Open Source Radar — October 21: Graphify, Cloudflare audit skill
Three projects on today's board, and none of them is a model. The energy has moved to the layer that tells an agent how to do a job properly.
graphify (Python, 125,640 stars) — A skill that turns a whole codebase, plus its docs, SQL schemas, configs and PDFs, into a knowledge graph your agent queries instead of grepping file by file. Code is parsed locally with tree-sitter, so the code half is deterministic and nothing leaves the machine; docs and PDFs get a semantic pass from whatever model your assistant already has. The design choice worth noting is that every edge is tagged as read directly from the source or inferred during resolution, so you can see which connections are evidence and which are the tool's guess. There is no vector store and no embedding step — it is a graph you traverse, and you can ask it to trace the shortest path between any two concepts. It runs inside Claude Code, Cursor, Codex, Gemini CLI and fifteen other harnesses, sits at 232 releases since April, and the company behind it is in Y Combinator's S26 batch, per the project's README.
security-audit (JavaScript, 28,432 stars) — Cloudflare open-sourced the skill that seeded its own vulnerability-hunting harness: an agent runs a six-phase audit, mapping trust boundaries first, then sending isolated hunters at each unit, then handing every candidate finding to a fresh verifier whose job is to disprove it. That adversarial split is the whole point — the agent that checks a finding is never the one that found it — and the output is machine-readable rather than prose, with confirmed, needs-validation and rejected kept as separate verdicts so a guess never arrives dressed as a bug. The README's most interesting number is a humility note: in Cloudflare's own test runs a single pass found roughly half the vulnerabilities that repeated runs found in total. Two caveats before you point it at production code: it needs a real OS-level sandbox to build and run target code, and without one it downgrades leads to needs-validation instead of executing anything.
knowledge-work-plugins (Python, 29,147 stars) — Anthropic's own plugin set for Claude Cowork, also usable in Claude Code: eleven job functions — sales, legal, finance, data, marketing, product management, customer support, recruiting-adjacent productivity, enterprise search, bio-research and plugin management — each bundling the skills, slash commands and MCP connectors that role actually needs. Everything is markdown and JSON, no code and no build step, which is what makes the second half of the pitch credible: you are meant to fork these and swap in your own tools, terminology and process rather than run them as shipped. The connectors are the honest tell about who this is for — HubSpot, Snowflake, Box, Jira, Microsoft 365, PubMed — knowledge work, not engineering. If your company is evaluating Cowork, this is the fastest way to see what a role-specific agent looks like before you write your own.
Which of these would you actually let loose on your codebase — the auditor or the graph? Write to us via our contact page.
