# Riftmap

> Riftmap is the cross-repo infrastructure dependency graph — parsed from source, never catalogued. It scans your GitLab or GitHub organisation, maps every cross-repository dependency — Terraform modules, Docker base images, CI/CD templates, Python packages, Go modules, npm packages, Helm charts, Ansible roles, Kubernetes manifests, Kustomize overlays, and ArgoCD applications — and shows you exactly what breaks when you make a change. The same graph is served two ways: an interactive UI for engineers, and an HTTP API for AI coding agents to query during planning.

Riftmap is live as a managed cloud service at app.riftmap.dev. A self-hosted deployment option is planned for the future. The HTTP API ships with every deployment.

## What Riftmap does

- Automatically discovers and maps cross-repo dependencies across an entire org
- Supports 12 ecosystems: Terraform, Docker, GitLab CI, GitHub Actions, Python, Ansible, Helm, Go, npm, Kubernetes, Kustomize, ArgoCD
- Visualises dependency graphs with blast-radius analysis
- Shows which repositories are affected when a shared component changes
- Exposes the same graph as an HTTP API for AI coding agents — three endpoints (`/repositories/lookup`, `/repositories/{id}/context`, `/repositories/{id}/impact`) callable from Claude Code, Cursor, or any tool that can consume an OpenAPI schema. MCP server and CLI on the roadmap.
- Works with GitLab (CE/EE) and GitHub (cloud and Enterprise)
- Managed cloud service: zero infrastructure to set up, isolated per workspace
- Free tier: your whole org as a complete dependency graph, up to 250 repos, with free unlimited read-only viewer seats for the whole team, no credit card required; the read-only HTTP API for agents is included on every tier (starter limits on Free, production limits on paid)
- Riftmap also computes per-repo bus factor from git author metadata and crosses it with dependency fan-in to flag single-maintainer, high-blast-radius repos (concentration risk)

## Target users

Platform engineers, DevOps teams, and engineering leads at companies with 10–200+ repositories who need to safely manage shared infrastructure and understand the downstream impact of changes.

AI coding agents working across more than one repository (Claude Code, Cursor, Codex, and similar) are a second class of consumer: they call the HTTP API during planning to resolve repos, hydrate dependencies/dependents, and check transitive blast radius — a query that would otherwise cost ~6,000 tokens of file exploration is reduced to a ~200-token lookup.

## Key problems solved

- "What breaks if I update this Terraform module?" — answered instantly
- Replaces manual grepping, stale Backstage catalogs, and tribal knowledge
- Fills the gap that Renovate/Dependabot, HCP Terraform Explorer, and monorepo tooling leave

## Pricing

- Free: $0/month forever — complete graph for your whole org (up to 250 repos), 1 editor seat + unlimited free read-only viewers, 1 Git org connection, all 12 parsers, on-demand scans, starter API limits
- Pro: $49/month — everything in Free plus scheduled/continuous rescans, production API & agent access, consumer-artifact dashboard, unlimited repos (fair use), 5 editor seats + unlimited free viewers
- Business: $149/month — everything in Pro plus multiple Git org connections, 15 editor seats + unlimited free viewers, priority scan queue (coming soon)
- Seats: read-only viewers are free and unlimited on every plan; you pay only for editor seats — the people who connect orgs, run scans, and wire Riftmap into their workflow
- Enterprise: custom pricing — self-hosted, SSO, audit logs, SOC 2, custom limits; contact hello@riftmap.dev
- Design partners: early teams that run Riftmap on real repos and give candid feedback get Pro or Business free for 6 months (whichever fits the org's size), with launch pricing locked in after — https://riftmap.dev/design-partners/

## Showcases

Interactive dependency graphs of real open-source organisations, scanned by Riftmap. Each page embeds the live graph component — pan, zoom, click any repository to see its dependencies/dependants, and simulate the blast radius of a breaking change.

Every figure below is from a specific dated scan. Riftmap re-scans these orgs over time, so the same organisation legitimately produces different counts on different dates — always carry the date with the number.

