, and every risk is something to check, not a verdict.
This is the live page the skill wrote. Click a component, pick a flow and press Play, or open the Risks tab.
How /arch-visualize mapped it
- 01Discover (a script)discover.mjs read 4 files (package.json, docker-compose.yml, the Dockerfile and the .env.example variable names) and found 11 of the 12 components and 2 of the 13 connections. It counted .env.local as skipped and never opened it.
- 02Read (the agent)The agent searched for where each service is created and read only those lines. It added the WebSocket server the scripts cannot see, 11 more connections each with a file and line, and marked 2 connections as inferred (dashed) because no file shows them.
- 03Write the flows (the agent)4 request flows, each following the real code: run code in a lesson, ask the AI mentor, sign in with GitHub, and start an infra lab in the background. Press Play on each to watch it.
- 04Check (scripts)model-check confirmed that every item has evidence or is marked inferred and that nothing looks like a secret. risk-check then added 3 possible risks by rule (a single database, no health check, data ports published to the host). The agent added 1 from its own reading: the Docker socket mounted into the app, with its file and line.
- 05Render (a script)render.mjs wrote one offline HTML file of about 75 KB. It makes no network requests, which is why it can sit inside this page.
Runs scriptsThis skill includes scripts
Your agent may run these scripts on your machine. A maintainer has read every one in full, and the CLI lists the files when you install. You can read them on GitHub first.
Read the files on GitHubAudit
- Critical
- 0
- High
- 0
- Medium
- 0
- Low
- 2
116 files · audited 2026-10-29 · rules 1.0.0
LowAA-S07Hidden file or folder
evals/fixture-app/.env.example
Why Hidden entries are skipped by most file listings, so they are easy to overlook in a review.
Fix Remove it, or rename it so it is visible. Only .aisleaudit.yaml may be hidden.
LowAA-N01Plain http:// URL
evals/fixture-app/apps/web/app/page.tsx:2
const res = await fetch("http://api:4000/api/me");Why Plain HTTP can be read or altered by anyone on the network path.
Fix Use https://.
What this skill can use
Tools
- Read
- Write
- Glob
- Grep
- Bash(node *)
Scripts
- evals/fixture-app/apps/api/src/lib/session.ts
- evals/fixture-app/apps/api/src/routes/checkout.ts
- evals/fixture-app/apps/api/src/routes/me.ts
- evals/fixture-app/apps/api/src/server.ts
- evals/fixture-app/apps/web/app/page.tsx
- evals/fixture-app/apps/worker/src/worker.ts
- scripts/_lib.mjs
- scripts/discover.mjs
- scripts/model-check.mjs
- scripts/render.mjs
- scripts/risk-check.mjs
Domains mentioned
- api
- api.stripe.com
- github.com
Automated checks found the patterns listed here. An audit reduces risk; it is not a guarantee of safety. How audits work · Read the rules
Show this grade in a README
The badge updates when the registry is rebuilt. Paste this Markdown into the README:
[](https://agentsaisle-vercel.vercel.app/skills/arch-visualize)SKILL.md
Rendered from commit 3ff5cbf
Architecture visualizer
Reads a project's files as text, builds a model of its components and request flows, and renders docs/architecture.html. Scripts gather facts and render; you connect the components and judge the flows. <skill> below is the folder that holds this SKILL.md.
Use when
- The user asks to visualize, map or explain how a system fits together, or how a request travels through it.
- A project has more than one moving part: an app plus a database, cache, queue, worker or outside service.
Don't use when
- The user wants a UI mockup, live production monitoring, a code-level call graph or a cloud-account scan. This shows how requests would travel from the code, not real traffic.
- The project is a single static page with no services. Say so instead of drawing one box.
Steps
- Run
node <skill>/scripts/discover.mjs --root . --out docs/architecture.draft.json. Read its summary. It lists components found, files read and files skipped. It never opens.envfiles; do not open them either. - Read only the files needed to connect components: entry points, route handlers, data-access and queue modules,
docker-compose.yml. Search first (references/discovery.md). Never run or import project code. - Write
docs/architecture.jsonfrom the draft (references/model-schema.md):- Give each node a plain
label(what it does, not its package name). - Add
edges(who calls whom) withprotocol,syncand evidence (file and line). - Add 1 to 5
flows(references/flows.md): page load, login, a write, a background job. - Anything without a file to point at goes in
inferredand is drawn dashed.
- Give each node a plain
- Run
node <skill>/scripts/model-check.mjs --model docs/architecture.json. Fix every problem it lists and run it again until it passes. - Run
node <skill>/scripts/risk-check.mjs --model docs/architecture.json --root .. It adds rule-based possible risks to the model. Add your own only with evidence (references/risks.md), then run model-check again. - Run
node <skill>/scripts/render.mjs --model docs/architecture.json --out docs/architecture.html. If it refuses to overwrite a file, pick another--out; use--forceonly when the user says to replace it. - Tell the user the file path and to open it in a browser (it works offline). See
references/viewer.mdfor what the page shows.
Budget
-
Search first (grep, glob, symbol search). Read line ranges, not whole files.
-
Read at most 8 files per step. If you need more, write down what you learned and narrow the question.
-
Do not re-read a file you just wrote or edited.
-
Prefer the smallest command output that answers the question: head, tail, quiet flags, filtered lists.
-
Let
discover.mjsfind components; do not read every file looking for them. -
Read to connect components and write flows, not to review code quality.
-
Update an existing model instead of starting over: keep its labels, edges and flows, then re-run steps 4 to 6.
Output
- The path of
docs/architecture.htmlanddocs/architecture.json. - Counts: components, connections, flows, possible risks (rule-based and your own).
- Which nodes or edges are inferred, and which files or services the scripts could not see (for example Kubernetes, Terraform, Python or Go code).
- One line: generated from code, not live traffic; every risk is something to check, not a verdict.
Done when
model-check.mjsexits 0 on the final model, andrisk-check.mjsran after the last change to nodes or edges.- Every node and edge has evidence or is listed in
inferred, and every flow step points at a real edge. - No secret value appears in the model, the page or your reply.
.envfiles were not opened. docs/architecture.htmlwas written and the user knows how to open it.
Version history
| Version | Commit | Install |
|---|---|---|
| 0.1.1latest | 3ff5cbf | add arch-visualize |