The Understanding Layer
Your AI agents write code into systems they don't understand. Your engineers ship changes whose blast radius they can't see. Substrait builds a persistent knowledge graph from structure, history, contributors, and architecture — the context layer that makes both dramatically better.
The Problem
Software companies sit on codebases worth tens of millions in accumulated engineering investment. But they cannot answer basic questions about them.
Because nobody can see that a handful of high-complexity files, owned by one developer who left six months ago, sit at the intersection of three architectural boundaries — and every team touches them without knowing.
Sprint velocity says one thing. The actual codebase says another. Complexity is rising, boundaries are eroding, and the files that change most have the worst quality scores. But these signals live in different tools that never talk to each other.
Because it sees the files it’s editing — nothing more. It has no map of your module boundaries, no memory of who owns what, no awareness of the CVE in the library it just pulled in. It writes fluent code into a system it has never been introduced to.
Is the team building new capabilities, or spending a significant share of their time reworking the same fragile modules? Leadership has no way to know without cross-referencing Git history, complexity data, and team allocation across disconnected systems.
Four Dimensions
Static analyzers see structure. Productivity tools see velocity. Vulnerability scanners see dependency risk. None of them connect these signals — which is why you can't answer the questions that actually matter about your codebase.
Structure, symbols, dependencies, complexity. A deep ruleset spanning security, correctness, and maintainability. Per-function metrics and symbol-level dependency graphs across 20 languages.
Hotspot detection, temporal coupling, and churn analysis mined from full Git history. Which files change too often, always change together, or are decaying over time.
Ownership depth, bus factor, contributor concentration. Not who committed last — who has deep, sustained expertise, and where knowledge is dangerously concentrated.
Feature work vs. rework vs. debt reduction — derived from commit classification, review patterns, and architectural impact. Know where engineering investment actually goes.
A suite of high-performance analysis engines feeds a persistent knowledge graph — designed for multi-million-line enterprise repositories. Every commit enriches the model. Every signal informs every other signal — and every one of them is queryable, in real time, by your coding agents.
Knowledge Graph
The core of Substrait is a persistent knowledge graph — not a snapshot, not a report, but a living model that gets richer with every commit. It connects code structure, change history, contributor patterns, and architectural intent into a single queryable system.
What breaks if I change this function?
Graph traversal across structural and temporal relationships — enriched with change frequency and health data.
Which files always change together?
Temporal coupling mined from Git commit co-occurrence, stored as persistent graph relationships.
Who is the expert on this module?
Ownership analysis from commit patterns — weighted by recency, frequency, and contribution depth.
Is our architecture holding or eroding?
Symbol-level dependency analysis against declared domain boundaries, tracked over time.
Why does this module keep breaking?
Combines hotspot detection, complexity metrics, ownership concentration, and the coupling graph.
Every commit enriches the graph. Every analysis adds context. After six months, the model knows things about your codebase that would take a new principal engineer weeks to piece together — and that your coding agents, reading fresh, will never piece together at all.
Depth Score
A composite score from 0 to 100, computed across security, maintainability, and team dimensions. Not a vanity metric — each component traces to specific files, and the knowledge graph shows exactly what to address first.
Integration Surfaces
Substrait is not a dashboard engineers check once a week. It's the context layer every coding interface plugs into — in the editor where humans write, in the reasoning loop where agents generate, in the pipeline where changes land, and in the reports leadership relies on.
Where code gets written
Substrait Lens
A deeply integrated VS Code extension — not a linter, not a dashboard. Every save surfaces the consequences: blast radius, new findings, complexity delta, ownership, architectural drift. The Lens is where human judgment and agent-generated code are both reviewed against the full knowledge graph, before anything gets committed.
MCP Server
The same knowledge graph, exposed to every coding agent through the Model Context Protocol. Agents stop writing blind — they query architectural boundaries, ownership, blast radius, and vulnerability data before they generate. Context is the difference between autocomplete and engineering.
Where decisions get made
CI/CD Gates
Context-aware quality gates that go beyond pass/fail. A vulnerability in a high-churn, single-owner file gets a different risk assessment than the same issue in a stable, well-owned module.
Command Center
Portfolio-level health views, investment allocation analysis, architectural governance, and risk quantification. Evidence for board reporting, M&A due diligence, and compliance — not gut feel.
Why Substrait
Existing tools analyze a snapshot and produce a report. Substrait builds a living model that compounds understanding with every commit — and makes it available to your team, your AI tools, and your pipelines.
Context
In 2026, the most productive engineer on your team is a coding agent — and it’s writing into systems it has never seen. Substrait is the context layer agents query before they generate. Context is the difference between autocomplete and engineering.
Persistent
Every commit, every analysis, every PR enriches a persistent knowledge graph. After six months, the model knows things about your codebase that no agent — and no new principal engineer — could piece together from a fresh read.
Cross-Signal
A CVE in a high-churn file owned by one developer who's on vacation — that's a critical risk. But you can only see it if you connect vulnerability data, change patterns, and ownership analysis in one model.
Pre-Commit
Analyze the impact of uncommitted code — whether a human wrote it or an agent generated it — against the full knowledge graph. Blast radius, architectural drift, and risk scoring, in the editor, before the commit.
Polyglot
Language-agnostic parsers produce a uniform symbol graph regardless of language. Polyglot repositories — the norm at any scale — get the same depth of understanding across all their code.
One System
Static analysis, vulnerability scanning, DORA metrics, architectural conformance, contributor intelligence — one platform where every signal informs every other, instead of disconnected tools that never share context.
Security
CWE/OWASP-mapped rules, CVE scanning with SBOM generation, and vulnerability lifecycle tracking. A critical CVE in a high-churn, single-owner file gets prioritized over the same CVE in stable, well-owned code.
People
Ownership depth, bus factor analysis, team coupling, and contribution patterns — who has deep expertise, where knowledge is concentrated, and what happens to your payment system if someone leaves.
Documentation
A hierarchical wiki generated from the knowledge graph and incrementally refreshed as the code evolves. Documentation that stays current without manual effort.