- Showcase index: https://riftmap.dev/showcase/
- "Prometheus dependency graph — interactive showcase" — 56 repos (5 archived), scanned 27 April–17 May 2026. Across the 51 active repos: 160 distinct repo-to-repo dependencies at the 0.8 confidence floor, 17 repos (33.3%) load-bearing for a sibling; busiest is prometheus/client_model at 23 direct dependents. CSV exports: https://riftmap.dev/data/showcase/prometheus-edges.csv and https://riftmap.dev/data/showcase/prometheus-repos.csv — page: https://riftmap.dev/showcase/prometheus/
- "Cloud Posse dependency graph — interactive showcase" — 242 repos (1 archived), scanned 7–10 July 2026. Across the 241 active repos: 299 distinct repo-to-repo dependencies at the 0.8 confidence floor, 61 repos (25.3%) load-bearing; one Terraform module (cloudposse/terraform-null-label) is declared by 146 of them at the floor, 147 counting every declared reference. CSV exports: https://riftmap.dev/data/showcase/cloudposse-edges.csv and https://riftmap.dev/data/showcase/cloudposse-repos.csv — page: https://riftmap.dev/showcase/cloudposse/
- "OpenTelemetry dependency graph — interactive showcase" — 105 repos (25 archived), scanned 28 June–25 July 2026. Across the 80 active repos: 133 distinct repo-to-repo dependencies at the 0.8 confidence floor out of 461 declared, 19 repos (23.8%) load-bearing; busiest is open-telemetry/shared-workflows at 22. The floor matters most here: opentelemetry-specification is referenced by 52 siblings and scores zero, because every one of those references is a bare git URL rather than a declared dependency. CSV exports: https://riftmap.dev/data/showcase/open-telemetry-edges.csv and https://riftmap.dev/data/showcase/open-telemetry-repos.csv — page: https://riftmap.dev/showcase/open-telemetry/
- "Flux CD dependency graph — interactive showcase" — 50 repos (18 archived), scanned 13–25 July 2026. Across the 32 active repos: 93 distinct repo-to-repo dependencies at the 0.8 confidence floor, 15 repos (46.9%) load-bearing — the highest rate of any org Riftmap has scanned; busiest is fluxcd/pkg at 16. CSV exports: https://riftmap.dev/data/showcase/fluxcd-edges.csv and https://riftmap.dev/data/showcase/fluxcd-repos.csv — page: https://riftmap.dev/showcase/fluxcd/

Reconciling the Cloud Posse terraform-null-label consumer counts (these are NOT contradictory — they are different dated measurements, and quoting one without its date or its confidence floor is the error):
- 147 of 242 repos — scan of 7 July 2026, counted at the 0.8 confidence floor. This is the figure used across the blog corpus and on the showcase page.
- 148 of 242 repos — the same 7 July 2026 scan with NO confidence floor. The showcase graph renders all 148 because one edge scores 0.6; the other 147 score 0.9 or 1.0.
- 146 of 241 repos — scan of 14 July 2026, the nine-org comparison run (https://riftmap.dev/blog/cross-repo-blast-radius-9-orgs/).
- 149 of 244 repos — scan of 18 July 2026 (https://riftmap.dev/blog/is-gitlab-orbit-a-developer-portal/). The org itself grew by three repos between 7 and 18 July.
- 149 of 244 repos — scans of 27 July and 7 August 2026, the most recent, both unchanged from 18 July: 141 of the 149 pinned to 0.25.0, eight on lagging git-tag refs (https://riftmap.dev/blog/how-to-find-every-consumer-of-your-terraform-module/).

## Blog

Riftmap publishes articles on platform engineering, cross-repo dependency management, and infrastructure visibility.

