TOOLS · OX-CODES

Code search +
structural rewrite +
dataflow

ripgrep, tree-sitter, and ast-grep exposed behind one stateless JSON API. Drop it next to any codebase; no auth, no indexing step, no state.

View on GitHub API reference

What it does

Language-aware search

ripgrep backend with tree-sitter AST scoping. Search inside function bodies, class definitions, or import blocks — regex confined to the construct you actually care about. 15 languages: Go, Rust, TypeScript, Python, Java, C, C++, and more.

Structural queries

ast-grep $WILDCARDS match any subtree regardless of whitespace or variable naming. Find every call site where the first argument is a string literal — not a regex, a syntactic fact.

// pattern
fmt.Errorf($MSG)

// matches any
fmt.Errorf("not found")
fmt.Errorf(msg)

Structural rewrite

Search-and-replace at AST level. Returns a unified diff before touching any file. Safe to preview, safe to apply.

// unified diff output
- errors.New($MSG)
+ fmt.Errorf($MSG)

Dataflow analysis

Dead store detection, unused variable tracking, and source-to-sink taint tracing. No runtime required — purely static.

Stateless HTTP service

No database, no auth, no indexing. Mount a repo path, POST JSON, get results. Runs on port 8902 by default; single binary, single make run.

Endpoints

Method + path	What it does
`POST /search`	grep-like full-text search via ripgrep
`POST /search/scoped`	regex confined inside AST node regions (tree-sitter)
`POST /search/structural`	pattern match with `$WILDCARDS` (ast-grep)
`POST /rewrite`	structural search-and-replace, returns unified diff
`POST /dataflow/analyze`	dead stores, unused variable detection
`POST /dataflow/taint`	source-to-sink taint tracking
`GET /health`	liveness probe

Quick start

Build and run in under a minute. Requires Go 1.22+ and make.

# clone and build
git clone https://github.com/anatolykoptev/ox-codes
cd ox-codes
make build
make run

# search for all error returns in a repo
curl -sX POST http://127.0.0.1:8902/search \
  -H 'Content-Type: application/json' \
  -d '{"repo":"/path/to/repo","pattern":"return.*err","language":"go"}' \
  | jq '.matches | length'

# structural query — find every fmt.Errorf call
curl -sX POST http://127.0.0.1:8902/search/structural \
  -H 'Content-Type: application/json' \
  -d '{"repo":"/path/to/repo","pattern":"fmt.Errorf($MSG)","language":"go"}'

ox-codes vs go-code

ox-codes is a stateless HTTP engine: code search, structural rewrite, and dataflow analysis behind a JSON interface. No MCP layer, no knowledge graph, no embeddings, no observability overhead. Useful standalone for any tool that needs a code search HTTP backend.

go-code (Krolik) is the full platform built on top of ox-codes. It adds 28 MCP tools, a live knowledge graph backed by Apache AGE, semantic search via embeddings, OTel-backed runtime debugging attribution, and agent-facing interfaces for Claude Code, Cursor, and Windsurf.

Use ox-codes when you want the engine only. Use Krolik when you want the platform.

Open source · MIT license

Start here.

github.com/anatolykoptev/ox-codes Full API docs & examples

Code search + structural rewrite + dataflow