13 releases

new 0.4.0	May 11, 2026
0.2.4	Apr 28, 2026
0.1.6	Apr 23, 2026

#1046 in Artificial intelligence

Used in tldr-cli

AGPL-3.0

11MB
224K SLoC

tldr

Token-efficient code analysis for LLMs. 40+ commands across AST, call graph, data flow, security, and quality — output optimized for machine consumption.

Why

LLMs waste context on raw source dumps. tldr extracts the signal: function signatures, call graphs, taint flows, complexity metrics, dead code — as structured JSON that fits in a fraction of the tokens.

18 languages: Python, TypeScript, JavaScript, Go, Rust, Java, C, C++, Ruby, Kotlin, Swift, C#, Scala, PHP, Lua, Luau, Elixir, OCaml.

Installation

Standard install (recommended)

cargo install tldr-cli

This gives you 60+ analysis commands — everything except natural-language semantic search.

With semantic search

cargo install tldr-cli --features semantic

Adds three commands:

tldr semantic '<query>' <path> — natural-language code search
tldr embed <path> — build embedding index
tldr similar <file> — find similar fragments

This pulls in fastembed + ONNX Runtime. On first run it downloads the arctic-embed-m model (~110MB, cached). Builds reliably on Mac. Other platforms are unverified — if it doesn't compile for you, a PR with the fix is very welcome.

Quick start

# What's in this codebase?
tldr structure src/

# Who calls this function?
tldr impact parse_config src/

# Find dead code
tldr dead src/

# Security scan
tldr secure src/

# Full health dashboard
tldr health src/

Commands

AST Analysis (L1)

Command	Description
`tree`	File tree structure
`structure`	Code structure — functions, classes, imports
`extract`	Complete module info
`imports`	Parse import statements
`importers`	Find files importing a module

Call Graph (L2)

Command	Description
`calls`	Cross-file call graph
`impact`	Reverse call graph — who calls this?
`dead`	Dead code detection
`hubs`	Hub functions (centrality analysis)
`whatbreaks`	What breaks if target changes?

Data Flow (L3-L4)

Command	Description
`reaching-defs`	Reaching definitions
`available`	Available expressions (CSE detection)
`dead-stores`	Dead store detection (SSA-based)

Program Dependence (L5)

Command	Description
`slice`	Backward program slice
`chop`	Chop slice (forward + backward intersection)
`taint`	Taint flow analysis

Security

Command	Description
`secure`	Security dashboard
`taint`	Taint flows (injection, XSS)
`vuln`	Vulnerability scanning
`api-check`	API misuse patterns
`resources`	Resource leak detection

Quality & Metrics

Command	Description
`smells`	Code smells
`complexity`	Cyclomatic complexity
`cognitive`	Cognitive complexity
`halstead`	Halstead metrics
`loc`	Lines of code
`churn`	Git churn analysis
`debt`	Technical debt (SQALE)
`health`	Health dashboard
`hotspots`	Churn x complexity
`clones`	Code clone detection
`cohesion`	LCOM4 cohesion
`coupling`	Afferent/efferent coupling

Patterns & Architecture

Command	Description
`patterns`	Design pattern detection
`inheritance`	Class hierarchies
`surface`	API surface extraction

Contracts & Verification

Command	Description
`contracts`	Pre/postcondition inference
`specs`	Extract test specs
`invariants`	Infer invariants from tests
`verify`	Verification dashboard
`interface`	Interface contracts

Search & Context

Command	Description
`search`	BM25 search with structural context
`semantic`	Natural language code search *
`similar`	Find similar code fragments *
`context`	LLM-ready context from entry point
`definition`	Go-to-definition
`explain`	Comprehensive function analysis

* Requires the semantic feature: cargo install tldr-cli --features semantic

Aggregated

Command	Description
`todo`	Improvement suggestions
`diff`	AST-aware structural diff
`fix`	Diagnose and auto-fix errors
`bugbot`	Automated bug detection on changes

Output formats

--format json      # Default — structured, machine-readable
--format text      # Human-readable
--format compact   # Minified JSON for piping
--format sarif     # GitHub/VS Code integration
--format dot       # Graphviz visualization

Daemon mode

For repeated queries, the daemon caches results in memory:

tldr daemon start
tldr warm src/          # Pre-warm cache
tldr calls src/         # Fast — cache hit
tldr daemon stop

Documentation

For detailed documentation, see the docs/ folder:

License

AGPL-3.0

Dependencies

~281MB
~8M SLoC