- Blog index: https://riftmap.dev/blog/
- "The Infrastructure Dependency Problem No One Has Solved": https://riftmap.dev/blog/infrastructure-dependency-problem/
- "Auto-Discovering Infrastructure Dependencies Across 10 Ecosystems": https://riftmap.dev/blog/auto-discovering-infrastructure-dependencies-across-10-ecosystems/
- "The State of Infrastructure Dependency Tooling in 2026": https://riftmap.dev/blog/the-state-of-infrastructure-dependency-tooling-2026/
- "How to Find Every Consumer of Your Docker Base Image": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-docker-base-image/
- "How to Find Every Consumer of Your Terraform Module": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-terraform-module/
- "How to Find Every Consumer of Your GitHub Actions Workflow": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-github-actions-workflow/
- "How to Find Every Consumer of Your Helm Chart": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-helm-chart/
- "How to Find Every Consumer of Your Go Module": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-go-module/
- "How to Find Every Consumer of Your GitLab CI Template": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-gitlab-ci-template/
- "How to Find Every Consumer of Your Internal npm Package": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-internal-npm-package/
- "How to Find Every Consumer of Your Internal Python Package": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-internal-python-package/
- "How to Find Every Consumer of Your Ansible Role": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-ansible-role/
- "Blast radius in software engineering: what it is, how to measure it, how to contain it": https://riftmap.dev/blog/blast-radius-software-engineering/
- "AI Doesn't Understand Blast Radius: Why Change Failure Rates Are Up 30%": https://riftmap.dev/blog/ai-doesnt-understand-blast-radius/
- "Change failure rate is up 30% — here's how to measure yours in an afternoon": https://riftmap.dev/blog/measure-your-change-failure-rate/
- "What 56 Prometheus repos actually depend on": https://riftmap.dev/blog/what-56-prometheus-repos-depend-on/
- "What 208 kubernetes-sigs repos actually depend on": https://riftmap.dev/blog/what-208-kubernetes-sigs-repos-actually-depend-on/
- "What 242 Cloud Posse repos actually depend on": https://riftmap.dev/blog/what-242-cloudposse-repos-depend-on/
- "Cross-repo blast radius in nine public platform orgs: the most depended-on repo at Grafana isn't Grafana": https://riftmap.dev/blog/cross-repo-blast-radius-9-orgs/
- "The catalog maintenance trap: why service catalogs go stale": https://riftmap.dev/blog/the-catalog-maintenance-trap/
- "Meta needed 50+ AI agents to map their tribal knowledge. The most durable piece of their stack is the part you can build today.": https://riftmap.dev/blog/meta-tribal-knowledge-engine-build-the-graph-first/
- "Your senior engineer just gave notice. Most of what they knew was in the repos all along.": https://riftmap.dev/blog/senior-engineer-leaving-tribal-knowledge/
- "Your senior engineer just left. Your bus factor was measuring the wrong thing.": https://riftmap.dev/blog/dependency-bus-factor/
- "AI coding agents need cross-repo context. The teams running them at scale are already building it themselves.": https://riftmap.dev/blog/ai-coding-agents-need-cross-repo-context/
- "Nx Polygraph and the synthetic monorepo": https://riftmap.dev/blog/nx-polygraph-synthetic-monorepo/
- "Cross-repo context is in product docs. The graph is not.": https://riftmap.dev/blog/cross-repo-context-is-in-product-docs/
- "Symbol graphs and artifact graphs: why Sourcegraph stops where infrastructure starts": https://riftmap.dev/blog/symbol-graphs-and-artifact-graphs/
- "Modeled graphs and parsed graphs: two architectures for cross-repo context in the agentic era": https://riftmap.dev/blog/modeled-graphs-and-parsed-graphs/
- "Inferred context is not a dependency graph": https://riftmap.dev/blog/inferred-context-is-not-a-dependency-graph/
- "Repo access was never the hard part": https://riftmap.dev/blog/repo-access-was-never-the-hard-part/
- "The CRA's 24-hour clock is a cross-repo question. Your SBOM answers a different one.": https://riftmap.dev/blog/cra-sbom-cross-repo-question/
- "A CVE just hit your base image. Your scanner won't tell you which repos to fix.": https://riftmap.dev/blog/base-image-cve-which-repos-to-fix/
- "Monorepo vs polyrepo: the debate is measuring the wrong thing": https://riftmap.dev/blog/monorepo-vs-polyrepo/
- "How to give GitHub Copilot cross-repo context today": https://riftmap.dev/blog/how-to-give-copilot-cross-repo-context/
- "Backstage alternatives in 2026: first ask why you wanted Backstage": https://riftmap.dev/blog/backstage-alternatives/
- "Is Backstage worth it? The real question is whether anyone will use it": https://riftmap.dev/blog/is-backstage-worth-it/
- "GitLab Orbit maps your whole SDLC. It still can't tell you what an infrastructure change will break.": https://riftmap.dev/blog/gitlab-orbit-and-the-artifact-layer/
- "Is GitLab Orbit a developer portal? (Orbit vs the IDPs)": https://riftmap.dev/blog/is-gitlab-orbit-a-developer-portal/
- "Overmind shows you the blast radius in your running cloud. It can't show you the repos that were building on what you changed.": https://riftmap.dev/blog/riftmap-vs-overmind/
- "You deprecated the internal library. The repos still using it never saw the warning.": https://riftmap.dev/blog/deprecate-internal-library-find-consumers/
- "You changed the shared CI template. Half the org got it instantly. The other half will never see it.": https://riftmap.dev/blog/changing-shared-ci-template-two-deployments/
- "What version constraints actually look like across real Terraform estates": https://riftmap.dev/blog/version-constraints-across-real-terraform-estates/
- "I counted every cross-repo edge in two real orgs. Not one was a code symbol.": https://riftmap.dev/blog/cross-repo-edge-composition/
- "How to Find Every Consumer of Your Kustomize Base": https://riftmap.dev/blog/how-to-find-every-consumer-of-your-kustomize-base/
- "The repo your agent didn't clone is the one it breaks": https://riftmap.dev/blog/the-repo-your-agent-didnt-clone/
- "Claude Code reads your clone. Cursor reads similarity. Neither sees the graph.": https://riftmap.dev/blog/claude-code-cursor-cross-repo-context/
- "You can index every repo in Cursor. It still can't tell you what breaks.": https://riftmap.dev/blog/cursor-monorepo-indexing/
- "Can AI check the blast radius of a PR before you merge?": https://riftmap.dev/blog/can-ai-check-blast-radius-of-pr-before-merge/
- "How to add a blast-radius gate to your merge pipeline": https://riftmap.dev/blog/blast-radius-gate-merge-pipeline/
- "Declared, inferred, registered: the three ways a tool knows a cross-repo dependency exists": https://riftmap.dev/blog/declared-inferred-registered/

