-
Using dependency graphs and complexity metrics to drive AI‑assisted refactoring
“I have a some tools that build dependency graphs (C# and Python) and store the results in a local database. Agents seem quite good at poking at this and coming up with refactor ideas.” — woggy
“I've been feeding agents dependency graphs plus CC and coverage data from a local store, and it works well for spotting cyclical deps and high‑CC hotspots.” — cryptolobster -
Debate over cyclomatic complexity as a proxy for security or code quality
“Buffer overflow checks are really only going to be a linear growth in CC. It's when things move towards exponential growth or higher that it gets really easy to introduce flaws of many kinds.” — pixl97
“Overall cyclomatic complexity is a useful metric, but it does have one shortcoming when used with modern languages: it was invented before polymorphism really became a thing… it really only counts explicit branching.” — bunderbunder
“It’s not obvious to me because cyclomatic complexity is not a straightforward proxy for the number of systems that are being combined.” — bunderbunder -
Practical experiences and pitfalls of relying on CC (including security angle)
“From a security perspective cc is highly relevant. I use it to get a solid rating of the security aspects of Python code.” — runningmike
“Worst things happen always when 2 or more systems are combined because each system might be simple on its own, yet a combination is always much more complex.” — ozim
“Fun story: at my previous aaaawful company CC was discovered as a thing to care about… Cue an avalanche of completely unreviewable diffs.” — throwyawayyyy
Cyclomatic Complexity in C#
📝 Discussion Summary (Click to expand)
🚀 Project Ideas
Generating project ideas…
Agentic Dependency Graph Service
Summary
- Provides language‑agnostic dependency graphs (call & module) stored in a queryable DB for AI agents to run clustering, centrality, and refactor‑suggestion algorithms.
- Core value: gives agents rich structural data to generate smarter, safe refactor ideas beyond simple cycle detection.
Details
| Key | Value |
|---|---|
| Target Audience | Developers using AI coding assistants for large‑scale refactors |
| Core Feature | Auto‑extract dependency graph, store in Neo4j/SQLite, expose GraphQL/REST endpoints for agents to run algorithms (e.g., Louvain clustering, betweenness) |
| Tech Stack | Python (networkx, py2neo or sqlite3), FastAPI, Docker, optional Neo4j |
| Difficulty | Medium |
| Monetization | Revenue-ready: tiered SaaS ($10‑$50/mo per repo) |
| #### Notes | |
| - HN users like woggy said “Agents seem quite good at poking at this and coming up with refactor ideas” and cryptolobster feeds agents dependency graphs plus CC data. | |
| - Enables discussion on new graph‑based refactor tactics and practical utility for teams wanting automated, agent‑driven cleanup. |
Dynamic Dispatch Complexity Analyzer
Summary
- Extends traditional cyclomatic complexity by counting possible dispatch paths from polymorphism and higher‑order functions, yielding a more accurate complexity metric for modern OO/FP code.
- Core value: gives teams a better signal for readability and maintenance risk where CC falls short.
Details
| Key | Value |
|---|---|
| Target Audience | Developers frustrated with CC limits in C#, Java, Scala, or functional languages |
| Core Feature | Static analysis (AST + type inference) to enumerate virtual/interface calls and HOF applications, compute path count; optional runtime tracing to validate |
| Tech Stack | Python (ast, mypy, typed_ast) for .NET use Roslyn via pythonnet; or use Tree-sitter grammars; backend in Rust for speed |
| Difficulty | High |
| Monetization | Revenue-ready: per‑seat license ($12/user/mo) or open‑source core with paid cloud analytics |
| #### Notes | |
| - bunderbunder noted “CC was invented before polymorphism… it really only counts explicit branching” and that “higher‑order functions also introduce forms of branching that CC doesn’t measure.” | |
| - Provides a concrete tool to address that critique, sparking discussion on better complexity measures and enabling teams to prioritize refactoring where it matters. |
Security‑Aware Complexity Hotspot Finder
Summary
- Combines cyclomatic complexity with lightweight taint/data‑flow analysis to flag functions that are both complex and handle untrusted input, highlighting likely security‑problem areas.
- Core value: helps developers focus review and testing on the riskiest code, bridging the gap between complexity metrics and actual vulnerability likelihood.
Details
| Key | Value |
|---|---|
| Target Audience | Security‑conscious developers and auditors working with Python, C#, or JavaScript |
| Core Feature | Run existing CC tool (e.g., radon) + simple taint analysis (identify sources like request.form, sinks like exec, SQL) and output a ranked list of high‑CC, taint‑touching functions |
| Tech Stack | Python (radon, bandit, tree-sitter), optional Rust extension for speed; CLI or VS Code extension |
| Difficulty | Medium |
| Monetization | Hobby (free open‑source) – can later offer hosted CI integration as paid add‑on |
| #### Notes | |
| - runningmike mentioned using a CC tool for security rating and linked to a complexity check site; bunderbunder pointed out that buffer overflows don’t raise CC, showing need for taint‑aware metrics. | |
| - Gives HN community a practical plugin they can drop into CI, prompting discussion on how to improve security scoring beyond raw CC. |