ripwire

ripwire is Red Hat Emerging Technologies' answer to one expensive habit: agents that grep around a repository and read whole files to answer a question a call graph already answers. The project calls itself the ripgrep of AI context. Point it at a repository and it prints a ranked symbol map: the symbols that matter for the task you are about to do, who calls them, and which tests reach them.

The first-party repository was created on 2026-07-29 under Apache-2.0. On 2026-09-20 GitHub listed 2,277 stars and 145 forks, and the advertised release line was 0.6.1. The binary is single-file C++23 with no runtime dependencies; every dependency, including 25 tree-sitter grammars, is vendored in-tree, so a source build finishes with the network off. Stars are a heat signal here, not traffic.

The CLI is the primary interface on purpose. ripwire on your PATH costs an agent nothing until it runs a command, while MCP tool schemas ride in the context window every session, whether or not they get called.

Key Features

• A map before the read: ripwire . --for="add retry to the upload path" returns ranked symbols, callers, and the tests that reach them.
• Impact before the edit: --callers, --uses, --impact, and --affected answer "what breaks if I change this" without an editor plugin.
• 25 tree-sitter grammars: Rust, C++, Objective-C/C++, C, Python, Go, Swift, TypeScript, JavaScript, Java, Ruby, PHP, Lua, Elixir, Dart, Kotlin, GDScript, Bash, C#, plus JSON, TOML, YAML, and Markdown.
• MCP when you want it: ripwire wrap <agent> prints the registration recipe for Claude, Codex, or OpenCode instead of editing your config. --mcp --listen=HOST:PORT is one of only two modes that open a network socket.
• 17 task-shaped skills: skills/install.sh teaches an agent when to reach for which verb, so it does not treat 182 long flags as a menu.

The project publishes its own comparison sweep against a leading graph-database code-context MCP server: won 27, lost 7, tied 14 on 48 matched questions across django, webpack, and its own repository, spending about 77K tokens against the other tool's ~486K. Treat every one of those numbers as a vendor benchmark, not an independent audit.

Use Cases

• Cold orientation: a fresh session in a large repository gets the two or three files that matter instead of a directory listing.
• Change review: before an agent edits anything, ask what the blast radius is and which tests should run.
• Token budgets: a task-scoped map replaces the read-everything-then-decide loop that burns context on files nobody needed.

Limitation: ripwire advises, it never edits or executes anything for you, and "just grep for it" is treated as a legitimate answer. History-backed commands need git on the path and a real checkout, and the tool measures complexity rather than fixing it.

Pricing

There is no paid tier and no hosted service published as of 2026-09-20.

Getting Started

RIPWIRE_REPO=redhat-et/ripwire bash -c "$(curl -fsSL https://raw.githubusercontent.com/redhat-et/ripwire/main/scripts/install.sh)"
export PATH="$HOME/.local/bin:$PATH"
cd your-repo
ripwire . --for="<the change you are about to make, in words>"

Then tell the agent to use it: "Use ripwire on this repo." First-party entry points are INSTALL.md, docs/COMMANDS.md, and docs/LIMITS.md.

Frequently Asked Questions

Is this just code search?

No. Search finds strings. ripwire ranks symbols for a task and reports callers, reaching tests, and blast radius.

Does it need a server, embeddings, or an index?

No API key, no embeddings, no daemon, and no index server. A git URL input and --mcp --listen are the only paths that touch the network.

Can I run it in CI?

The build needs CMake 3.24+ and a C++23 compiler and nothing else, so it can be built offline in a pipeline.

Alternatives

• Serena: LSP-backed semantic code toolkit exposed to agents over MCP.
• Chrome DevTools MCP: the browser side of an agent loop rather than the repository side.
• Claude Code: the host agent itself. ripwire is what you hand it before it starts reading.

Tips

1. Install the skills, not just the binary. Without them an agent reaches for the full map every time, including the times it should not.
2. Write --for= in the caller's own words. The ranking is only as good as the task sentence.
3. Re-run after large refactors. The map is derived, not cached, so stale truth is never served.

Conclusion

ripwire is a cheap, deterministic first move for coding agents in large repositories: build the call graph, rank it against the task, and read fewer bytes. Try it when an agent's opening move in a new repository is still a directory listing and a full-file read.