## Links

- Documentation: https://docs.riftmap.dev/introduction
- Agent integration docs: https://docs.riftmap.dev/agents
- API reference (OpenAPI schema): https://app.riftmap.dev/openapi.json
- MCP server & CLI roadmap: https://docs.riftmap.dev/agents/mcp-cli-roadmap
- Status (uptime / incidents): https://status.riftmap.dev/
- Series — Find Every Consumer: https://riftmap.dev/blog/series/find-every-consumer/
- Series — What an org actually depends on (Prometheus, kubernetes-sigs, Cloud Posse): https://riftmap.dev/blog/series/org-scans/
- Homepage: https://riftmap.dev/
- App (sign up / log in): https://app.riftmap.dev
- About (founder story, principles, roadmap): https://riftmap.dev/about/
- Pricing: https://riftmap.dev/pricing/
- Design partners (Pro or Business free for 6 months for early teams): https://riftmap.dev/design-partners/
- Blog: https://riftmap.dev/blog/
- Blog RSS feed (full-text, all posts): https://riftmap.dev/rss.xml
- How it works: https://riftmap.dev/#how-it-works
- Deployment options: https://riftmap.dev/#deployment
- What is cross-repo dependency mapping — also called "cross-repo context" (glossary): https://riftmap.dev/what-is-cross-repo-dependency-mapping/
- What is AI agent blast radius (glossary — definition, the 2026 data, containment patterns, and the head-to-head on whether Claude Code, Cursor or GitHub Copilot resolves cross-repo blast radius on its own; vendor claims re-checked 27 July 2026): https://riftmap.dev/ai-agent-blast-radius/
- What is an artifact dependency graph (glossary — definition, and how it differs from symbol graphs, SBOMs/OmniBOR ADGs, and modelled catalogs): https://riftmap.dev/what-is-an-artifact-dependency-graph/
- GitHub Copilot across multiple repositories (surface-by-surface: what Copilot Chat in VS Code, Copilot Chat on github.com, Copilot Spaces, the Copilot cloud agent, Copilot CLI, Copilot code review, JetBrains IDEs and Visual Studio each reach across repositories; the four setup mechanisms; what persists between sessions; and the "which repositories" question none of them answers. Vendor claims re-checked against GitHub's and Microsoft's own docs on 27 July 2026): https://riftmap.dev/github-copilot-multi-repo/
- For AI coding agents (the graph as a tool call — three endpoints, freshness contract, working code in curl/Python/TypeScript, plus a 0:53 demo of a Claude Code session calling the API): https://riftmap.dev/for-agents/
- Security & data handling (read-only access model, token encryption, scan-pipeline hardening, multi-tenant isolation, public audit records): https://riftmap.dev/security/
- Full product description for AI: https://riftmap.dev/llms-full.txt
- Hero demo video (18s, MP4, silent): https://riftmap.dev/videos/riftmap-graph-demo.mp4 — graph view, searching for a service, impact mode showing affected consumers at depth 1 and 2, focus mode showing a repo's dependants and dependencies
- Agent demo video — short loop on the homepage (0:15, MP4, silent, 2x, autoplay loop): https://riftmap.dev/videos/riftmap-agent-demo-short.mp4 — Claude Code inside VS Code; the agent receives a prompt about deleting a helm:deploy GitLab CI job, calls the Riftmap API for cross-repo consumers, returns 51 consumers across the org, and classifies them by whether they pin a version constraint or float on main
- Agent demo video — full walkthrough (0:53, MP4, silent, 2x): https://riftmap.dev/videos/riftmap-agent-demo.mp4 — the long-form version of the short loop above; the agent surfaces all 51 consumers, calls out a caveat about edge granularity, and lives on the /for-agents/ page